How to plan, staff, and run an ISO 9001 internal audit program when your whole quality department is two people and a clipboard
Affiliate Disclosure: Some links in this article are affiliate links. If you purchase through them, The Standards Navigator may earn a commission at no additional cost to you.
Your ISO 9001 Internal Audit Program Should Find Problems Before Your Registrar Does
An ISO 9001 internal audit program is supposed to find your problems before your registrar does. In a small company, it can do the opposite. It gets squeezed into the month before surveillance, run by the same two people who wrote the procedures, and closed out with a report that says everything is fine.
Registrars know what that looks like. A clean internal program followed by an external audit with several findings tells the auditor your internal audits aren’t working.
The fix isn’t a bigger team. It’s a risk-based program, spread across the year, staffed so nobody audits their own work. Whether you’re certified and facing the ISO 9001:2026 transition or a 15-to-60-person shop building toward first certification, here’s how to run internal audits that hold up with the people you have.
From the Floor: My current fabrication shop runs quality with a three-person QA/QC team: two inspectors and one person driving the program. Many of our procedures were written for field construction, so we modify them for the shop. That makes auditing against them harder. Our internal audits tend to land right before a customer or certification audit, and one of them showed exactly what that costs. Our material tagging procedure was being followed, but the tags didn’t carry the correct information. One color of tag had run out, and the crew had switched to colored tape, which turned out to be the wrong color.
Everyone knew what needed to happen and was close to doing it right. It took an audit against the actual procedure to expose the gaps. The good news is that our internal audit caught it, not the customer. The bad news is that we found it days before the customer walked in, when a scheduled internal audit should have caught it months earlier. And it raised a harder question: if one procedure we trusted had drifted that far, how many others did we need to audit to know the program was actually working?
👉 Before you schedule your next ISO 9001 internal audit, check where your QMS actually stands. The free ISO 9001 Roadmap — now updated for ISO 9001:2026 — walks you step by step through what your quality system needs, so your audit program targets real gaps instead of re-checking what already works.
In This Guide
- What clause 9.2 requires — and what the 2026 edition adds
- A quick-answer table for running an ISO 9001 internal audit with a small team
- How to solve the impartiality problem when you only have two or three auditors
- A sample risk-based annual audit schedule for a small shop
- How to write audit objectives that satisfy the 2026 requirement
- Illustrative hour estimates and what drives them
- Common findings in practice, a pre-surveillance checklist, and FAQs
Table of Contents
👉 Start Here (Top Resources)
- Get the standard you’re auditing against. Your auditors can’t verify conformance to requirements they’ve never read. Buy the current edition, ISO 9001:2026 from the ANSI Webstore, in PDF or print, and use code CC2026 at checkout for 5% off through December 31, 2026.
- Skip building audit forms from scratch. 9001Simplified offers an ISO 9001 Audit Toolkit with an internal audit procedure, a clause-by-clause audit checklist, an executive audit checklist, and a report form — built for small and medium-sized organizations that want to run their own audit program instead of outsourcing it.
- Train the people you’ll put on the audit team. BSI Group’s ISO 9001 training courses and ISOQAR’s ISO training catalog both cover internal auditor skills — check each for courses updated to the 2026 edition.
Quick Answer: ISO 9001 Internal Audits for a Small Team
| Question | Short Answer | Notes |
|---|---|---|
| How often must you audit? | At planned intervals — ISO 9001 doesn’t set a fixed frequency | Your program decides frequency based on process importance, changes, and previous results |
| How much of the QMS must you audit? | Enough to show the QMS conforms and is effectively implemented and maintained | ISO 9001 doesn’t prescribe auditing every procedure at a fixed frequency; plan coverage by process importance, changes, and prior results |
| Can you audit your own work? | You shouldn’t | Auditors must be selected and audits conducted so the process stays objective and impartial |
| What’s the most visible 2026 change? | Each audit needs explicitly defined objectives, alongside scope and criteria | Add an objective sentence to every audit plan and answer it in the report |
| Do internal auditors need certification? | No certificate is required by the standard | Auditors must be competent — training records are your evidence |
| What guidance applies? | ISO 19011:2026 (guidance, not requirements) | You can’t be certified to ISO 19011; it shows how to run audits well |
What Clause 9.2 Actually Requires
Clause 9.2 is short. Small shops still miss parts of it. At its core, it requires you to conduct internal audits at planned intervals to determine two things: whether your QMS conforms to your own requirements and to ISO 9001, and whether it is effectively implemented and maintained. Those are separate questions. An audit that only checks whether a procedure exists answers the first one and skips the second.
Under clause 9.2.2, you also need to:
- Plan and maintain an audit program — frequency, methods, responsibilities, planning, and reporting — that considers the importance of each process, changes affecting the organization, and previous audit results
- Define the criteria and scope for each audit — and, under the 2026 edition, the objectives
- Select auditors and conduct audits so the process stays objective and impartial
- Report results to relevant management
- Take correction and corrective action without undue delay
- Retain documented information as evidence of the program and its results
The ISO 9001:2026 edition was published September 16, 2026. It explicitly requires organizations to define the objectives, criteria, and scope for each internal audit. The rest of clause 9.2 retains the core requirements for planned audits, impartiality, reporting, corrective action, and audit records. For small manufacturers, the practical takeaway is straightforward: every audit should have a clear purpose, and the findings should show whether that purpose was achieved. ISO, the standard’s publisher, maintains the official catalog record for each edition. If you need the full clause-by-clause picture, our ISO 9001 clause breakdown walks through clauses 1 through 10.
ISO publishes companion guidance for running audits in ISO 19011:2026, Guidelines for auditing management systems, the fourth edition, published in May 2026.
That guidance isn’t a requirement. It explains audit principles, program management, and auditor competence — the same concepts your registrar’s auditors work from.
The Small-Team Problem: Impartiality
Here’s where small companies get stuck. The standard says auditors can’t audit their own work. In a 25-person machine shop, the quality manager wrote the procedures, runs receiving inspection, and manages the calibration program. Who audits that?
You have more options than you think.
| Option | How It Works | Watch Out For |
|---|---|---|
| Cross-auditing | Production supervisor audits purchasing; quality manager audits production | Each auditor needs training and enough independence from the area audited |
| Trained operators or leads | A senior welder or machinist audits a process outside their own department | Plan release time — production pressure kills audit schedules |
| Outsourced auditor for the quality function | Hire an outside auditor for the processes your quality lead owns | Scope it tightly; you only need outside help where impartiality breaks down |
| Peer exchange with another shop | Two non-competing local manufacturers trade internal audits | Put a confidentiality agreement in writing first |
| Owner/GM as auditor | Top management audits an operational process they don’t run day to day | Leadership’s own processes (clause 5, management review) still need someone else |
Common finding in practice: The quality manager audits every process, including document control and corrective action — the two processes they personally own. Even a strong audit loses credibility when the auditor is checking their own work.
If you are a shop with one quality person → train one or two supervisors as internal auditors and outsource only the audit of the quality function itself. That can cost a fraction of a fully outsourced program.
US manufacturers can also check with their local center in the NIST Manufacturing Extension Partnership network, which supports small and mid-sized manufacturers with quality and ISO assistance.
Build a Risk-Based Annual Schedule
You don’t need to audit everything at once. You need to audit everything across the program, with the riskiest processes getting more attention.
A risk-based schedule weighs three inputs the standard names directly: how important the process is, what has changed, and what past audits found. For a fabrication or machine shop, that tends to point at special processes, contract review, purchasing, and nonconformance control.
Here’s an illustrative schedule for a small job shop. Treat it as a starting template, not a mandated sequence.
| Quarter | Processes Audited | Why Here |
|---|---|---|
| Q1 | Contract/order review, purchasing and supplier control | Early-year contract and supplier changes surface before they cause escapes |
| Q2 | Production and special processes (welding, coating, heat treat), work instructions at point of use | Peak production exposes whether procedures match the floor |
| Q3 | Receiving and final inspection, calibration, nonconformance and corrective action | Tests whether problems found in Q1–Q2 actually got fixed |
| Q4 | Leadership, context and risks, objectives, document control, organizational knowledge | Feeds directly into management review before year-end |
High-risk processes can appear twice. If a customer escape traced back to welding in Q2, add a follow-up audit of welding in Q4. That’s the program responding to previous results — exactly what clause 9.2.2 asks for.
Supplier controls deserve their own attention. Small shops depend on outside providers for material, coating, heat treat, and calibration services, and that dependency can be where nonconformances start. Our guide to supplier quality requirements covers what to verify.
👉 If your supplier controls haven’t been audited in the last year, that’s a gap your registrar will find first. Run the free Supplier Quality Checklist before your next audit cycle — it shows exactly which flow-down and evaluation controls are missing, so you can schedule your purchasing audit around real weak spots.
How to Write Audit Objectives for the 2026 Requirement
Explicit audit objectives are the most visible ISO 9001 internal audit change in the 2026 edition, and they’re easy to satisfy badly.
A weak objective restates the scope: “Audit the production process for compliance with ISO 9001.” That tells nobody what the audit is trying to find out.
A strong objective names a specific question the audit will answer. Write one sentence in the audit plan, then make sure the report answers it.
| Process | Weak Objective | Strong Objective |
|---|---|---|
| Welding / special processes | Audit welding for compliance | Determine whether the welding procedure specification (WPS) revisions issued in Q2 reached the floor and are being followed on both shifts |
| Purchasing | Audit purchasing procedure | Verify that purchase orders for coated parts flow down the customer’s coating specification and inspection requirements |
| Nonconformance / CAPA | Review corrective actions | Determine whether corrective actions closed in the last six months were verified as effective before closure |
| Material identification and traceability | Audit material tagging | Verify that tags on work-in-process carry the information and color code the procedure requires, and that any substitute marking is authorized |
| Calibration | Check calibration records | Confirm that every gauge used for final inspection on active jobs is in calibration and traceable |
| Document control | Audit document control | Verify that procedures in use at point of use are the current approved revision |
Notice what the strong objectives do. They point the auditor at evidence on the floor, not at the binder. That’s where effectiveness gets tested.
If you’re building this from zero, audit procedures, checklists, and report forms are part of a complete QMS document set. Our ISO 9001:2026 mandatory documents list shows which internal audit records you’re required to retain. 9001Simplified’s audit toolkit gives you a ready-to-customize internal audit procedure and checklist, so your team spends its time on objectives and evidence instead of formatting forms.
“We Don’t Have Time for an ISO 9001 Internal Audit Program”
It’s a fair objection. When the quality manager is also running inspection, the audit loses to the shipment. But compare the cost of auditing to the cost of skipping it: a failed surveillance audit means corrective action plans, possible follow-up audit fees, and — at worst — a suspended certificate your customers will ask about. Our guide on what happens if you fail an ISO 9001 audit breaks down that chain of consequences.
The hours can be smaller than teams expect, especially once the program is spread across the year. The table below shows illustrative planning ranges — not published figures or mandated durations.
| Audit Activity (One Process, Small Shop) | Illustrative Hours | Notes |
|---|---|---|
| Preparation (review procedure, prior findings, write objective) | 1–2 | Faster once your checklist is built |
| On-site audit (floor walk, interviews, record sampling) | 2–4 | Longer for special processes or multi-shift operations |
| Report and findings write-up | 1–2 | A standard report form cuts this significantly |
| Follow-up verification of corrective actions | 0–2 | Depends on whether findings require corrective action; can be combined with the next scheduled audit |
Actual hours depend on the number of processes in your scope, how many shifts you run, whether you’re auditing special processes, auditor experience, how clean your records are, and how many findings the previous cycle produced. Expect a first-cycle program to take longer than the second.
If you are under customer pressure to certify quickly → don’t wait for the perfect audit program. Train two auditors, build a four-quarter schedule, and get the first cycle started now. A registrar wants to see the program implemented, not polished — though one completed cycle shows implementation, not a guarantee you’re ready for certification.
Running the Audit: A Small-Team Sequence
Keep every audit to the same five steps: plan (objective, scope, criteria, prior findings), open (five minutes with the area supervisor), gather evidence (floor first, then records — interview the people doing the work), close (share findings before you leave), and report and follow up (log nonconformities into corrective action and schedule effectiveness checks).
Evidence gathering is where small-shop audits can fall short. Point-of-use documents are a fast test: pick up a procedure at a workstation and check whether it’s the current revision. Our ISO 9001 document control guide covers what clause 7.5 expects you to find.
Common finding in practice: Three years of internal audits with zero findings, followed by an external audit with several. Clean internal audit reports don’t prove a healthy QMS. They can mean the audits aren’t looking hard enough.
👉 If your last ISO 9001 internal audit came back clean, run a second check before your registrar does. The free Manufacturing Compliance Checklist covers the ISO, OSHA, and quality requirements production environments get audited on — it takes less than an hour and shows you where a clean report may be hiding real gaps.
Once the Program Is Running: Tracking Findings Without Losing Them
After two or three audit cycles, a small team can have dozens of findings, corrective actions, and verification dates to track. In a spreadsheet, that’s where things slip — a closed CAPA nobody verified, an audit postponed twice and never rescheduled. We covered where that breakpoint tends to hit in QMS software vs spreadsheets.
If your shop is at that point, QualityWeb 360 is ISO 9001 QMS software with modules for internal audits, CAPA, document control, and KPIs, so audit schedules, findings, and corrective action follow-up live in one system. You can request an introduction through our Refer a Company form.
If you are already certified and moving to ISO 9001:2026 → run at least one full internal audit cycle against the 2026 requirements before your transition audit, and put the transition on your management review agenda. Organizations certified to ISO 9001:2015 must complete transition by September 30, 2029, but your certification body may set earlier cut-offs — confirm its schedule now. Our ISO 9001:2026 publication guide covers the broader transition plan.
Transition rules for accredited certification are coordinated internationally through Global ACI, and in the US you can confirm a certification body’s accreditation status through ANAB.
For 2026 transition audits, consider adding the areas that certification-body summaries flag as revised or clarified to your ISO 9001 internal audit checklist. Some strengthen existing requirements rather than add new ones, so check the wording against your copy of the 2026 standard:
- Leadership promoting quality culture and ethical behavior, and employee awareness of it
- Risks and opportunities addressed as separate considerations under clause 6.1
- Planning of changes, including how the results of a change are reviewed
- Organizational knowledge — how it’s retained and shared
- Management review inputs covering changes in interested parties’ needs and expectations
Quick Pre-Surveillance ISO 9001 Internal Audit Checklist
- ✅ Audit program covers every QMS process across the cycle
- ✅ Schedule reflects process importance, changes, and previous results
- ✅ Every audit plan has an objective, scope, and criteria
- ✅ No auditor audited their own work
- ✅ Auditor training or competence records are on file
- ✅ Audit checklists cite current ISO 9001:2026 clauses where you’ve transitioned
- ✅ Findings reported to relevant management
- ✅ Corrective actions logged, closed, and verified for effectiveness
- ✅ Audit results feed into management review
- ⚠️ No audits postponed indefinitely — rescheduled audits have a new date
Frequently Asked Questions
How often does ISO 9001 require internal audits?
ISO 9001 requires audits at planned intervals but sets no fixed frequency. Your program decides, based on process importance, changes, and previous results. One practical approach for a small shop is a full cycle across 12 months, with high-risk processes audited more than once — and evidence that you ran the program you planned.
How many internal auditors does a small company need?
There’s no minimum number. In practice, a small company needs enough trained auditors that nobody audits their own work. For a shop with one quality manager, that may mean two or three people — the quality manager plus one or two trained supervisors or leads — with an outside auditor covering the quality function if no one else can audit it impartially.
Can the quality manager audit the whole QMS?
They can audit most of it, but not the processes they own. If the quality manager runs document control, calibration, and corrective action, a cross-trained supervisor or outside auditor needs to cover those areas.
How much of the QMS should an ISO 9001 internal audit program cover?
The audit program should provide evidence that the QMS conforms to requirements and is effectively implemented and maintained. Plan coverage around process importance, changes, and previous audit results — ISO 9001 does not prescribe a separate audit of every procedure at a fixed frequency. A procedure tied to a recent finding, a customer requirement, or a process change — like material tagging after a tag color runs out — earns another look sooner. One recommended method: map your QMS processes and supporting procedures against the annual schedule, note when each was last audited against the actual procedure, and give anything without a recent date a closer look when you plan next quarter.
Do internal auditors need to be certified?
No. ISO 9001 requires auditors to be competent and impartial, not certified. Competence evidence — training records, a course certificate, or documented experience — is what your registrar will look for. Formal internal auditor training from BSI Group or ISOQAR makes that evidence easy to show; our BSI vs ISOQAR comparison covers how the two differ.
How long does an ISO 9001 internal audit take in a 20-to-50-person shop?
For a single process, a planning range of roughly 5 to 10 total hours — prep, on-site audit, report, and follow-up — is reasonable, but it’s not a fixed figure. Special processes, multiple shifts, and messy records push it higher. A first-cycle audit will likely take longer than later ones.
Can I outsource internal audits completely?
Yes. ISO 9001 allows outsourced internal auditors. The trade-off is cost and lost knowledge, because your own people learn the system by auditing it. A hybrid approach — trained internal auditors plus an outside auditor for the quality function — can give a small shop the best of both.
Is ISO 19011 required for ISO 9001 internal audits?
No. ISO 19011:2026 is guidance, not a requirement, and you can’t be certified to it. It’s still worth owning because it explains audit principles, program management, and auditor competence in the same terms registrars use. You can buy ISO 19011:2026 from the ANSI Webstore — code CC2026 takes 5% off through December 31, 2026.
What changed for internal audits in ISO 9001:2026?
The most visible change is that the 2026 edition explicitly requires defined objectives for each ISO 9001 internal audit, alongside its scope and criteria. The rest of clause 9.2’s core requirements carry forward. Practically, that means adding an objective sentence to every audit plan and making sure the report answers it. If you’re transitioning, your checklist should also cover the other revised or clarified areas before the transition audit.
📥 Free Resources
- ISO 9001 Roadmap — step-by-step implementation guide for manufacturers building or improving a quality management system, now updated for ISO 9001:2026
- Manufacturing Compliance Checklist — practical compliance reference covering key ISO, OSHA, and quality requirements for production environments
- Supplier Quality Checklist — evaluation tool for assessing supplier quality controls and flow-down compliance before audits or new contracts
Not Sure What to Do Next?
🔹 Still researching how internal audits fit your QMS? Start with our ISO 9001 for Small Manufacturers guide to see how the standard, the documents, and the system to run it fit together — then pick up ISO 9001 internal auditor training from BSI Group or ISOQAR once you know who’s on your audit team.
🔹 Ready to start your audit program this quarter? Don’t burn your first cycle designing forms. A ready-built ISO 9001 audit procedure and checklist set from 9001Simplified gets your team auditing within days, with 2026 updates included.
🔹 Already running audits and losing track of findings? Once audit schedules, CAPAs, and verification dates outgrow a spreadsheet, refer your company to QualityWeb 360 to manage them in one system.
🔹 Need the standards on your auditors’ desks? Get ISO 9001:2026 directly from the ANSI Webstore. If you want ISO 19011:2026 too, buying multiple standards together through an ANSI standards bundle saves meaningfully compared to purchasing separately. The CC2026 coupon takes another 5% off through December 31, 2026, and ANSI serves international buyers with standards in multiple languages.
An ISO 9001 internal audit program doesn’t need a big team. It needs a plan that follows risk, auditors who aren’t checking their own work, and objectives that send them to the floor instead of the binder. Get those three right and your internal audits start finding problems before your registrar does. That’s what The Standards Navigator is here for — clear, practical guidance from people who’ve run these programs, not just read about them.
The Audit That Only Checks the Binder
Small shops that struggle with internal audits run them once a year, check whether procedures exist, and file a clean report. Small shops that succeed spread audits across the year, write a real objective for each one, and go looking for evidence on the floor.
The Standards Navigator covers ISO 9001 for small manufacturers end to end — the standard, the documents, and the system that keeps an audit program running between registrar visits.
👉 Get updates on ISO 9001:2026 audits, transition, and small-shop QMS practice
👉 Be first to access new audit checklists, templates, and free resources
Industrial Compliance. Clearly Explained.
