Internal Audit Best Practices

Published 14 September 2026

Every ISO management system standard requires internal audits at planned intervals. Many organisations run them because they must, produce a report nobody reads, and repeat the exercise a year later. Done well, internal audits are the cheapest improvement tool an organisation has. Here are the practices that make the difference.

1. Audit processes, not clauses

Following the standard clause by clause produces a tick list. Following a process from its inputs to its outputs shows whether the system works. Pick a process, identify its objectives, its inputs, its controls, its outputs and its measures, and audit that. The clauses of the standard will be covered along the way, and you will see interactions between processes that a clause based audit hides.

2. Plan with risk in mind

ISO 19011:2018 asks for a risk based approach. Processes that are new, have changed, have produced nonconformities or complaints, or carry high consequence deserve more audit time than stable, low risk activities. The audit programme should say why each audit is scheduled and how much depth it will have.

3. Prepare properly

Read the procedure, the previous audit report, recent nonconformities, customer complaints and performance data before you arrive. Prepare open questions and a list of the records you expect to see. An auditor who arrives knowing the process earns cooperation quickly.

4. Use a checklist as a memory aid, not a script

A checklist stops you forgetting things. Reading it aloud stops you listening. Ask the open question, follow the answer, and tick the list afterwards.

5. Sample deliberately

You cannot look at everything, so decide how you will sample and record it. Choose records across a period, across people and across product or service lines. If a sample of ten shows two problems, say so and say how the sample was chosen. Unstated sampling makes findings impossible to evaluate.

6. Ask, observe, then verify

The three sources of evidence are what people tell you, what you see happening, and what the records show. Use all three. When someone describes how a process works, ask them to show you, then look at the record the last time it was done. Differences between the three are where the useful findings live.

7. Write findings that can be acted on

A finding needs the requirement, the evidence and the gap. “Calibration records were not available” is not a finding. “Clause 7.1.5.2 of ISO 9001:2026 requires measuring equipment to be calibrated or verified at specified intervals. Of eight torque wrenches sampled in Assembly, three (asset numbers 114, 121 and 130) had no calibration record and were beyond the 12 month interval on the calibration schedule” gives the process owner everything needed to act.

8. Separate the fact from the fix

The auditor reports the nonconformity. The process owner analyses the cause and decides the corrective action. An auditor who prescribes the fix takes ownership of a problem that is not theirs and often misses the real cause.

9. Report to the people who can act

The closing meeting is where findings are confirmed with the auditee, so there are no surprises in the report. The report itself goes to the process owner and to management. Findings that never reach a decision maker never get resolved.

10. Close the loop

Verify corrective action. Check that the cause was addressed, not just the symptom, and that the same problem has not appeared elsewhere. Feed the results into management review. An internal audit programme that shows the same findings year after year is measuring the organisation’s tolerance for problems, not improving it.

Competence is the foundation

None of this works without competent auditors. Competence means knowledge of the standard, understanding of the organisation’s processes, auditing skills and the personal behaviour ISO 19011:2018 describes: ethical, open minded, diplomatic, observant, perceptive, versatile, tenacious, decisive and self reliant. QA Assessor’s Internal Auditor certification assesses exactly these areas.