ISO 9001 Internal Audit — Clause 9.2 Requirements, Program and Checklist
Clause 9.2 makes internal audits a non-negotiable part of every ISO 9001 quality management system. This page breaks down what the standard requires of your audit program, how to plan audits against Clause 4–10, and the findings that most often surface during certification.
What Clause 9.2 actually requires
Clause 9.2.1 requires the organization to conduct internal audits at planned intervals to provide information on whether the QMS conforms to its own requirements and to the ISO 9001 standard. Clause 9.2.2 sets the rules: audits must be planned, established, implemented and maintained as a program; the program must consider the importance of processes, changes, and previous results; auditors must be objective and impartial; and the results must be reported to management.
Building an audit program that holds up
A defensible program covers every clause and every process over a defined cycle (typically 1–3 years), assigns competent auditors, and links each audit to the process owner’s corrective action. The audit itself should sample objective evidence against Clauses 4–10, not just tick a generic checklist.
Findings auditors see most
Recurring issues: audits treated as a paperwork exercise rather than a real check; the same nonconformities recurring because corrective action (Clause 10.2) addresses the symptom, not the root cause; and audit records that don’t show objective evidence was actually gathered.
Frequently asked questions
How often must ISO 9001 internal audits be done?
The standard says “planned intervals” — it does not mandate a frequency. Most certified organizations audit each process at least annually and the full system on a 1–3 year rolling cycle, with higher-risk processes audited more often.
Can the quality manager audit their own area?
No. Clause 9.2.2 requires auditors to be objective and impartial, so an auditor must not audit work they are responsible for. Independence can be within the organization but never over one’s own area.
What is the link between internal audit and management review?
Audit results are a required input to management review (Clause 9.3). The audit program is only closed when its results have been reviewed by top management and fed into improvement.