How to perform an internal audit

Internal audits are a structured way to verify that a company’s management system is actually being followed—both against the requirements of standards such as ISO 9001 (quality), ISO 14001 (environment), and ISO/IEC 27001 (information security), and against the organization’s own internal procedures. Done well, auditing functions as a “spot check” that checks whether documented processes are implemented, maintained, and producing the outcomes management expects—like error-free service delivery, effective risk controls, and continual improvement.

The session frames internal auditing as more than compliance paperwork. Audits help organizations confirm planned arrangements are in place, identify where processes are less effective than intended, and feed corrective actions that prevent recurring failures. They also strengthen communication across teams by involving staff in the review of how work is performed, and they can highlight training gaps or resourcing needs when problems appear in specific areas. For senior leadership, audit findings provide feedback on whether established processes are effective and where improvements should be targeted.

A practical audit starts with principles that guide how auditors behave and how evidence is handled. Key themes include fair presentation, confidentiality (including information security and GDPR considerations), independence (for example, auditing a purchasing process using people from other departments), an evidence-based approach, professional care, impartiality, and integrity. These principles matter because audit credibility depends on what is checked, how it is checked, and how findings are documented.

The briefing then breaks internal audits into four main types: system audits, process audits, project audits, and product audits. A system audit checks the management system against the standard’s structure—often clause-by-clause—so organizations can confirm the overall system is operating as required. A process-based audit groups related clauses into real operational workflows (such as handling customer inquiries or managing emergency controls) and checks whether day-to-day activities match documented procedures. Project audits follow a project from start to finish to confirm that requirements are addressed throughout delivery—whether it’s new product development, construction, or an IT implementation where information security concerns must be embedded. Product audits focus on how a specific product is produced, manufactured, packaged, and delivered, often using customer orders as the boundary for what is audited.

Preparation is treated as a planning discipline. Organizations create an audit schedule (often mapped on a 12-month matrix) to ensure coverage of management system elements and to demonstrate planning as required by many ISO standards. Scheduling also accounts for timing, availability of the right people, auditor training and experience, and practical logistics such as what equipment is needed (including whether calibration checks are possible). The plan can be adjusted when serious problems or nonconformities are found, including adding rechecks after corrective actions.

Audit execution and reporting are presented as evidence-driven. Auditors typically use checklists derived from procedures or manual sections, sample activities, record what was expected, and document the evidence found. If expected elements like risk assessments, signed daily notes, or required approvals are missing, nonconformities are raised. The report’s purpose is assurance: either confirming processes run as planned or identifying where corrective actions, resources, or procedural changes are needed.

Finally, the Q&A emphasizes how to choose audit type and frequency. Clause-based coverage is commonly spread across a year, while full coverage may extend up to three years for larger implementations. Audits can be done by observation, interviews, and document review, but reliance on interviews alone is cautioned because people may unintentionally provide answers that sound correct without proof. External auditors generally sample across the management system, so internal audits should align with what the organization’s manual and processes claim to do. The session closes by pointing to internal audit training and mentoring options for building audit capability across teams.