How to create an internal audit process
How to design an internal audit process as a cycle rather than a project: a risk-based programme deciding what gets audited, an independence check on every assignment, and a close-out that re-samples.
An internal audit process runs at two levels: a risk-based programme deciding which processes are audited and how often, and the audit itself: plan, sample, report, correct, then verify.
The short version
- The programme decides what is audited and when; one audit is an iteration of it.
- Frequency follows risk, change and finding history, never an even calendar.
- Independence is a property of the assignment, which makes it a question about lanes.
- Close-out is fieldwork: the auditor re-samples the population the finding came from.
- Nonconformities oblige corrective action; observations do not, so the grade is a funding decision.
The programme is the process, not the audit
Almost every internal audit map documents one audit and leaves the programme implicit. That is how an organisation accumulates three years of reports covering the same three areas: the ones that are easy to schedule and where the auditee is helpful. The programme is the process: a schedule derived from risk, from recent change and from what previous audits found, covering every process over a defined period. A single audit is one iteration of it.
The second decision is what a close-out consists of. Verifying a finding is not a status change: it means returning to the population the sample came from and drawing a fresh sample against the same requirement, recorded with a scope and a size like any other test. That is fieldwork, and it is why the verification row sits in the auditor's lane: whoever implemented the action cannot be the one who measures whether the records now pass.
The example below is one turn of the cycle across six phases and four roles. "Auditor independent of the area?" is asked before any planning happens, because independence is a property of the assignment and not of the auditor. At the far end, "Corrective action effective?" carries a "Reopen" branch back to "Agree root cause and corrective action": one of only two routes on this chart that point backwards, and the one that sends a finding back for a second attempt instead of into the register.
Four roles, one closed finding
Watch the programme come before the first audit, and a "Reopen" branch send a finding back for a second attempt at its corrective action.
Start with the programme
The chart opens on "Review risks and past findings" rather than on an audit, then builds the annual programme and assigns an auditor to each entry in it. Three rows, and not one of them is an audit, which is the half most internal audit maps leave out.
Independence before planning
"Auditor independent of the area?" routes a No to "Reassign to another auditor", which points back at the gate to be asked again. Only then does planning start: a checklist, dates agreed with the auditee, and "Provide procedures and records" sitting in the auditee's own lane.
The report is not the finish
Fieldwork samples records and grades what it finds. "Evidence meets the requirement?" sends a "Gap found" to "Record nonconformity or observation", both routes converge on the closing meeting, and the report is issued. Most internal audit maps stop on that row.
A finding closes when verified
Root cause is agreed with the process owner, the action is completed by its due date, and then "Corrective action effective?" decides. "Reopen" goes back to row 16 rather than onward, and only the verified route reaches management review and a retained record.
How it works
List every process before scheduling one
The programme needs a denominator. Write down every process in scope with its owner, then note when each was last audited and what came out of it. The gaps in that list are the argument for the schedule, and they persuade management more reliably than the schedule ever does on its own.
Derive each interval from a risk score
Score every process on impact, recent change and finding history, and let the score set the interval: quarterly for one that has failed twice, once a cycle for one that has been stable for years. Record the reason beside the interval, because an auditor asked why dispatch is audited every three years needs an answer.
Build the programme rows first
In QueryChart the opening rows are the programme, not the audit: a Start shape on "Review risks and past findings", then the rows that build the schedule and assign an auditor to each entry. Keeping them in the same chart as the fieldwork is what makes the cycle visible to the person following it.
Add the independence gate as a decision
Phrase the assignment row as a question, then change its Shape column to Decision and give Line to two row numbers, with the answers in Line text in the same order. The reassignment route points back at the gate to be checked again, so its number is smaller than the row it is written on.
Put each step in its owner's lane
Vertical lane holds the role (quality manager, internal auditor, auditee, top management) and Horizontal lane holds the phase. Lanes are what make independence checkable at a glance: when fieldwork rows sit in the same lane as the process under audit, the chart is showing you a finding.
Close the cycle in the auditor's lane
Add the verification row in the auditor's lane, give it a scope (which population, how many records, after how long) and route its failure back to "Agree root cause and corrective action". Then share the link with the auditee, not only the audit team: whoever sees that row knows the finding closes on the re-sample, not the action report.
Mistakes to avoid
Filling the calendar month by month
Twelve audits, one a month, chosen because they are convenient to arrange. Coverage looks complete and risk appears nowhere in it. Write each frequency against a risk score and the awkward areas stop being postponable.
Treating the report as the deliverable
Issuing it feels like the end of the work, and nearly all of the value sits downstream. On a map the weight belongs after the report: root cause, action, verification, and what the next programme does differently.
Auditing the process you manage
Convenient, and it voids the result: nobody samples their own records against their own procedure and finds much. Swap auditors between departments, or borrow a trained one from another site, rather than waiving the check.
Findings with no clause cited
A finding that does not name the requirement it breaches is an opinion, and it gets talked away at the closing meeting. Cite the clause or the procedure and the discussion moves to the evidence, where it belongs.
Build your own internal audit cycle
Open the internal audit example as your own chart, set your own audit frequencies, and name who verifies a finding before it closes.
Related guides
Frequently asked questions
How often should internal audits be carried out?
At planned intervals set by risk, which for most management systems means every process at least once per certification cycle and the exposed ones considerably more often. ISO 9001 asks for planned intervals and deliberately names no frequency, so auditing everything once a year is a choice rather than a requirement, usually a poor one, because it spreads identical effort across processes with wildly different consequences. Frequency should also move: a process with two open findings has earned an earlier revisit.
Who is allowed to carry out an internal audit?
Anyone trained in auditing who is independent of the area under audit: independence, not seniority, is the constraint. An auditor from another department, from another site, or a contracted one all qualify. The process owner does not, and neither does whoever wrote the procedure being sampled. Small organisations solve this by swapping auditors between functions rather than by waiving the requirement, and the assignment step is where the check belongs, because the assignment is where the conflict is created.
When can an internal audit finding be closed?
When an auditor has gone back to the population the finding came from, sampled it again, and found it now meets the requirement. Close-out is a piece of fieldwork with a scope, a sample size and a date, not a field changed from open to closed, and that is why it waits for an agreed interval rather than the following week: a sample drawn the day after the fix shows the fix was installed, not that it holds. Whether the action was well chosen is the corrective action process's question.
What is the difference between a nonconformity and an observation?
A nonconformity is a failure to meet a stated requirement and it obliges corrective action; an observation is a weakness or an emerging risk that breaches nothing and carries no such obligation. So the grade is a funding decision, not a wording one: mis-grade upwards and the register carries an obligation nobody budgeted for, mis-grade downwards and one that was owed has been quietly discharged. Decide it at the closing meeting, with the clause cited and the sample recorded.