How to run an internal audit, step by step

Most internal audits go wrong before anyone opens a file. The scope is vague, the auditee hears about it the day before, the auditor arrives with a clause list instead of a plan, and the report appears three weeks later when nobody remembers the details. This guide walks through one audit from start to finish, the way ISO 19011:2018 describes it and the way ISO 9001:2015 clause 9.2 expects it to be run, using a purchasing audit at Kestrel Metals, a fictional fabricator with plants in Lagos and Ogun, as the running example.

Set the scope, criteria and plan

An internal audit starts from the programme. ISO 9001 clause 9.2.2 asks you to define the criteria and scope for each audit, to select auditors who will be objective and impartial, to report results to the relevant management, to act on what is found without undue delay, and to keep records. ISO 14001, ISO/IEC 27001 and ISO 45001 carry the same requirement in near-identical words.

Three things need writing down before you do anything else:

• Audit scope: which process, site, shifts and period. “Purchasing at the Ikeja plant, purchase orders raised January to August 2026” is a scope. “Purchasing” is not.
• Audit criteria: what you will compare evidence against. Usually the relevant clauses of the standard plus your own procedures, customer requirements and any legal requirements.
• Objective: why this audit, now. For Kestrel Metals, the objective was to confirm that supplier evaluations were up to date after two late steel deliveries in the second quarter.

The audit plan turns those into a day: who is interviewed, at what time, where, and which records you will ask for. A one-page plan is enough for most internal audits. Tunde Bakare, the auditor from production planning, drafted his plan five working days before the audit and checked it with A. Mensah, the quality manager, who runs the programme.

Notify the auditee and review documents

Send the plan to the auditee, the process owner, typically a week or two before the audit. Ask them to confirm the date, name who will be available, and say if any record needs to be pulled from archive or another site. An audit that arrives as a surprise produces defensive interviews and missing records, and the findings then argue about logistics rather than the process.

Use the time before the audit for a desk review. Read the procedure, the last audit report for this process, open findings and their actions, recent complaints or incidents, and any change since the last audit, such as a new buyer or a new ERP module. At Kestrel Metals, the desk review showed that procedure QP-08 required annual supplier re-evaluation and that the previous audit had closed a finding about missing evaluations eighteen months earlier. That gave Tunde a clear trail to follow: had the fix held?

Turn the desk review into a short checklist of questions and records to ask for. The guide on building an internal audit checklist covers how to write questions that test evidence rather than invite a yes.

Open the audit properly

The opening meeting usually takes ten to fifteen minutes for an internal audit. Confirm the scope, the plan and timings, who will act as guide, how findings will be graded, when the closing meeting is, and any safety or confidentiality rules for the areas you will visit. It is also the moment to say that the audit is of the process, not the people.

Keep it short, but do not skip it. Agreeing the closing meeting time at the start is what makes the closing meeting happen. The guide on opening and closing meetings has agendas for both.

Fieldwork: interviews, observation and sampling

Fieldwork is where audit evidence is collected. ISO 19011 describes three main sources: interviews, observation of activities, and review of documented information. A good audit uses all three and checks one against another.

Interviews. Ask open questions and ask people to show you how they do the work: “Walk me through how you approved the last new supplier.” Talk to the people who do the job, not just the manager. Record the role and the time, not just the answer.

Observation. Watch the process happen. In purchasing that may mean sitting with a buyer while an order is raised; on a shop floor, watching goods-in inspection of a delivery. Observation catches the difference between the procedure and the practice.

Records. Pick samples yourself from a list the auditee provides. Do not accept the folder they have prepared. Work in both directions: from the approved supplier list to the evaluation records, and from purchase orders back to the approved supplier list.

There is no sample size in the standards. ISO 19011 discusses judgement-based and statistical sampling, and most internal audits use judgement. A common practice:

• For a small population, under about ten items, look at most or all of it.
• For a few dozen items, take five to ten, spread across the period.
• For hundreds, take ten to fifteen, including the busiest months and any period of change.
• If the first few items show a problem, extend the sample to see how far it goes.

Write down what you sampled as you go: record IDs, dates and how many conformed. Tunde sampled all 11 active suppliers on the approved list and 12 purchase orders across eight months. Three suppliers had no evaluation since 2023, and two of the 12 orders were with one of them.

Keep notes that someone else could follow: the record ID, the date, what the record showed and whether it met the criterion. Photographs of labels, screens or noticeboards help where your site rules allow them. Notes written up at the end of the day from memory lose the detail that makes a finding hard to dispute.

Turn evidence into findings

Before the closing meeting, take time alone or with the audit team to review the evidence. Every audit finding should state the requirement, the evidence and the gap, and should be graded according to your scheme. Record what conforms as well; the report should say where the process works.

At Kestrel Metals, Tunde raised one nonconformity against clause 8.4.1 and QP-08: three of eleven active suppliers had no current evaluation. He recorded an observation that the evaluation form did not ask about delivery performance, which explained why the late steel deliveries had not triggered a review. The guide on writing audit findings sets out the structure in detail.

In Orisynx, each checklist answer is recorded as “in order” or as an exception, and findings are linked to the audit and graded low, medium, high or critical, so the evidence trail from question to finding stays in one record.

Close the audit and write the report

At the closing meeting, present the findings, read each nonconformity out, and confirm the facts. Disagreement about the grade can be settled later; disagreement about the facts should be settled before you leave. Agree who will respond to each finding and by when.

Write the report while the detail is fresh, typically within five working days. It should state the scope, criteria, dates, team, what was sampled, the findings by severity, positives and a conclusion. The guide on writing the internal audit report gives a template.

A typical day for a single-process internal audit looks like this:

Time	Activity	Notes
08:30	Opening meeting	10 to 15 minutes; confirm plan, guide and closing time
08:45	Process walk-through with the owner	How the process should work; recent changes
09:30	Records sampling	Auditor selects samples from full lists
11:00	Observation at the workplace	Watch the activity; short interviews with operators
12:30	Break
13:15	Interviews with staff and support functions	Follow trails to stores, finance or IT as needed
14:45	Fill gaps and extend samples	Revisit anything unclear from the morning
15:30	Auditor review	Agree findings and grades in private
16:00	Closing meeting	Present findings; agree response dates
16:30	End	Report issued within about five working days

Follow up until the actions close

An audit is not finished when the report goes out. Clause 9.2.2 asks for correction and corrective action without undue delay, and clause 10.2 expects you to review whether corrective action was effective. In practice that means three checkpoints:

1. Response. The process owner accepts the finding and proposes a correction, a root cause and a corrective action by the agreed date, usually two to four weeks.
2. Implementation. The owner shows evidence the action was done: a revised procedure, completed evaluations, training records.
3. Effectiveness. Some time later, the auditor or quality manager checks the result: are evaluations now done on time, and has the problem recurred?

At Kestrel Metals, J. Okafor in purchasing accepted the finding, completed the three missing evaluations within a month and added delivery performance to the evaluation form. A. Mensah checked six months later that all eleven suppliers had current evaluations before closing the action. The guides on root cause analysis and checking a corrective action worked cover those steps in depth.

Sources

• ISO 19011:2018, Guidelines for auditing management systems: https://www.iso.org/standard/70017.html
• ISO 9001:2015, Quality management systems, Requirements: https://www.iso.org/standard/62085.html