Internal management system audit

The internal audit ISO standards require, done by an outsider, with a risk-based programme and a report that drives improvement.

Who it is for

Certified organisations or those preparing for certification that need to meet the internal audit requirement (clause 9.2 of ISO management system standards) with independence, and multi-site organisations that want to compare how each site works.

Signs you need it

• The internal audit happens the week before the external one and finds nothing useful.
• The auditor is the same person who maintains the system.
• You hold several certifications and audit them separately.
• Each site works its own way and nobody has checked it methodically.

What it includes

• Risk-based annual audit programme that builds on previous results.
• Integrated system audits (for example ISO 9001 + ISO 14001 + ISO 45001) in a single visit.
• Site sampling in multi-site organisations.
• Interviews at the workplace and review of real records, not only documents.
• Report with findings, evidence and prioritised actions.
• Review of the effectiveness of actions from the previous audit.

Standards and models

Outcome

A standard requirement turned into an improvement tool, and no surprises at the external audit.