ISO 9001 internal audit process (clause 9.2)
An ISO 9001 internal audit process flowchart aligned to clause 9.2. Documents audit programme planning, criteria definition, audit execution, finding routing, corrective action, and management review.
How it works
Describe how the programme gets set
Write down the criteria the frequency is actually based on: process risk, past nonconformities, customer complaints and changes since the last audit.
Make independence a step
Assigning the auditor needs its own node with an assessment of whether they'd be auditing their own work.
Split the findings into classes
Nonconformity, observation and improvement suggestion need to follow separate paths.
Link nonconformities to the CAPA process
Let the diagram end in the CAPA process rather than in the audit report.
End in management review
Add the step where aggregated results feed into clause 9.3.
Frequently asked questions
What does ISO 9001 clause 9.2 require?
Clause 9.2 requires planned internal audits at defined intervals, with documented programme, criteria, and audit scope; reporting of findings to relevant management; correction and corrective action; and retention of documented information as evidence.
How does the internal audit process tie to corrective action (CAPA)?
Audit findings feed clause 10.2 (nonconformity and corrective action). QueryChart links the audit-finding step in the internal audit process map to the CAPA workflow template.
How often do we need to run internal audits?
The standard doesn't set an interval, but requires the programme to account for process importance, organizational changes, and past results.
Can an employee audit their own department?
An auditor may not audit their own work. Use cross-audits, an external auditor, or another accountable reviewer.