Internal Audit Procedure

The internal audit procedure is one of six required procedures in ISO 9001. This procedure must detail, at a minimum, who is responsible for the audit planning, what are the requirements for conducting audits, how audit planning takes place, how the audit results are reported and what records are maintained from the audit. Whew… this could get complicated!

Creating your internal audit procedure is easier than it looks. We’ll detail each of the above concepts so that you’ll have a good understanding of what to expect if you’re writing one… and what to expect if you’re auditing one.

Well written procedures generally detail the purpose of the procedure. In this case, the purpose is to define the requirements and responsibilities for audit planning, preparation, performance, reporting and follow-up. Define the application of the procedure next, that is, to whom and where does the procedure apply. The internal audit procedure will apply to audits performed by trained auditing personnel, process owners and all identified processes within your quality management system.

Determine who is responsible for maintaining your audit program. Record that individual’s title in the procedure stating that the person with this title is responsible for the audit program. Don’t list a name, you’ll have to change the procedure each time there is a change of personnel in the position.

Record any associated documents and records that pertain to the audit program. Documents such as the audit schedule, checklist forms, audit report form, process flow diagrams and related procedures (Corrective Action comes to mind) should be considered as related documents.

Now you’re ready for the body of the internal audit procedure. If you have an audit schedule, record how the schedule is to be created. Click on the above link to go to the audit schedule page where we provided an overview.

What will be required of your auditors? Specialized training or can they learn by being part of an audit team? Do you use checklists for conducting audits? Have the auditors been trained on checklist creation? Do they know what documents are relevant to the process being audited? Determine these requirements and record them in your procedure.

Speaking of checklists, if your audit program provides for the use of checklists, define what types of documents should be reviewed during checklist creation. Click the above link to go to learn more about checklist creation.

Establish the method of reporting the audit results and detail your method. Have a controlled document to record the audits results. This is not required, but having one simplifies your audit program. The standard only states that there must be records and that each company defines the records within the procedure. But using the same format for all audit results makes reading the results easier for your auditees (process owners) and for your auditors to review.

In the last section of your procedure, define how the negative findings enter into your corrective action program. We cover this topic in greater depth on the internal audit report page.

Return from the Internal Audit Procedure page to the Audit Program page