Internal auditsthat close
Orisynx keeps the internal audit programme, the checklists, the findings and the corrective actions in one place, so an audit is finished when its actions are verified, not when the report is written.
Where internal audits stall
The programme lives in a spreadsheet
Dates move, auditors change and nobody is sure which audits are confirmed. By the third quarter, the programme on file no longer matches what is happening.
Findings are raised, then forgotten
The report goes out, the actions are agreed, and months later the same finding turns up again because nobody checked whether the fix worked.
Evidence is scattered
Checklists sit in one folder, photos in a phone, and the proof of each fix in someone’s inbox. When the certification auditor asks, the trail takes days to rebuild.
The internal audit, step by step
Six steps, one record. Each one picks up where the last left off.
Plan the programme
Build the year’s internal audits in an audit plan, or import it from an .xlsx or .csv file. Every row is checked before anything is created, and errors are reported by row and cell. Each planned audit belongs to a department or site, carries a priority and a risk level, and moves from tentative to scheduled to confirmed.
- Import a programme from .xlsx or .csv
- Priority and risk level on every planned audit
- Progress per department, including overdue audits
2026 audit programmeActiveAudit Standard Date Status Purchasing ISO 9001 12 Mar Confirmed Warehouse, Leeds ISO 45001 3 Apr Scheduled Kestrel Metals Supplier 21 May Tentative Access control ISO 27001 9 Jun Scheduled 7 of 18 audits confirmed
Prepare the audit
Start an internal audit against ISO 9001:2015, ISO 14001:2015, ISO/IEC 27001:2022 or ISO 45001:2018, or as a custom audit. Questions come from templates your team builds, with text, number, date and choice fields, so the checklist follows your own processes. There is no pre-loaded clause library; templates can follow a standard’s clause structure.
- Templates built by your team
- Text, number, date and choice fields
- A shared calendar of audits and due dates
Template · Supplier audit12 questions- Supplier nameText
- Date of last evaluationDate
- Evaluation outcomeChoice
- Late deliveries in last 12 monthsNumber
Used in 14 audits this year
Conduct the audit
Work through the checklist and record each answer as in order or as an exception. Files, links and notes can be attached to the audit as evidence, so what the auditor saw stays with the record. The audit moves through draft, planning, active and completed, and the activity log records who changed what, and when.
- Each answer recorded as in order or exception
- Files, links and notes attached as evidence
- Activity log of who changed what
Purchasing · ISO 9001:2015In progress8.4 Control of externally provided processes
- Criteria for evaluating external providers are definedIn orderException
- Approved supplier list reviewed at planned intervalsIn orderException
- Purchase orders state requirements clearlyIn orderException
14 of 22 questions answered
Raise findings
Each finding is linked to the audit it came from and graded low, medium, high or critical. It moves from draft to open, in review and closed, and can carry its own files, links and notes. Comments can be added to the record, so the discussion stays with the finding.
- Severity: low, medium, high or critical
- Statuses: draft, open, in review, closed
- Evidence and comments on the finding
FND-0142HighApproved supplier list not reviewed since March 2024
Three of eleven active suppliers have no evaluation on file.
Correct and verify
Each finding carries corrective and preventive actions. The person responsible accepts the action or disputes it with a reason before work starts. Actions break down into tasks with an assignee, priority and due date, and every action passes through verify before it can close, with effectiveness recorded as effective, partially effective, ineffective or pending.
- Owners accept or dispute, with a reason
- Every action passes through verify
- Daily email digest of overdue and due-soon work
Remediation action for FND-0142Accepted- Open
- In progress
- Verify
- Closed
Report and review
Create an audit summary, finding trend or remediation status report as a draft for review. Analytics for each year show audits and completed audits, open findings, open and overdue actions and tasks, and each person’s open, completed and overdue work, ready for management review. Audit history exports to CSV.
- Audit summary, finding trend and remediation status reports
- Progress per department and per person
- Audit history export to CSV
Audit summary · PurchasingReport22Questions3Findings3/3Actions closedCritical 0 Effective 2 High 1 Partially effective 1 Medium 2 Ineffective 0
An audit in progress
A real Orisynx audit, with fictional data: test progress, findings raised and the corrective actions they opened.
Everyone in the audit
- Quality managersRun the internal audit programme, see which audits are confirmed or overdue by department, and take the year’s results to management review.
- Internal auditorsWork from your own templates, record each answer as in order or exception, and raise graded findings with the evidence attached.
- Action ownersAccept or dispute each action with a reason, break the work into tasks, and see what is due in a daily email digest.
For internal audits against ISO 9001, ISO 14001, ISO 27001 and ISO 45001, and your own templates for anything else.
Internal audit guides
- How to run an internal audit, step by stepA practical walk-through of one internal audit, from setting the scope and criteria to verifying the corrective actions, based on ISO 19011 and ISO 9001 clause 9.2, with a sample timetable for a one-day process audit.
- How to build an internal audit checklistA checklist that asks 'is there a procedure?' gets a yes and teaches you nothing. Here is how to write process-based questions that ask for evidence, tie each one to a criterion and tell the auditor what to sample.
- Independence and impartiality for auditorsInternal auditors should not audit their own work, but small organisations rarely have a dedicated audit team. Here is what the standards actually ask, the practical options, and how to check competence and conflicts before each audit.
- Opening and closing meetings that workThe opening meeting sets the terms of the audit; the closing meeting decides whether its findings are accepted. Here are agendas for both, who should attend, and how to present findings without starting an argument.
- Writing the internal audit reportThe report is the only part of the audit most managers will read. Here is what it should contain, how to keep it short and factual, who should receive it, and how audit results flow into management review.
- How to plan a risk-based audit programmeA practical method for building a year's internal audit programme around process importance, recent changes and earlier results, with a worked example from a metals manufacturer.
- How to write an audit finding that gets fixedA finding that names the requirement, shows the evidence and states the gap clearly is hard to dispute and easy to act on. Here is the structure, with weak and strong examples side by side.
Internal audit questions
How often must we carry out internal audits?
ISO 9001 and the other management system standards ask for internal audits at planned intervals, taking account of the importance of each process, changes and previous results. They set no fixed frequency. Many organisations audit high-risk processes once or twice a year and cover the whole system over a three-year cycle, but check what your certification body expects to see each year.
Can we use internal auditors from another site?
Yes, and it is a common way to keep audits impartial in a small team, since the standards expect auditors not to audit their own work. In Orisynx, people are invited by email and given a role, each planned audit belongs to a department or site, and the activity log records when a planned audit is reassigned.
Does it work for ISO 27001 internal audits?
Yes. Audits can be started against ISO/IEC 27001:2022, as well as ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018. There is no pre-loaded Annex A checklist: your team builds the template, so the questions follow your own controls and statement of applicability.
Can we import our existing audit programme?
Yes, from an .xlsx or .csv file. Every row is validated before anything is created, and errors are reported by row and cell so you can fix the file and upload it again. Legacy .xls files are rejected with a message.
How are findings followed up?
Each finding carries corrective and preventive actions. The owner accepts or disputes each action with a reason, works through tasks with due dates, and the action passes through verify before it can close, with its effectiveness recorded. Overdue work appears on the shared calendar and in a daily email digest.
What does it cost?
Plans start at ₦150,000 a month, excluding VAT.
Run your next internal audit here
Bring an audit you have already run. We will walk it through Orisynx with you, from the plan to the last closed corrective action.