Internal Audit Report



Your Internal Audit Report is the significant output of the audit process. Not only is the document considered as evidence of your audit program, it is also the vehicle that conveys the audit results to the responsible process owners.

Because of the two-fold nature of the internal audit report, importance must be placed upon the creation of the document so that it will meet both needs. If we can meet these goals with just one document, we’ve also made our QMS simpler as well.


internal audit report form

The internal audit report document should list several specific topics about the audit conducted, with the first being the area or areas that were audited and the names of the process owner(s). Recall that the process owners are generally the managers or supervisors of the audited area.

The audit criteria are the documents or standards against which you will compare the evidence during the course of the audit. In other words, during an audit you collect evidence regarding how the process is performing compared to any procedures, goals, and the ISO 9001 standard. These are your audit criteria.

Detail the scope of the audit. The audit scope can generally be written as "determining conformance of (insert process name) to the ISO 9001 (or applicable) standard, additional customer and internal requirements."

The internal audit report should also list the audit trail, which is a detailed listing of the documents viewed by the auditors. These details should include which specific documents were reviewed. If you saw 4 purchase orders during your audit, record the purchase order numbers. If you examined some work instructions, record the exact work instructions that were reviewed.

Remember that as part of the audit planning, the auditors review previous audits of the same process. Providing a high level of detail in the audit trail portion of the report allows for better planning the next time this process is audited. After all, it does you no good to audit the same documents again. You’ve already determined if they were conforming.

Record any opportunities for improvement, potential issues identified and other positive comments within the observation field of your form. Always attempt to find improvement opportunities while you audit.

Lastly, state if nonconformities were identified during the audit and how many were found. You can also include a statement template into this field to make finishing the internal audit report much easier. The template could read something like this:

During the above audit ____ findings were identified and ____ Corrective Action Requests issued. The Corrective Action Request Numbers _____________________________________ are attached and were given to the process owner(s) at the closing meeting of (insert date of meeting).

This process is - is not deemed effective (circle one).
Increase audit frequency? Y N


Recording a Finding

The goals of recording an audit finding are to 1) identify an issue and get it corrected and 2) minimize additional internal auditor involvement. Unfortunately, many inexperienced auditors fail to document their finding in this manner. Again, the details are critical to appropriately recording audit findings.

A well written finding consists of three concepts. You will meet the goals of recording a finding by following these guidelines.

  • List the requirement- From the audit criteria, which clause or which document details the requirement that your evidence shows is not in compliance. Be specific when listing the requirement. For example, if you determined that the audit results were not discussed in management review, you would state the requirement is 5.6.2.a, rather than the more general 5.6.
  • List the evidence that supports your finding- Record the specific document, record, etc. that details exactly what you found to be not in compliance. It is better to state "2007 Management Review Meeting Minutes" than just management review minutes. This tells both the process owner and future auditors what evidence was found during the audit.
  • Reference the requirement- Paraphrase the clause or procedure paragraph that is not compliant. You may choose to record the exact terminology from the standard or procedure. As long as what you write describes the intent of the requirement, you’ve fulfilled this aspect of recording a finding.

The paragraph below is an example of a well written finding. Notice the finding lists the requirement first, clause 5.6.1. The finding paraphrases the clause then details what the clause says. The finding then reports the evidence that was reviewed. It also indicates another nonconformity, clause 5.6.2.

ISO 9001:2008 clause 5.6.1 states that management shall review the QMS to ensure effectiveness. Review of the September 2005 Management Review records shows top management didn't ensure effectiveness of QMS. Data and analysis were missing for Shipping, Receiving and Purchasing processes. This is also a violation of clause 5.6.2.c which says an input to management review shall be process performance. Corrective Action had been issued in the past to process owners for data/analysis issues.

Please note that the above finding could also be considered as nonconforming to clause 8.5.2, Corrective Action.

The inclusion of these three concepts in your internal audit report allows the process owner to understand exactly what the auditor saw and why it is nonconforming. The process owner can take action without having to contact the auditors to ask "what does this mean?" Also, a well written finding can be directly copied into the corrective action request form. There's no need to rewrite the finding for another document if you've made the effort to write an effective finding.

Check out our ISO9001 Internal Quality Auditor Seminar










›› ›› Internal Audit Report