ISO 9001 Internal Audit: 6 Steps, Checklist, and Findings

Say your plant has just been told to run an internal audit before a Japanese customer's next visit. The parent company in Japan wants the audit plan, the findings, and the rikiryo-hyo (力量表, competence matrix) in English. You have been named the auditor, and you are not sure where to start.
An ISO 9001 internal audit is the company checking its own quality management system (QMS). It confirms that the rules you set are being followed and that they actually deliver quality results, so you can fix weak spots before a customer or certification body finds them.
This guide covers what ISO 9001:2015 clause 9.2 requires, a six-step process from planning to corrective action, a sample checklist, and a simple format for writing findings. It also maps the Japanese terms you will see in audit documents from Japanese customers and parent companies, and ends with checklists and questions you can reuse.
Contents
- What ISO 9001 Requires for Internal Audits
- The Internal Audit Process in 6 Steps
- Steps 1–2: Set the Audit Program and the Audit Plan
- Step 3: Build an ISO 9001 Internal Audit Checklist
- Step 4: Conduct the Audit
- Step 5: How to Write Internal Audit Findings
- Step 6: Report, Corrective Action, and Follow-Up
- Why Internal Audits Become a Formality
- Japanese Internal Audit Terms: Quick Reference
- Reusable Templates: Checklist, Finding Format, and Questions
- Limits of This Guide
- FAQ
- Sources
What ISO 9001 Requires for Internal Audits

Internal audits are required by ISO 9001 clause 9.2. Clause 9.2.1 says the organization must conduct internal audits at planned intervals. The purpose is to find out whether the QMS conforms to the organization's own requirements and to ISO 9001, and whether it is effectively implemented and maintained.
That gives the audit two targets: conformity and effectiveness. Checking that people follow the procedure is only half the job. A complete audit also asks whether that procedure helps prevent defects from reaching the customer and helps the plant meet its quality objectives.
Clause 9.2.2 then lists six things the organization must do. They are easier to remember when grouped into planning, doing, and follow-up:
9.2.1 states the purpose. 9.2.2 lists what you do to achieve it.
b) Audit criteria and scope for each audit
d) Results reported to relevant management
f) Records of the program and audit results retained
Clause references are to ISO 9001:2015. A note to 9.2.2 points to ISO 19011 (Guidelines for auditing management systems) for guidance. Its Japanese edition is JIS Q 19011.
Internal vs. Second-Party vs. Third-Party Audits
Audits are grouped by who carries them out. An internal audit (first-party audit) is done by the organization itself. A second-party audit is done by a party with a business interest, such as a customer, and a third-party audit (certification audit) is done by an independent body such as a certification body.
An audit of your plant by a customer, such as a Japanese customer's supplier audit, is a second-party audit.
The certification body usually visits about once a year, and the guidance on ISO 19011 published by the Japanese Standards Association (JSA) assumes that internal audits cover the system in between. In other words, an internal audit is not a rehearsal for the certification audit. It is the self-check that fills the gap between audits.
The table below compares the three types:
They differ in who audits, against what, and why.
Based on JSA briefing materials on JIS Q 19011:2019 (the notes to the audit definition and the criteria for second-party audits), in Japanese.
ISO 9001:2026 and ISO 19011:2026: What Has Changed
A new edition, ISO 9001:2026, was published on September 16, 2026. According to ISO/TC 176, the committee that writes the standard, organizations certified to ISO 9001:2015 have until September 30, 2029 to complete the transition. From March 31, 2028, new certifications can only be issued to the 2026 edition.
The core internal audit requirements have not changed much. Certification bodies report that the title of 9.2.2 now reads "internal audit programme" and that audit objectives have been added to what you define for each audit, alongside criteria and scope. Check the clause wording against your own copy of the 2026 standard.
The Japanese edition, JIS Q 9001, is scheduled for December 2026. If your procedures follow a Japanese parent company's rules, check the JIS wording before revising them to avoid rework. In the meantime, ask which edition your audit procedure should follow.
ISO 19011 itself was revised as well. The fourth edition, ISO 19011:2026, was published in May 2026 and replaces the 2018 edition, with expanded guidance on remote auditing. The ISO 19011 points in this guide come from the 2018 edition (JIS Q 19011:2019 in Japan).
The Internal Audit Process in 6 Steps
Running the audit in six steps, from the annual plan to verifying corrective action, makes it harder to miss anything. The steps regroup the ISO 19011 (clause 6) sequence of initiating, preparing, conducting, reporting, completing, and following up into units that are easier to manage in a plant.
Three steps of preparation, two on the audit day, and one afterward.
Your own procedure can divide the steps differently. ISO 9001 does not specify a number of stages.
New auditors tend to focus on what to ask on the audit day. In practice, the quality of the audit depends largely on the three preparation steps. If you have not decided what you are going to verify, the day goes by flipping through documents.
Steps 1–2: Set the Audit Program and the Audit Plan
ISO 19011 defines an audit program as arrangements for a set of one or more audits planned for a specific time frame and directed toward a specific purpose. It is close to an annual audit schedule, but it is more than a list of dates. It records where you have decided to put the most attention.
Use the Program to Set Priorities for the Year
Clause 9.2.2 a) says the program must take into account the importance of the processes concerned, changes affecting the organization, and the results of previous audits. You do not need to audit every department at the same depth at the same time every year. The more natural reading is that the standard expects you to prioritize.
The three factors can be used to raise or lower the frequency and depth for each process:
Use the three factors named in the standard to adjust frequency and depth by process.
ISO 9001 does not require a fixed frequency such as once a year. You can also schedule audits by event, for example "within three months of starting mass production on a new line."
One audit does not have to cover every department either. Because the program covers a series of audits, you could cover all processes over two years and still audit the critical ones every year.
Scope does not have to follow department lines. You can scope an audit by product, by customer, or along a process from order receipt to shipment. Department-by-department audits tend to miss problems at the handoffs between departments, so adding one cross-functional process audit a year often makes the program more effective.
Select the Auditors
Clause 9.2.2 c) requires you to select auditors and conduct audits so that the audit process is objective and impartial. The notes to the audit definition in ISO 9000 say independence can be demonstrated by being free from responsibility for the activity being audited.
The usual approach is cross-auditing between departments: someone from production audits quality assurance, and someone from quality assurance audits production.
Small companies may not have enough fully independent auditors. ISO 19011 says that even then, auditors should make every effort to remain unbiased and objective. A practical rule is that no one audits their own work.
For competence, auditors need knowledge of the standard, technical knowledge of the process they audit, and interviewing and report-writing skills. ISO 19011 says auditors can build that competence through a combination of:
- Completing a training program
- Work experience
- Audit experience under a competent auditor
Tracking each auditor's experience in a skills matrix (competence matrix) makes it easier to put audit teams together.
Write the Plan for Each Audit
If the audit program is the design for the year, the audit plan is the setup for one audit. As 9.2.2 b) states, define the audit criteria (what you judge against) and the audit scope (which locations, activities, and time period you cover) for each audit. Then write down the schedule, the audit team, and the order of visits.
Notifying the auditee of the dates and scope about one month ahead gives them time to prepare documents and make the right people available. Before the audit, also review the previous audit results and what happened to the corrective actions.
Whether the previous findings were actually fixed is one of the things this audit must check.
Step 3: Build an ISO 9001 Internal Audit Checklist

A checklist is a working document that keeps you from forgetting what to verify on the day. ISO 19011 lists checklists as an example of work documents for an audit, but you are not required to use one.
JSA's guidance materials actually warn that a checklist can push auditors toward simply checking items off for conformity, at the expense of looking at effectiveness.
Clause-Based vs. Process-Based Checklists
There are two main ways to build a checklist. A clause-based checklist lists questions in the order of the ISO 9001 clauses. A process-based checklist follows the auditee's actual workflow.
Clause-based lists make it easier to avoid gaps, but they do not work well on the shop floor. An operator asked "What about clause 7.1.5?" will not know what you mean.
For shop-floor audits, ask questions in workflow order and note the matching clause in a side column. That way you get questions people can answer and still cover the standard.
Ask Whether It Works, Not Just Whether It Exists
If the checklist only asks "Is there a procedure?" and "Is there a record?", every answer will be "yes." What you want to know is effectiveness, so mix in questions about whether the procedure delivers the intended result. For example:
- "What is the purpose of this task?"
- "What defects are most likely in this process?"
- "Have you changed the procedure recently?"
Open questions that ask people to explain, rather than yes/no questions, bring out how the work is really done, which documents alone will not show.
The sample below pairs "what to look at" with "how to ask" for each audit point in a production department:
For each audit point, prepare both the evidence to look at and the question to ask.
Clause numbers are from ISO 9001:2015. Do not reuse the same checklist for years. Update it each time based on the previous results and recent changes.
Digging deeper into one audit point often opens up related issues. Take control of measuring equipment: for calibration and traceability, the audit also covers how calibration intervals are set, and whether anyone traced back and assessed the effect on product already made when a gauge was found out of tolerance.
The same goes for following work instructions. When you find an instruction not being followed, do not stop at blaming the individual. Ask whether the instruction itself is hard to use, and your finding will lead to real corrective action.
How to Audit a Competence Matrix (Rikiryo-hyo)
Japanese companies call the competence matrix a rikiryo-hyo (力量表) or sukiru mappu (スキルマップ, skills map). Under "competence and training" (7.2), audits often stop at confirming that the matrix exists.
Clause 7.2 has four requirements:
- a) Determine the competence needed for the work
- b) Ensure people are competent on the basis of education, training, or experience
- c) Where applicable, take action to acquire the necessary competence and evaluate the effectiveness of that action
- d) Retain documented information as evidence of competence
The existence of a matrix only provides evidence for parts of a) and d). When you review one, compare it with what is actually happening on the floor:
- Do the tasks in the matrix match the work and processes actually performed (no new equipment or processes missing)?
- Are the criteria for "can work alone" written down, and can you tell who signed off and when?
- Are new hires, transferred staff, and temporary or borrowed operators included, and is anyone not yet signed off working alone?
- After training, does anyone check that the person can actually do the job (the effectiveness evaluation in 7.2 c)?
- In processes that had defects or near misses, does the operator's actual skill match the rating in the matrix?
A gap between the matrix and reality is itself a finding about effectiveness.
Step 4: Conduct the Audit

The audit day runs in three parts: the opening meeting, evidence collection, and the closing meeting. Time per department depends on the size of the organization and the scope. Either way, always reserve time for the audit team to agree on its findings before the closing meeting.
Align Objectives and Scope at the Opening Meeting
Start by confirming four points with the auditee:
- Introduction of the audit team
- Objectives and scope of this audit
- Schedule for the day
- Time of the closing meeting
Make it clear that the audit is not a fault-finding exercise but a joint check that the system is working. People will speak more openly in the interviews that follow.
Collect Evidence by Listening, Observing, and Checking Records
Audits deal with verifiable evidence, not opinions. "Evidence-based approach" is one of the ISO 19011 principles of auditing, described as the way to reach reliable and reproducible audit conclusions. You collect evidence in three ways:
Combine three sources of information, and trace in both directions.
Example: pick one inspection record for a shipped product and trace back to the gauge used, the operator's competence, and the drawing revision.
Based on JSA briefing materials on JIS Q 19011:2019 (selecting sources of information, sequence of investigation), in Japanese.
Interview the people who actually do the work, not only the department manager. Where the manager's explanation and the operator's explanation differ, the system may not have reached the floor, so check those points carefully.
Tracing backward from results is especially useful for judging effectiveness. Starting from an outcome can reveal a specific gap that was not visible in the written procedure. Picking a complaint or defect record and checking that it was handled per the procedure and has not recurred works the same way.
Sampling and Note-Taking on the Floor
You cannot read every record, so you check a sample. In internal audits, auditors almost always choose samples by judgment rather than statistically. Instead of only the latest records, deliberately pick records from periods like these to find weak spots:
- Peak production periods
- When the person in charge changed
- Right after a change
On the floor, write down what you saw and heard, with record numbers and dates, on the spot. If you cannot later point to which record and which entry, the nonconformity will rest on weak evidence.
Share Findings at the Closing Meeting
At the end, the audit team sorts out its findings and then holds the closing meeting with the auditee. Explain each nonconformity and its evidence, and confirm with the auditee that the facts are correct.
Agreeing on the facts in the room makes corrective action go more smoothly later. Mention what was done well, too. It makes the auditee more willing to cooperate next time.
Step 5: How to Write Internal Audit Findings

An audit finding is the result of evaluating what you found against the audit criteria. Findings can be positive or negative. In the report, the ones that get handled differently are nonconformities and items that are not nonconformities but leave room for improvement.
Three Categories of Findings
Many companies sort findings into major nonconformities, minor nonconformities, and observations (opportunities for improvement). ISO 9001 does not name these categories, so define the names and criteria in your own procedure.
Severity decides what corrective action is required and how fast.
Set the category names, criteria, and corrective action deadlines in your own procedure. The usual practice is shorter deadlines and earlier verification for more serious findings.
Because observations carry no obligation for corrective action, they tend to be taken lightly. In areas with frequent changes or high staff turnover, though, an observation is often an early warning of a nonconformity at the next audit. Add it to the next audit plan and check whether it improved.
Write Each Finding as Fact, Requirement, and Conclusion
A nonconformity statement needs three parts before the auditee can tell what to fix: what you saw (fact), what you compared it against (requirement), and how you judged it (conclusion). A common weak finding is "Document control is inadequate," which gives no clue what to fix.
The fictional example below shows the difference:
Separating fact, requirement, and conclusion pins down what needs to be corrected.
Fictional example, adapted from an example in the Japanese quality management site "Vision de Mawasu Hakase no Hinshitsu Management," Internal Audit Guide. A boundary sample (gendo mihon, 限度見本) is a physical sample that shows the limit of acceptable appearance.
Keep guesses and opinions out of the statement. Do not write assumed causes such as "probably not trained" or "low awareness." Finding the cause is the auditee's job, and the auditor writes only the facts that were confirmed.
When one fact seems to touch several requirements, pick the single requirement that is the most direct basis. That keeps the corrective action focused. Use names only as far as the record needs them, and avoid wording that blames an individual.
Step 6: Report, Corrective Action, and Follow-Up
After the audit, report the results to relevant management under 9.2.2 d), and carry out corrections and corrective actions without undue delay under e). As f) requires, retain records as evidence that the audit program was implemented and of the audit results.
What to Include in the Audit Report
Reports often end up as a list of nonconformities. ISO 19011 says the report can also include items such as:
- The audit plan
- A summary of the audit
- Confirmation that the audit objectives were achieved
- Areas within the audit scope that were not covered
- Audit conclusions and key findings
- Good practices identified
- Follow-up of agreed action plans
"Areas not covered" and "good practices" pay off in the next audit. Areas you missed can go into the next plan, and a department's good practice can be rolled out to others, which Japanese companies call yokoten (横展開, horizontal deployment).
Top management then uses the report as an input to management review and reflects it in next year's policy and resource allocation.
Take Corrective Action on the Cause
There are two responses to a nonconformity. Correction fixes the problem that occurred. Corrective action removes the cause so it does not happen again.
Clause 10.2 requires you to review and analyze the nonconformity, determine its causes, and determine whether similar nonconformities exist or could occur elsewhere.
In the boundary sample example, warning the inspector is only a correction. It becomes corrective action when you reach a cause, for example that the sample was stored away from the inspection bench, or that it was not part of new-hire training.
Why-why analysis (5 Whys) and the seven QC tools help you dig into causes. Turn the corrective action into a plan with the action, the owner, and the deadline. For cause analysis and recurrence prevention at the level a customer expects, use the structure of an 8D report.
Verify Effectiveness in Follow-Up
When the corrective action is done, the auditor or the audit coordinator confirms that it was carried out and that it works. Set the timing by severity, and verify serious findings sooner.
Do not close a finding on a report that says the action was taken. Check records over a period of time to confirm the same nonconformity has not recurred, then close it. In the next audit, watch the actual work to make sure the fix did not stop at revising the procedure.
Why Internal Audits Become a Formality
After years of internal audits, many plants fall into a routine: the same checklist, the same documents, zero findings. In Japanese this is called keigaika (形骸化, becoming a formality). JSA's guidance materials list beliefs that many organizations hold even though the standard does not require them:
- Internal audits must be held at a fixed frequency, such as once a year
- Internal audits are done by department, and every department is audited every time
- Internal audits are done in a meeting room by reviewing documents
- Top management is outside the scope of internal audits
- A checklist must always be used
- The report contains only nonconformities and opportunities for improvement
- Internal auditors must be certified and must always come from another department
Making any of these an internal rule is fine. The trouble starts when people believe they are ISO requirements and lock them in, which makes the audit hard to change.
Top management, for example, commissions the audit but also sets the organization's direction and policy. It is hard to audit how quality objectives and policy are deployed without hearing from management. Some companies build a dialogue with top management into the audit program, even if it is not run as a formal audit.
Another common mistake is treating zero findings as a good result. Zero findings means either the system really works well or the audit was shallow.
If it works well, write down why in the report so others can use it. If the audit was shallow, revisit the program's priorities and the checklist.
Auditors also need to review their own work. ISO 19011:2018 lists seven principles of auditing:
- Integrity: the foundation of professionalism
- Fair presentation: the obligation to report truthfully and accurately
- Due professional care: the application of diligence and judgment in auditing
- Confidentiality: security of information
- Independence: the basis for the impartiality of the audit and the objectivity of the audit conclusions
- Evidence-based approach: the rational method for reaching reliable and reproducible audit conclusions
- Risk-based approach: an audit approach that considers risks and opportunities (added in the 2018 edition)
The risk-based approach is the same idea as setting priorities in Figure 4. The guidance is to focus on what matters to the organization in planning, conducting, and reporting audits.
After each audit, ask the audit team, "Did we look at the things that matter?" Over time, that question makes each year's audit program sharper.
Internal auditors often come from production and design as well as quality assurance. Serving as an auditor is also a good way to learn how work flows through other departments.
Japanese Internal Audit Terms: Quick Reference
Audit procedures, plans, and reports from Japanese customers and parent companies use the terms below. The English column gives the ISO 9001 or ISO 19011 term where one exists.
| Japanese | Romaji | English (ISO term) |
|---|---|---|
| 内部監査 | naibu kansa | internal audit (first-party audit) |
| 第二者監査 | dai-nisha kansa | second-party audit (for example, a customer's supplier audit) |
| 審査/認証審査 | shinsa / ninsho shinsa | certification audit (third-party audit) |
| 監査プログラム | kansa puroguramu | audit program |
| 監査計画 | kansa keikaku | audit plan |
| 監査基準/監査範囲 | kansa kijun / kansa han'i | audit criteria / audit scope |
| 被監査部門 | hi-kansa bumon | auditee (audited department) |
| 初回会議/最終会議 | shokai kaigi / saishu kaigi | opening meeting / closing meeting |
| 所見/指摘 | shoken / shiteki | audit finding / finding raised by the auditor |
| 重大な不適合/軽微な不適合 | judai na futekigo / keibi na futekigo | major nonconformity / minor nonconformity |
| 観察事項/改善の機会 | kansatsu jiko / kaizen no kikai | observation / opportunity for improvement |
| 修正/是正処置 | shusei / zesei shochi | correction / corrective action |
| 力量/力量表 | rikiryo / rikiryo-hyo | competence / competence matrix (skills matrix) |
| マネジメントレビュー | manejimento rebyu | management review |
| 横展開 | yokoten | rolling out a fix or good practice to other areas |
Reusable Templates: Checklist, Finding Format, and Questions
Use the tools below as starting points and adjust them to your own procedure and to what your customer requires.
Pre-Audit Checklist
Go through these items before each audit:
- Audit program updated for process importance, recent changes, and previous results
- Objectives, criteria, scope, schedule, and team written in the audit plan for this audit
- Auditee notified of dates and scope (about one month ahead)
- Auditors do not audit their own work
- Previous findings and the status of their corrective actions reviewed
- Checklist updated, with open questions about effectiveness, not only "is there a record?"
- Backward trace considered (from a shipped lot, complaint, or defect record) to check effectiveness
- Sample records chosen from peak periods, staff changes, and right after changes
- Competence matrix to be compared with who is actually working on the floor
- Time reserved for the team to agree on findings before the closing meeting
Finding Statement Template
Write every nonconformity in the same three-part format:
- Fact: On [date], at [process/location], [what was seen, with record number or part number].
- Requirement: [Document name and revision, section] requires [what it says]. (ISO 9001 clause [x.x] where relevant)
- Conclusion: The requirement was not met. Classified as [major/minor nonconformity] per [your audit procedure].
Questions to Ask Your Japanese Customer or Parent Company
If your internal audit will be reviewed by a Japanese customer or parent company, confirm these points first:
- Which edition should our internal audit procedure follow during the transition, ISO 9001:2015 or ISO 9001:2026?
- Do you have required formats for the audit plan, report, or corrective action reply? Are English versions available?
- Do you require specific finding categories (major, minor, observation) or response deadlines?
- Do you require a minimum audit frequency or coverage of specific processes beyond ISO 9001?
- Do you have requirements for internal auditor training or qualification?
- What format do you expect for the rikiryo-hyo (competence matrix), and which processes must it cover?
- Should corrective actions for audit findings be reported in an 8D format or your own format?
A short email you can adapt:
Subject: Internal audit requirements for [plant name]
We are planning our next ISO 9001 internal audit for [month]. To make sure our audit plan and report meet your expectations, could you confirm the following? (1) Which edition of ISO 9001 our procedure should follow during the transition. (2) Whether you require specific formats for the audit report and corrective action replies. (3) Whether you have requirements for auditor qualification or for the competence matrix (rikiryo-hyo). Thank you for your help.
Limits of This Guide
This guide is based on ISO 9001:2015 clause numbering and ISO 19011:2018 guidance (JIS Q 19011:2019 in Japan). The 2026 editions of both standards were published in 2026, so check the current wording before you revise your procedure.
Finding categories, deadlines, notice periods, and report formats are company decisions, not ISO requirements. Your customer's or parent company's rules override the examples here. Sector standards such as IATF 16949 add internal audit requirements that this guide does not cover.
FAQ
Do ISO 9001 internal auditors need to be certified?
No. ISO 9001 does not require auditor certification, only that you select auditors who keep the audit objective and impartial. Auditors build competence through a combination of training, work experience, and audit experience under a competent auditor, and your customer may set its own requirements.
How often should ISO 9001 internal audits be done?
ISO 9001 requires audits at planned intervals, not a fixed frequency such as once a year. Set frequency and depth in your audit program based on process importance, changes, and previous audit results.
What is the difference between an internal audit and a certification audit?
An internal audit is the organization checking its own system for conformity and effectiveness so it can improve. A certification audit is an independent certification body deciding whether to grant or maintain certification. Certification audits usually happen about once a year, and internal audits check the system in between.
How do you write an internal audit finding?
State the fact you observed, the requirement you compared it against, and your conclusion, including the category. Leave out guesses about the cause. Finding the cause is part of the auditee's corrective action.
Does ISO 9001:2026 change internal audit requirements?
Not much. Certification bodies report that the 9.2.2 title now refers to the internal audit programme and that audit objectives have been added to what you define for each audit. The Japanese edition, JIS Q 9001, is scheduled for December 2026, so Japanese parent companies may update their procedures after that.
Sources
- ISO 9001:2015 clause 9.2; JIS Q 19011:2019 (ISO 19011:2018) audit principles, conducting audits, reports, and auditor competence; common misconceptions about internal audits: Japanese Standards Association, briefing materials on the revision of JIS Q 19011:2019 (Japanese)
- ISO 9001:2026 publication date and transition timeline: ISO/TC 176, News and updates
- ISO 9001:2026 publication: R&E, "ISO 9001:2026 has been published" (Japanese)
- Changes to 9.2.2 in ISO 9001:2026 and JIS Q 9001 schedule: JCQA, ISO 9001/ISO 14001 revision update, September 16, 2026 (Japanese); ISOcom, ISO 9001:2026 changes (Japanese)
- ISO 19011:2026 publication and scope of changes: Complife Group, "ISO 19011:2026, What changes for Management System Audits"
- Finding categories and the fact, requirement, conclusion format: ISO Ninsho Navi, internal audit nonconformities and how to write them (Japanese)
- Sample nonconformity statements: Vision de Mawasu Hakase no Hinshitsu Management, Internal Audit Guide (Japanese)
- Advance notice and sample questions: IR Engineer Education Institute, "What Is an Internal Audit?" (Japanese)
- Auditor knowledge and follow-up timing: J-VAC, ISO 9001 9.2 Internal Audit (2) (Japanese)
Original article in JapaneseThis guide is adapted from a MONOSCOPE article written for readers in Japan: ISO9001内部監査の進め方|6ステップとチェックリスト・力量表の見方・指摘の書き方


