ISO 9001 clause 9.2, internal audit: what it requires, what an auditor checks, and how to run one that finds something
Written from the auditor's side of the table. Clause numbers are pointers; the wording is ours, not the standard's. Last checked against the published ISO 9001:2026 text: October 12, 2026.
Internal audit is the one clause where the organization audits itself, and the one where certification auditors spend the least time reading and the most time asking. A program that covers every clause once a year and finds nothing is not evidence of a good system; it is evidence of a weak audit. Here is what 9.2 asks for, in plain words, and what an auditor does with it.
What clause 9.2 requires
Two sub-clauses. The first says why you audit; the second says how the program has to be built.
| Sub-clause | In plain words |
|---|---|
| 9.2.1 General | Audit at planned intervals to find out two things: whether the system conforms, both to your own rules for it and to the standard, and whether it is actually in use and being kept up. Conformance and effectiveness are two separate questions, and an audit that only answers the first is half an audit. |
| 9.2.2 Internal audit programme | Plan and maintain an audit program that sets frequency, methods, who is responsible, how audits are planned and how they are reported. When you build it, weigh how much each process matters, what the last audits found, and what has changed in the organization. For each audit: say what it is for, what it is checked against and what it covers; pick auditors so the audit is objective and impartial; report results to the managers concerned; and take correction and corrective action without undue delay. Keep records of the program being carried out and of the results. |
The word that matters is "programme." The standard does not require an annual schedule that touches every clause. It requires a program built from risk, history and change. Two audits a year of the three processes that matter, plus a follow-up where last year's findings were, is a program. Twelve identical checklists is a calendar.
What changed in 2026
The 2026 edition split the clause into 9.2.1 and 9.2.2 and made the program paragraph a requirement in its own right. The three things you must weigh when building it, importance of the process, previous results and changes affecting the organization, are now named. Each audit must define its objectives, not only its criteria and scope. Results go to "relevant managers," and the record requirement uses the edition's new documented-information wording. The full list of 2026 changes, clause by clause, is on the what changed page, and the document control checklist covers the references that break in an audit checklist written to the 2015 numbering.
What a certification auditor asks for
- The program, and the reasoning behind it. Not the schedule; the reason process A is audited twice and process B once. If the answer is "we do everything annually," the next question is how that reflects importance, history and change.
- Auditor independence. Who audited the quality department, and who audited the auditor's own process. A one-person quality function needs an arrangement here: a trained colleague from another area, a swap with a sister site, or a contracted auditor for the one audit the quality manager cannot do.
- A sample of audit records, read for depth. Objectives, criteria, scope, the plan, the evidence sampled, the findings, who was told, what was done and when. An audit report with no evidence listed and no findings is the record an auditor reads most carefully.
- The path from finding to closure. Finding, correction, cause, corrective action, verification. The word in the standard is "without undue delay," and a finding open for nine months with no explanation is its own finding.
- Effectiveness, not only conformance. Evidence that audits asked whether the process achieves its intended result, not only whether the procedure was followed.
The findings that come up most
- The empty audit. Three years of internal audits with zero findings, followed by a certification audit with five. The certification auditor writes it up as an ineffective audit program.
- Auditing the procedure instead of the process. The checklist asks "is there a procedure for X" and "is it followed," and never asks whether X works.
- Nobody audits the quality manager. Impartiality gap on 9.2.2 b).
- Findings that never reach the corrective action process. The audit report says "observation," the observation is filed, and the same issue appears next year. The 2026 edition asks for correction and corrective action without undue delay; a repeat finding is proof of delay.
- The checklist still cites 2015 clause numbers. After September 2026, an audit of clause 10.3 is an audit of a clause that does not exist.
The empty audit and the procedure-only audit come from the same checklist: one that asks yes-or-no questions. The $5+ ISO 9001 Internal Audit Checklist asks for evidence by clause, records what was sampled, and flags a repeat finding against last year's; the Internal Audit Program Kit adds the risk-weighted program that answers the auditor's first question, the audit plan, and closure with a 90-day check.
How to run an audit that finds something
- Build the program from three columns. For each process: how much it matters (customer impact, cost of failure), what the last audit found, and what changed since (new people, new equipment, new customer, new edition of the standard). Score them, and audit the top of the list more often.
- Write questions that produce evidence, not yes. "Show me the last three calibration records for this gauge" produces a record or a gap. "Is the gauge calibrated?" produces a nod.
- Sample, and write down what you sampled. Three records, two operators, one shift. The audit report lists them, so the next auditor samples differently.
- Ask the effectiveness question at the end of every process. Is this process achieving what it is for? What does the measure say? If nobody can name the measure, that is the finding.
- Route every finding into the corrective action process the same week, with an owner and a date, and flag repeats. A finding raised in the same clause as last time is the one that says the fix did not hold.
- Report to the managers who own the process, not to the quality file. Then carry the audit results into management review as the input 9.3.2 asks for.
The tool for this clause: the $5+ ISO 9001 Internal Audit Checklist, questions by clause that produce evidence, updated for the 2026 edition, with a findings register that flags repeats. The Internal Audit Program Kit adds the risk-weighted annual program, the audit plan, closure with a 90-day check, the management review report and a dashboard.
Not sure where your system stands on the 2026 edition?
The free readout asks thirteen questions and gives you your readiness, your timeline to the deadline, and your first three actions. Nothing you enter leaves your browser unless you ask for the optional AI reading.
Run the free readoutSee every toolQuestions
What are the internal audit requirements for ISO 9001?
Audit at planned intervals to determine whether the system conforms to your own requirements and the standard's, and whether it is implemented and maintained effectively. Build and maintain an audit program that sets frequency, methods, responsibilities, planning and reporting, weighted by process importance, previous results and change. Give each audit its objectives, criteria and scope, keep auditors objective and impartial, report results to the managers concerned, take correction and corrective action without undue delay, and keep records of the program and the results.
How often does ISO 9001 require internal audits?
The standard does not set a frequency. It requires planned intervals set by your program, weighted by how much each process matters, what previous audits found and what has changed. Most certification bodies expect every process to be covered at least once in the certification cycle and the important ones more often; a single annual audit of everything is common but is not what the clause describes.
Can the quality manager audit their own department?
No. 9.2.2 requires auditors to be selected so the audit is objective and impartial, and auditing your own work fails that test. Use a trained colleague from another function, a swap with another site, or a contracted auditor for that one audit.
What is an ISO 9001 internal audit checklist?
A list of questions organized by clause that an auditor uses to sample evidence. The useful kind asks for records and observations rather than yes-or-no answers, records what was sampled, and feeds findings into a register. A free one built that way is on this site.
Does ISO 9001 require internal auditors to be certified?
No. It requires competence (clause 7.2) and impartiality. A recognized auditor course is one way to evidence competence; documented training and supervised audits are another.