But what is an internal audit, and how do you conduct one? Read on to learn more about our ISO 9001 internal audit plan.<\/p>\r\n
\r\n<\/strong>What is an internal audit?<\/h2>\r\nAn internal audit is a core part of the ISO 9001 certification process. It\u2019s an organised process that aims to verify that an organisation\u2019s Quality Management System complies with ISO 9001 requirements and specifications.<\/p>\r\n
The purpose is to identify any gaps or areas of noncompliance within an organisation\u2019s QMS so they can be addressed before the certification audit. It also has to identify any areas of noncompliance with ISO 9001.<\/p>\r\n
Unlike an external audit, which is conducted by a third-party certification body, an internal audit is undertaken by the organisation seeking certification.<\/p>\r\n
\r\n<\/strong>The objectives of an internal audit<\/h2>\r\nConducting an internal audit can help organisations achieve several objectives:<\/p>\r\n
\r\n\t- To determine the effectiveness of the QMS in delivering high-quality output<\/li>\r\n\t
- To ensure the QMS is meeting ISO 9001 requirements and industry regulations<\/li>\r\n\t
- To identify areas for improvement in operations<\/li>\r\n\t
- To ensure the QMS is meeting specified financial and quality business objectives<\/li>\r\n\t
- To help an organisation identify any areas of weakness they have ahead of their certification audit<\/li>\r\n<\/ul>\r\n
\r\n<\/strong>Who should perform an internal audit?<\/h2>\r\nAn internal audit is conducted by the organisation seeking ISO certification.<\/p>\r\n
The individual or team conducting the process should not be responsible for the activities being audited to ensure that the process is unbiased and objective.<\/p>\r\n
The individual or team conducting the audit \u2013 often referred to as the \u2018internal auditor\u2019 \u2013 needs to have a good understanding of the ISO 9001 standard and its requirements, the organisation\u2019s processes, audit principles and techniques. Internal auditors should also have the skills to objectively evaluate the implementation of the QMS and identify nonconformities and areas for improvement.<\/p>\r\n
The organisation needs to be able to demonstrate to a certification body that any auditors it uses for internal audits are competent. Internal auditors also require strong communication skills to interact successfully with staff throughout the auditing process and precisely report the outcomes.<\/p>\r\n
Read our FAQ guide to ISO certification<\/a>.<\/p>\r\n
\r\n<\/strong>Step-by-step guide to an ISO 9001 audit<\/h2>\r\nStep 1 \u2013 Create an ISO 9001 internal audit plan<\/strong><\/h3>\r\nBefore you conduct an audit for your organisation, create an audit plan. You may want to define the following:<\/p>\r\n
\r\n\t- Objectives<\/strong> \u2013 Clarify what the audit aims to achieve, including identifying and assessing risks and opportunities related to the QMS<\/li>\r\n\t
- Scope<\/strong> \u2013 Define the areas of the organisation to be audited<\/li>\r\n\t
- Criteria<\/strong> \u2013 Identify the standards against which the organisation will be assessed<\/li>\r\n\t
- Timeline<\/strong> \u2013 Specify when each phase of the audit will happen<\/li>\r\n<\/ul>\r\n
Step 2 \u2013 Select the audit team<\/strong><\/h3>\r\nSelect the individual or team who will be responsible for carrying out the audit \u2013 this will depend on the size of your organisation.<\/p>\r\n
Consider potential conflicts of interest and ensure that team members have the necessary competencies.<\/p>\r\n
For a smaller organisation, you may only need one auditor. But for larger organisations, a team consisting of an audit leader, several auditors and technical experts could make the undertaking more manageable.<\/p>\r\n
The audit lead would oversee the entire process and liaise with the auditee, while the auditors would conduct the audit and report their findings. The technical experts could provide specific contextual knowledge.<\/p>\r\n
Step 3 \u2013 Conduct the opening meeting<\/strong><\/h3>\r\nAn opening meeting is the initial meeting that takes place at the start of an audit between the auditors and the auditee.<\/p>\r\n
In this meeting, you might discuss a number of topics, including:<\/p>\r\n
\r\n\t- The audit\u2019s objectives, scope and criteria<\/li>\r\n\t
- How the audit will be conducted<\/li>\r\n\t
- The schedule<\/li>\r\n\t
- The confidentially of the audit\u2019s results<\/li>\r\n<\/ul>\r\n
Step 4 \u2013 Gather and review documentation<\/strong><\/h3>\r\nBefore conducting the audit, ensure you have read the following:<\/p>\r\n
\r\n\t- Quality manual<\/strong> \u2013 An overview of the organisation\u2019s QMS<\/li>\r\n\t
- ISO regulations<\/strong> \u2013 The requirements of the ISO 9001 standard<\/li>\r\n\t
- Procedures <\/strong>\u2013 Specific steps to perform key tasks<\/li>\r\n\t
- Records<\/strong>\u2014Evidence that procedures are being followed\u2014documenting the audit plan and criteria is crucial to ensuring transparency and accountability<\/li>\r\n<\/ul>\r\n
Step 5: Conduct the audit<\/strong><\/h3>\r\nAn audit can be conducted using various data-collection methods, including interviews, observations and document reviews (including data records). To ensure consistency and efficiency, use checklists or audit criteria.<\/p>\r\n
Both qualitative and quantitative data is important in a quality management audit. During these activities, auditors should also assess how risks and opportunities are being managed within the QMS. Direct discussions with employees to understand current processes and outcomes and on-site observation of work activities and conditions can be helpful in collecting real-time data.<\/p>\r\n
Step 6: Record all findings, identifying both good practices and nonconformities, plus opportunities for improvement<\/strong><\/h3>\r\nUsing the data collected during the audit, you will then need to document and categorise all findings. This includes good practices and areas that do conform, as well as any identified nonconformities, ensuring each finding is supported by objective evidence. You will then be able to recommend opportunities for improvements based on this.<\/p>\r\n
Step 7: Hold the closing meeting<\/strong><\/h3>\r\nWrap up your internal audit with a closing meeting. This meeting should cover the findings of the internal audit, the identified nonconformities and potential risks. Also include the next steps in systematically correcting them.<\/p>\r\n![\"ISO](\"https:\/\/amtivo.com\/ie\/wp-content\/uploads\/sites\/11\/2024\/10\/ISO-9001-Checklist-9001-Internal-Audit.png\" "\\"ISO")
<\/a>\r\n\u00a0<\/h2>\r\nISO 9001 requirements relevant to internal audits<\/h2>\r\n
ISO 9001 emphasises the importance of internal audits, particularly under Clause 9.2 Internal Audit and Clause 9.3 Management Review, and your ISO 9001 internal audit plan needs to take this into account.<\/p>\r\n
Clause 9.2<\/strong> highlights that organisations must conduct internal audits at planned times to ensure that their QMS conforms to the organisation\u2019s own requirements and ISO 9001\u2019s requirements. These audits should not only verify conformity but also assess how the QMS manages risks and opportunities. The QMS processes must be effectively implemented and maintained. This clause also requires organisations to maintain records of the audit programme and the audits completed.<\/p>\r\nClause 9.3<\/strong> requires top management to review the organisation\u2019s QMS. This includes the results of internal audits to ensure its continuing suitability, adequacy, effectiveness and alignment with the organisation\u2019s strategic choices.<\/p>\r\nUnder ISO 9001 requirements, internal auditors must have the appropriate skills and knowledge and follow a planned and documented audit process.<\/p>\r\n
Download our guide to ISO 9001\u2019s key requirements<\/a>.<\/p>\r\n
\r\n<\/strong>Tips for a successful ISO 9001 internal audit plan<\/h2>\r\nOur guidance can help your organisation conduct a successful internal audit:<\/p>\r\n
\r\n\t- Maintain independence and objectivity<\/strong> \u2013 Auditors should not audit their own work or work done by their own department. This is to help keep any findings and actions unbiased and credible. It could also mitigate any in-team tension that could disrupt workflow.<\/li>\r\n\t
- Maintain effective communication<\/strong> \u2013 Ensure auditors communicate clearly with all parties involved in your audit before, during and after the audit. They should share information promptly so any areas of nonconformance or potential issues can be handled.<\/li>\r\n\t
- Positive problem-solving is key <\/strong>\u2013 When nonconformities are identified, auditors should maintain a proactive and positive attitude toward the problem-solving process, focusing on the root cause rather than just the symptoms.<\/li>\r\n\t
- Use checklists and tools<\/strong> \u2013 Checklists, flowcharts and other audit tools can help ensure all areas are covered and make the audit process more time- and resource-efficient.<\/li>\r\n\t
- Focus on collaboration<\/strong> \u2013 Approach the audit as a tool for improvement, not as a fault-finding mission. Collaborating directly with the auditees to get their input and identify effective solutions can increase productivity and engagement.<\/li>\r\n\t
- Follow up on actions<\/strong> \u2013 After the audit, check that any corrective actions are implemented and monitor their effectiveness.<\/li>\r\n<\/ul>\r\n
\r\n<\/strong>The objectives of an internal audit<\/h2>\r\n
Conducting an internal audit can help organisations achieve several objectives:<\/p>\r\n
- \r\n\t
- To determine the effectiveness of the QMS in delivering high-quality output<\/li>\r\n\t
- To ensure the QMS is meeting ISO 9001 requirements and industry regulations<\/li>\r\n\t
- To identify areas for improvement in operations<\/li>\r\n\t
- To ensure the QMS is meeting specified financial and quality business objectives<\/li>\r\n\t
- To help an organisation identify any areas of weakness they have ahead of their certification audit<\/li>\r\n<\/ul>\r\n
\r\n<\/strong>Who should perform an internal audit?<\/h2>\r\nAn internal audit is conducted by the organisation seeking ISO certification.<\/p>\r\n
The individual or team conducting the process should not be responsible for the activities being audited to ensure that the process is unbiased and objective.<\/p>\r\n
The individual or team conducting the audit \u2013 often referred to as the \u2018internal auditor\u2019 \u2013 needs to have a good understanding of the ISO 9001 standard and its requirements, the organisation\u2019s processes, audit principles and techniques. Internal auditors should also have the skills to objectively evaluate the implementation of the QMS and identify nonconformities and areas for improvement.<\/p>\r\n
The organisation needs to be able to demonstrate to a certification body that any auditors it uses for internal audits are competent. Internal auditors also require strong communication skills to interact successfully with staff throughout the auditing process and precisely report the outcomes.<\/p>\r\n
Read our FAQ guide to ISO certification<\/a>.<\/p>\r\n
\r\n<\/strong>Step-by-step guide to an ISO 9001 audit<\/h2>\r\nStep 1 \u2013 Create an ISO 9001 internal audit plan<\/strong><\/h3>\r\n
Before you conduct an audit for your organisation, create an audit plan. You may want to define the following:<\/p>\r\n
- \r\n\t
- Objectives<\/strong> \u2013 Clarify what the audit aims to achieve, including identifying and assessing risks and opportunities related to the QMS<\/li>\r\n\t
- Scope<\/strong> \u2013 Define the areas of the organisation to be audited<\/li>\r\n\t
- Criteria<\/strong> \u2013 Identify the standards against which the organisation will be assessed<\/li>\r\n\t
- Timeline<\/strong> \u2013 Specify when each phase of the audit will happen<\/li>\r\n<\/ul>\r\n
Step 2 \u2013 Select the audit team<\/strong><\/h3>\r\n
Select the individual or team who will be responsible for carrying out the audit \u2013 this will depend on the size of your organisation.<\/p>\r\n
Consider potential conflicts of interest and ensure that team members have the necessary competencies.<\/p>\r\n
For a smaller organisation, you may only need one auditor. But for larger organisations, a team consisting of an audit leader, several auditors and technical experts could make the undertaking more manageable.<\/p>\r\n
The audit lead would oversee the entire process and liaise with the auditee, while the auditors would conduct the audit and report their findings. The technical experts could provide specific contextual knowledge.<\/p>\r\n
Step 3 \u2013 Conduct the opening meeting<\/strong><\/h3>\r\n
An opening meeting is the initial meeting that takes place at the start of an audit between the auditors and the auditee.<\/p>\r\n
In this meeting, you might discuss a number of topics, including:<\/p>\r\n
- \r\n\t
- The audit\u2019s objectives, scope and criteria<\/li>\r\n\t
- How the audit will be conducted<\/li>\r\n\t
- The schedule<\/li>\r\n\t
- The confidentially of the audit\u2019s results<\/li>\r\n<\/ul>\r\n
Step 4 \u2013 Gather and review documentation<\/strong><\/h3>\r\n
Before conducting the audit, ensure you have read the following:<\/p>\r\n
- \r\n\t
- Quality manual<\/strong> \u2013 An overview of the organisation\u2019s QMS<\/li>\r\n\t
- ISO regulations<\/strong> \u2013 The requirements of the ISO 9001 standard<\/li>\r\n\t
- Procedures <\/strong>\u2013 Specific steps to perform key tasks<\/li>\r\n\t
- Records<\/strong>\u2014Evidence that procedures are being followed\u2014documenting the audit plan and criteria is crucial to ensuring transparency and accountability<\/li>\r\n<\/ul>\r\n
Step 5: Conduct the audit<\/strong><\/h3>\r\n
An audit can be conducted using various data-collection methods, including interviews, observations and document reviews (including data records). To ensure consistency and efficiency, use checklists or audit criteria.<\/p>\r\n
Both qualitative and quantitative data is important in a quality management audit. During these activities, auditors should also assess how risks and opportunities are being managed within the QMS. Direct discussions with employees to understand current processes and outcomes and on-site observation of work activities and conditions can be helpful in collecting real-time data.<\/p>\r\n
Step 6: Record all findings, identifying both good practices and nonconformities, plus opportunities for improvement<\/strong><\/h3>\r\n
Using the data collected during the audit, you will then need to document and categorise all findings. This includes good practices and areas that do conform, as well as any identified nonconformities, ensuring each finding is supported by objective evidence. You will then be able to recommend opportunities for improvements based on this.<\/p>\r\n
Step 7: Hold the closing meeting<\/strong><\/h3>\r\n
Wrap up your internal audit with a closing meeting. This meeting should cover the findings of the internal audit, the identified nonconformities and potential risks. Also include the next steps in systematically correcting them.<\/p>\r\n
<\/a>\r\n\u00a0<\/h2>\r\n
ISO 9001 requirements relevant to internal audits<\/h2>\r\n
ISO 9001 emphasises the importance of internal audits, particularly under Clause 9.2 Internal Audit and Clause 9.3 Management Review, and your ISO 9001 internal audit plan needs to take this into account.<\/p>\r\n
Clause 9.2<\/strong> highlights that organisations must conduct internal audits at planned times to ensure that their QMS conforms to the organisation\u2019s own requirements and ISO 9001\u2019s requirements. These audits should not only verify conformity but also assess how the QMS manages risks and opportunities. The QMS processes must be effectively implemented and maintained. This clause also requires organisations to maintain records of the audit programme and the audits completed.<\/p>\r\n
Clause 9.3<\/strong> requires top management to review the organisation\u2019s QMS. This includes the results of internal audits to ensure its continuing suitability, adequacy, effectiveness and alignment with the organisation\u2019s strategic choices.<\/p>\r\n
Under ISO 9001 requirements, internal auditors must have the appropriate skills and knowledge and follow a planned and documented audit process.<\/p>\r\n
Download our guide to ISO 9001\u2019s key requirements<\/a>.<\/p>\r\n
\r\n<\/strong>Tips for a successful ISO 9001 internal audit plan<\/h2>\r\nOur guidance can help your organisation conduct a successful internal audit:<\/p>\r\n
- \r\n\t
- Maintain independence and objectivity<\/strong> \u2013 Auditors should not audit their own work or work done by their own department. This is to help keep any findings and actions unbiased and credible. It could also mitigate any in-team tension that could disrupt workflow.<\/li>\r\n\t
- Maintain effective communication<\/strong> \u2013 Ensure auditors communicate clearly with all parties involved in your audit before, during and after the audit. They should share information promptly so any areas of nonconformance or potential issues can be handled.<\/li>\r\n\t
- Positive problem-solving is key <\/strong>\u2013 When nonconformities are identified, auditors should maintain a proactive and positive attitude toward the problem-solving process, focusing on the root cause rather than just the symptoms.<\/li>\r\n\t
- Use checklists and tools<\/strong> \u2013 Checklists, flowcharts and other audit tools can help ensure all areas are covered and make the audit process more time- and resource-efficient.<\/li>\r\n\t
- Focus on collaboration<\/strong> \u2013 Approach the audit as a tool for improvement, not as a fault-finding mission. Collaborating directly with the auditees to get their input and identify effective solutions can increase productivity and engagement.<\/li>\r\n\t
- Follow up on actions<\/strong> \u2013 After the audit, check that any corrective actions are implemented and monitor their effectiveness.<\/li>\r\n<\/ul>\r\n
- Maintain effective communication<\/strong> \u2013 Ensure auditors communicate clearly with all parties involved in your audit before, during and after the audit. They should share information promptly so any areas of nonconformance or potential issues can be handled.<\/li>\r\n\t
- ISO regulations<\/strong> \u2013 The requirements of the ISO 9001 standard<\/li>\r\n\t
- Quality manual<\/strong> \u2013 An overview of the organisation\u2019s QMS<\/li>\r\n\t
- Scope<\/strong> \u2013 Define the areas of the organisation to be audited<\/li>\r\n\t
- Objectives<\/strong> \u2013 Clarify what the audit aims to achieve, including identifying and assessing risks and opportunities related to the QMS<\/li>\r\n\t
![\"ISO](\"https:\/\/amtivo.com\/ie\/wp-content\/uploads\/sites\/11\/2024\/10\/ISO-9001-IA-Course-ISO-9001-Internal-Audit.png\" "\\"ISO")
<\/a>\r\n