What You Should Know About ISO 9001 Internal Audits

4 April 2024

ISO 9001 internal audits play a critical role as self-check mechanisms that enable organizations to periodically evaluate their compliance with ISO 9001 requirements. Not only are these audits a prerequisite for achieving and maintaining ISO registration, but they also serve as powerful tools for enhancing the effectiveness of the quality management system (QMS) and the efficiency of operational processes.

In this article, we'll explain what ISO 9001 internal audits are, how to benefit from them, and what you need to do to ensure compliance.

Distinguishing between Internal and External Audits

To grasp the essence of internal audits, it is important to differentiate them from external audits. While internal and external audit activities may appear similar at first glance, they serve distinct purposes and often have different scopes.

External audits are conducted by third-party entities, typically auditors or teams of auditors appointed by your company's registrar. These audits may also be performed by customers or other interested parties. External audits are initiated by an external party, are often focused on specific aspects of your quality system, and tend to have a more limited scope.

On the other hand, internal audits are conducted in-house at regular intervals as a means of self-assessment. The responsibility for conducting internal audits typically rests with the company's own employees who have been appointed and trained as ISO 9001 auditors. Some companies, however, chose to outsource their internal audits to an external expert.

The Objectives of Internal Audits

Internal audits serve several key objectives, including:

Understanding the ISO 9001 Audit Process

The ISO 9001 audit process consists of two main stages: the Document Review and the Process Review. Both stages are crucial in evaluating the effectiveness of an organization's quality management system (QMS).

Document Review

During the Document Review stage of an ISO 9001 internal audit, auditors meticulously examine the organization's documentation to ensure its compliance with the ISO 9001 requirements. This step serves as a preliminary assessment of the QMS, providing insight into its adherence to the standard. In the context of the first internal audit and the certification audit, this stage is commonly referred to as the Stage 1 Audit.

In the Document Review, auditors focus on key documents such as the quality policy, scope statement, process flows, and procedures. It is important to note that work instructions and forms are typically not part of the Document Review process.

This stage is specifically conducted as a separate audit activity during the first internal audit and the initial certification audit. Subsequent audits integrate the review of documents into the process review, effectively assessing their alignment with the documented processes.

Process Review

The Process Review stage is where auditors delve into the actual business activities of the organization to verify their alignment with the documented processes. During this stage, auditors meticulously scrutinize the operations, looking for any discrepancies or inconsistencies that may hinder the effectiveness of the QMS. When performed during the initial certification audit, this stage is known as the Stage 2 Audit.

ISO 9001 internal audits adopt the Process Approach, focusing on the sequential flow of work activities rather than verifying individual ISO requirements. During the audit, auditors observe activities, interview operators, and review related documents and records. It is common for internal auditors to cross-check information and records from other departments to ensure accuracy and comprehensiveness. Due to time constraints, auditors cannot assess every process, employee, or document, so a representative sample is carefully selected.

The auditing process itself is generally straightforward. Internal auditors assess whether procedures and documentation adhere to ISO 9001 requirements and verify that employees follow these procedures in their day-to-day work.

Challenges may arise when there is no specific procedure or work instruction documented for a process. ISO 9001 does not mandate procedures and work instructions for all processes but emphasizes their value when they contribute to the company's performance. It is crucial to clarify that process documentation is intended for the company's internal benefit, not solely to accommodate auditors. Organizations are neither obligated nor encouraged to develop procedures and work instructions solely for the purpose of assisting auditors.

In the absence of process documentation, auditors rely on a combination of employee interviews, observation of actual work processes, and review of records to assess process conformity and effective implementation. During this evaluation, auditors determine the need for additional procedures, work instructions, training, process standardization, or process improvement.

Internal Audit as Prerequisite for Certification

To comply with ISO standards, organizations must conduct at least one internal audit within two to three months before their certification audit. This internal audit generates audit reports and documents corrective action plans to address identified weak points (nonconformities) within the organization. These records are mandatory and reviewed during external audits. By the time the certification audit takes place, all necessary corrective actions should have been implemented to rectify any nonconformities.

Streamlining Your Internal Audit Process

To streamline your internal audit process and ensure a stress-free journey towards compliance, consider the following tips:

Appoint the Right Auditors

Choose individuals who are trustworthy, authoritative, possess good people skills, and have analytical or investigative talents. It is crucial to avoid potential conflicts of interest by ensuring auditors do not audit their own departments. The necessary educational qualifications such as familiarity with the ISO 9001 standard and auditing techniques can be acquired through internal auditor and lead auditor training. Additional qualifications are defined in ISO 19011.

Use Forms and Checklists

Simplify the internal audit process by utilizing audit forms and checklists. Two essential documents include the Audit Checklist, which encompasses all ISO 9001 requirements and facilitates process auditing, and the Audit Report Form, which standardizes the recording of audit findings and corrective action plans.

Standardize the Audit

Design and standardize the internal audit process, treating it as any other business process. Ensure auditors ask three critical questions during the process review:

These questions cover employee intent, implementation, and effectiveness in business activities. ISO 9000 describes effectiveness as "the extent to which planned activities are realized and planned results are achieved." Look beyond compliance and assess whether procedures effectively align with business objectives.

Hold a Closing Meeting with Auditees

Conduct a closing meeting immediately after completing the audit to share the audit findings with the relevant stakeholders. This meeting should involve top management, audited department managers, and potentially staff from various levels of the organization. Give balanced feedback by praising departments that performed well and emphasizing the importance and benefits of ISO 9001.

Get Feedback from Auditees

Gather feedback from auditees to gain insights into their experiences and perspectives. Establish a two-way communication channel, enabling auditees to share their thoughts and suggestions during the audit. Incorporate this feedback into future audits to ensure a fair and balanced internal audit process.

Getting Started with the Internal Audit Program

Commencing a robust internal audit program begins with the appointment of an audit program manager, entrusted with the task of configuring an internal audit program that enhances your business operations. In smaller companies, the audit program manager often fulfills the role of the main auditor, while a secondary auditor is assigned to audit the audit program function. Conversely, medium-sized and large companies typically maintain an entire team of internal auditors, amplifying the depth and scope of their auditing capabilities.

Empower your audit program manager by providing comprehensive lead auditor training, incorporating essential lessons on establishing and optimizing the internal audit program. Equally crucial is equipping members of the internal audit team with thorough auditor training, which primes them to execute robust and effective audits. Investing in their proficiency will prove invaluable in nurturing a culture of quality and compliance within your organization.

Conclusion

ISO 9001 internal audits play a vital role in achieving and maintaining ISO 9001 certification while driving overall business improvement. Disregard the myth that internal audits should showcase perfection from the outset, as continuous improvement lies at the heart of ISO 9001. Treat internal audits with the respect they deserve, viewing them as opportunities to enhance your company's operations and reap the rewards of ISO 9001.

Finally, it is noteworthy that certain companies, whether due to constraints or scale, may struggle to establish an internal audit program that fully aligns with their objectives. If your company faces these challenges, consider outsourcing your internal audit program to an experienced lead auditor. This approach ensures that the integrity and depth of your internal audits remain uncompromised, while benefiting from the expertise and suggestions of external auditors.