ISO 9001 requires internal audits at planned intervals, but the best organizations use them as a tool for improvement, not just for certification.
Plan a risk-based programme
Audit important and risky processes more often. Use complaints, nonconformities and changes to decide where to look.
Audit processes, not clauses
Follow the process from input to output. Ask how it is planned, what the measures show and how problems are handled, then link what you find to the relevant requirements.
Collect objective evidence
- Interview the people doing the work
- Observe activities
- Sample records
- Compare what happens with what is planned
Write clear findings
A good nonconformity states the requirement, the evidence and why it does not conform. Also record opportunities for improvement and good practice.
Follow up
Agree corrective actions with owners and dates, check that root causes were addressed, and close findings only when actions are effective.
