ISO 9001 internal audit process (clause 9.2)

What the iso 9001 internal audit process (clause 9.2) process is

Internal audit is where a quality management system either proves it works or reveals itself as a pile of documents. The difference rarely lies in the audit itself. It lies in what happens to the findings afterward: do they get classified, do they get an owner and a deadline, and is it verified that the action actually worked?

The useful version of the process is drawn as a closed loop. The audit programme is set from risk and past results, each audit gets its criteria and scope, findings are classified as nonconformity, observation or improvement suggestion, and only nonconformities move on to corrective action under clause 10.2. Verification leads back to closure, not to the report.

Independence is the other thing the diagram needs to make visible. Clause 9.2 requires that auditors not audit their own work. That's easy to write into a procedure and just as easy to break in practice, so assigning the auditor should be its own step with an explicit independence check, rather than a note buried in the planning.

What this flowchart covers

In this template

• The audit programme: frequency and scope set from process risk, past nonconformities, and changes since the last audit, approved by the quality manager
• Planning the individual audit (criteria, scope and audit plan) plus assigning an auditor with an explicit independence assessment
• Execution: an opening meeting, gathering objective evidence through interview, observation and document review, and a closing meeting with the auditee
• Classifying findings into nonconformities, observations and improvement suggestions: the branch that decides whether a finding triggers corrective action
• Reporting to relevant management and handing nonconformities to the CAPA process under clause 10.2, with an owner, a deadline and a root-cause analysis
• Closure and follow-up: verifying effectiveness, formally closing the nonconformity, and feeding results into management review under clause 9.3

When to use this template

• You're certifying to ISO 9001 or facing a surveillance audit and need to show the audit process as a controlled document
• Internal audits happen, but nonconformities get closed without documented verification that the action worked
• Auditors are, in practice, auditing their own department, and you need to make the independence requirement visible in the process
• The audit programme runs on a calendar rather than on risk, and you want to show the link to past results
• Results from internal audits never reach management review in a usable form

Controls documented

• 9.2
• 9.3
• 10.2

How it works

1. Describe how the programme gets set

   Write down the criteria the frequency is actually based on: process risk, past nonconformities, customer complaints and changes since the last audit.

2. Make independence a step

   Assigning the auditor needs its own node with an assessment of whether they'd be auditing their own work.

3. Split the findings into classes

   Nonconformity, observation and improvement suggestion need to follow separate paths.

4. Link nonconformities to the CAPA process

   Let the diagram end in the CAPA process rather than in the audit report.

5. End in management review

   Add the step where aggregated results feed into clause 9.3.

Frequently asked questions

What does ISO 9001 clause 9.2 require?

Clause 9.2 requires planned internal audits at defined intervals, with documented programme, criteria, and audit scope; reporting of findings to relevant management; correction and corrective action; and retention of documented information as evidence.

How does the internal audit process tie to corrective action (CAPA)?

Audit findings feed clause 10.2 (nonconformity and corrective action). QueryChart links the audit-finding step in the internal audit process map to the CAPA workflow template.

How often do we need to run internal audits?

The standard doesn't set an interval, but requires the programme to account for process importance, organizational changes, and past results.

Can an employee audit their own department?

An auditor may not audit their own work. Use cross-audits, an external auditor, or another accountable reviewer.