Improve Your Business by Leveraging the ISO 9001 Internal Audit Process

Table of Contents

All organizations that want to get certified to ISO 9001:2015 need to implement an internal audit program. The program is intended to verify that you've correctly implemented the ISO 9001 standard and your business is operating according to its requirements. Your audit program should prioritize the importance of problems you've identified and should take into account the frequency of audits, what they will examine and who will be responsible for addressing any issues that may arise.

ISO 9001 Internal Audits

Lost Opportunities
Implementing an ISO 9001 internal audit program along those requirements is sufficient for ISO 9001 certification. However, taking this attitude and approach can result in the audit program devolving into a bureaucratic policing process, despised and feared by employees and doing more harm to the business than good.

Organizations that see ISO 9001 internal audits as just one more aspect of the standard they need to address and do the bare minimum, rob themselves of a tremendous opportunity to use the program as a powerful tool to improve their business.

Your internal audit program could prove to be the most powerful element of your quality management system.

A Foundation for Continuous Improvement
However, take a different attitude and approach, and your internal audit program could prove to be the most powerful element of your quality management system, providing a way of identifying and eliminating ineffective processes, engaging the whole organization in your certification efforts, and driving continuous quality improvement throughout the entire organization.

The following article takes those sound principles further and reveals how to build a robust foundation for sustainable, long-term business improvement, a core objective of 9001Simplified's practical approach to ISO 9001 certification.

ISO 9001 Internal Audits as a Core Component of the Plan-Do-Check-Act (PDCA) Cycle

The PDCA cycle is one of the most popular methodologies used for business improvement and its principles are incorporated within the requirements of ISO 9001:2015.

PDCA Cycle

An effective internal audit program is an integral component of the "Check" part of this popular model, providing structure around comparing what an area should be doing against what is actually going on and then making recommendations for remediation and change (Act - Plan - Do).

As we've already mentioned, conducting audits as a "policing" process, instead of an opportunity to apply a fresh set of eyes to the way things are done is counterproductive. So too is creating an unwieldy bureaucracy, instead of streamlining audit efforts and prioritizing the application of resources according to what's most important to the business.

Rather than helping employees to appreciate the benefits of the quality management system (QMS) and get involved, both the "policing" approach and the unwieldy bureaucracy mentioned above can turn them away. Not having all employees on board and engaged with the QMS is one of the costly mistakes businesses make when pursuing ISO 9001:2015 certification and reduces the likelihood of creating an effective and sustainable QMS for the long term.

How to Structure Your ISO 9001 Internal Audit Program to Drive Business Improvement

By building on and enhancing the minimum requirements to comply with clause 9.2 of ISO 9001:2015, organizations can lay the foundations for long term sustainability and continuous improvement.

The following tips will assist you to bolster your internal audit program and change the primary focus from identifying non-conformances to discovering opportunities for improvement.

Involve More People

Two of the seven underlying principles of ISO 9001:2015 are 'Leadership' and 'Engagement of People.' Ideally, everyone from the CEO, right through to product and service delivery functions, and support staff should understand their role in the organization and their responsibilities concerning the quality system, including internal audits.

Nominate an Executive Champion for the internal audit program

By appointing a member of Top Management as the champion of the internal audit program as opposed to the Quality Manager or a Lead Auditor, the organization sends a signal to employees that the internal audit program is of high importance. Nominating a single executive by no means excuses the other managers from getting involved, taking an interest, or participating; but it does provide a focus and single point of accountability. This champion should:

Visibly support the program through regular communications about the program and obtaining and assigning resources

Facilitate a process to identify and sign off on priorities for the audits based on evidence and data (for example, customer complaints, process failures, product return rates)

Step in if schedules get off track, identify the reasons for the delay, and support solutions to get it back on track

The champion may even decide to train as an auditor and get involved in a selection of audits themselves as a way to show leadership in getting to the bottom of problems and supporting effective solutions.

Appoint more Internal Auditors

Rather than have a limited number of internal auditors, instead train as many willing employees in audit techniques as you can. Not only does this approach spread the load, but the organization can also plan a higher number of smaller, more focussed audits that take less time, reducing the downtime for both auditors and the area getting audited.

Training more internal auditors also results in a higher number of employees with knowledge in the requirements of ISO 9001:2015 and the organization's QMS.

The more auditors from different parts of the organization, the higher the opportunity for cross-fertilization of ideas. The organization can utilize auditors from areas doing a particular process well to audit sections which aren't (or vice versa) allowing best practice to spread.

Don't restrict the pool of internal auditors to more experienced employees. Train newer recruits and use the audits as a way to familiarize them with relevant departments. Without the organizational "baggage" they bring a fresh set of eyes to each process, can contribute insights from their experience in their previous positions, question the status quo, and are more likely to as "newbie" questions that current team members might take for granted or be too afraid to mention for fear of looking stupid.

In a similar vein, allow employees who are interested in working in other areas to get involved with audits of that team. Examining the new sections processes will provide them with an insight into how things operate, and start to prepare them for any new role.

Have Mentors (Buddy System)

Once an organization has a critical mass of trained and experienced auditors, they can introduce a mentoring process or buddy system to boost the number of their internal auditors and support the new trainees even further. A mentor (or buddy) provides support for the new auditor to prepare for their audits, transfers their knowledge, and facilitates beneficial networks that share a focus on improvement.

The buddy system can work outside the official hierarchy. For example, someone in production might mentor someone in sales, helping the auditor to interpret the requirements of the standard for an area they not otherwise know.

The new auditor gains a confidant, someone to whom they can pose questions they might not feel comfortable asking via the organization's formal hierarchies or quality department.

The program could be run on a purely voluntary basis or implemented as part of a structured professional development program with rewards and recognition for participation. Depending on the size and complexity of the organization this initiative could be coordinated by the Quality Team or as a joint effort with HR, and Training and Development.

Extend to many auditees

It's critical that the people performing tasks and activities get involved in the internal audits rather than being restricted to the managers or supervisors of the section. The closer you can get to the 'doing,' the better. It's the people at the coalface who feel the brunt of inefficient ways of operating and provided the audits are conducted in the spirit of helping get problems fixed rather than blaming individuals for things that go wrong; people will likely relish the chance to provide input.

Getting everyone involved with identifying areas for improvement and creating solutions is an excellent way to increase employee ownership of their role in the QMS and creates a positive work environment that encourages people to remain with an organization long term.

Upgrade the Skills of Internal Auditors to Include Problem Solving Techniques

Training internal auditors in problem-solving techniques and encouraging them to apply them during audits will result in a deeper insight into the real (or root) causes of non-conformances. Solutions that address the root cause of issues will be more effective, sustainable and permanent.

Without taking the time to identify the underlying problems, the organization may find itself addressing symptoms rather than the real issues.

For example, an auditor might find that employees aren't following the work instructions as supplied by the manager of a department. The auditor could just write that up as the problem in the audit report and leave the section to implement whatever corrective action they deem fit. Perhaps their response might be that workers have been reminded that they must follow instructions. The follow-up audit may then find that everyone is aware of and following the instructions. But perhaps the workers are unhappier, customer complaints are up, and the number of product returns is too.

Had the auditor dug deeper using problem-solving techniques like root cause analysis, they may have found that the real problem was the team had found a better, more efficient way of doing things. They may have informally made the changes to improve the process outcomes without understanding that there needed to be a formal sign off process, the work instructions then required updating, and that everyone involved in the process should undergo retraining to ensure they are all on the same page.

There are several methods that an auditor can use to analyze problems better and ultimately result in more effective solutions. These include Appreciation, 5 Whys, Six Thinking Hats, Flowcharts, Cause and Effect Diagrams, and Mind Mapping.

Our free guide on 6 Quality Improvement Techniques for More Effective ISO 9001 Internal Audits explores these techniques and how to apply them to your own internal audit program.

Benefits of an Enhanced ISO 9001 Internal Audit Program

Structure Your Audits and Checklists to Go Beyond Compliance

Rather than focus solely on compliance during internal audits, make the identification of potential improvements the primary aim. Just because an area is doing what the documents say they should, doesn't mean it's the right thing to do, nor the right way to do it.

Moreover, if an employee isn't doing what their work instructions say they should, they might have an excellent reason for not doing so. Rather than focus on the fact that they are not complying, ask auditees questions like:

What frustrates you about this process?

Why are you doing this the way you are?

How would you do this better?

If you can't make the changes, who can?

Conducting "process" audits rather than "procedural" audits promotes a much stronger focus on organizational effectiveness. Rather than following an activity from input to output, a process audit tries to determine whether the tasks, resources, and behaviors are managed efficiently and effectively to generate the end result, and whether the result matches the planned objectives.

The key to enabling this approach is to use forms and checklists that cover the requirements of the ISO 9001:2015 standard but are easily customized and expanded to incorporate a process approach.

Use Internal Audit Findings as the Foundation for Improvement Projects

Where an audit reveals significant problems, use the outcome as an opportunity to involve the auditors and auditees in a project to identify the root cause, devise solutions and then assess the effectiveness of changes. Rather than limit the auditor's responsibilities to carrying out the audit and follow-up of corrective actions, get them involved in helping to resolve the problem. Their expertise in quality improvement methods and the requirements of the ISO 9001 standard, along with their independence of the process and their different perspective, may result in more robust solutions than if the work area is left to find a solution in isolation.

If the problem is apparent across more than one area, create a cross-functional team to develop an effective, standardized, organization-wide change (where appropriate).

For example, if a review of Customer Support shows that they are continually fielding complaints about incomplete orders, and a subsequent audit of the Shipping Department shows they regularly have to wait for parts to complete orders or ship multiple times to clients, then it's the perfect opportunity to form a cross-functional team. Coordinate representatives from Sales, Manufacturing (perhaps more than one area), Shipping, Logistics, and Customer Support to analyze what happens from the order right through to the shipment of the final part. By looking at the system as a whole rather than isolated processes, the improvement team can work on solutions to streamline and improve the overall customer experience.

The improvement team can map the entire process as it exists, identify weak spots and bottlenecks, collect data, identify the root cause of failures and propose solutions that take the needs and perspectives of all those involved into account.

Use Data to Show the Effectiveness of the Internal Audit Program

When problems are identified during an internal audit, the work area should gather baseline data before implementing any solution. Once the data has been collected, improvements can be devised, applied and their impact measured. By comparing the new measurements to the baseline, you can verify that the changes have made a positive impact. The data can then be communicated throughout the organization as proof that the audit program is providing value, consequently increasing motivation and enthusiasm for the program and encouraging involvement.

Providing data to back up the need for changes is one factor in keeping staff engaged with the QMS and providing increased job satisfaction.

It's worth noting that evidence-based decision making is one of the seven underlying principles of the ISO 9001:2015 standard, although it's not explicitly mentioned in the internal audit clause this principle should be factored into the corrective action and follow-up stages of the audit process.

Communicate Success and Recognize and Reward Those Who Contribute

Encouraging involvement in, acceptance of, and support for internal audits are vital for the long-term sustainability and success of the audit program. Communicating the positive outcomes and benefits that result from the program is one way of ensuring this.

For example, if an auditor identifies a problem related to product quality and the department manager subsequently devises a solution that decreases customer complaints, the organization can highlight and communicate these positive results along with the methods the team used to diagnose the problem, identify the solution, and verify the success. In that way, the rest of the business learns from the process and is more likely to be enthusiastic about achieving similar outcomes in their areas.

Formally acknowledging and rewarding those involved in the audit process and in creating the solution provides a positive feedback loop and offers encouragement and incentive for everyone to play a part in the audit program and help develop a culture of improvement. Recognition might be as simple as highlighting the employees in the company newsletter or sending a note of appreciation from the CEO, right through to monetary rewards and formal awards ceremonies.

In previous articles, we've identified that recognizing and rewarding employees for improvement efforts helps organizations to retain employees, and subsequently lower their recruitment costs.


When an organization decides to develop an ISO 9001:2015 compliant Quality Management System and seek certification, they are obligated to implement an Internal Audit program. When applying the ISO 9001 requirements for Internal Audits they can attempt to do the bare minimum to comply with the standard, or they can embrace the enormous potential of clause 9.2 and create a framework that adds significant long-term value and becomes the cornerstone of their continuous improvement efforts, sustainability, and business success.

Our free guide on 6 Quality Improvement Techniques for More Effective ISO 9001 Internal Audits is full of practical tips to help you achieve these benefits.


9001Simplified's experts have been in the business of helping organizations achieve ISO 9001 certification for decades. Drawing from that experience, we developed our unique, "simplified" approach to ISO 9001 which is goal-oriented and geared towards adding real value to your business.

We've seen a lot of internal audit programs - good, bad and excellent. So when we developed our internal audit templates and best-selling internal auditor training courses we designed them to not only comply with the ISO 9001 standard but also to help you empower and support your entire team to get involved.

Those of you who are just getting started on your certification journey will find our guide on How to Get ISO 9001 Certified the 9001Simplified way and our flagship ISO 9001 Certification Package useful to jump-start the development of your Quality Management System.


    What's been your experience with internal audits? How do you think they could help your workplace improve? Tell us about it in the comments below (all relevant, respectful feedback is welcomed per our guidelines).


    Strouse, Richard "Improving the Effectiveness of Internal Auditing", TUV

    Ohanyan, A and Harutyunyan, H (2016), "The Role of Internal Audit in Continuous Improvement of Quality Management Systems at Private HE Institutions: A Case Study of Eurasia International University (Armenia)", Journal of Business & Financial Affairs

    "Internal audit – part of a Continual Improvement Process" APLISO

    "10 Practices to improve business processes", Instituut van Internal Auditors

    "Root Cause Analysis: Tracing a Problem to Its Origins", Mind Tools

    payment options

    ISO 9001 Simplified Money-Back Guarantee