ISO 9001 Clause 9.2 focuses on the internal audit process within the quality management system (QMS). More specifically, Clause 9.2.1 outlines the requirement for an organization to conduct internal audits at planned intervals (checking the QMS). Clause 9.2.2 focuses on the criteria for planning, establishing, implementing, and maintaining an audit program.
Clause 9.2.1 Internal Audit Explained
1. Purpose of Internal Audits: The primary purpose of internal audits is to provide information about the effectiveness of the Quality Management System (QMS) in meeting certain criteria.
2. Conformance to Requirements: The internal audits aim to determine whether the QMS conforms to two sets of requirements:
- Organizational Requirements: These are the internal standards, policies, and procedures that the organization establishes for its own QMS. These can be internal requirements of the organization or external requirements set by the customers.
- ISO 9001 Requirements: These are the requirements outlined in the ISO 9001 standard.
3. Effective Implementation and Maintenance: The audits are about meeting the criteria and evaluating whether the QMS is effectively implemented and maintained. This involves more than performing perfunctory audits that merely “check the box” (often referred to as “pencil whipping”). The goal is to assess how well the documented processes are followed in practice and whether they are effective in achieving the planned, determined, or expected results.
Clause 9.2.2 Internal Audit Explained
The organization shall plan, establish, implement, and maintain an audit program, establishing the frequency of audits (yearly schedule). This program should be based on the organization’s quality management system and consider the importance of the processes, changes affecting the organization, and the results of previous audits.
- Audit Criteria, Scope, Frequency, and Methods: The audit program should define the criteria and scope for each audit, as well as the frequency and methods. These methods include techniques to ensure the objectivity and impartiality of the audit process.
- Audit Objectives: The objectives of the audits should be established. They should include determining the extent to which the quality management system conforms to planned arrangements, ISO 9001, and the organization’s requirements.
- Selection of Auditors: The organization should select auditors and conduct audits to ensure objectivity and impartiality of the audit process. Auditors should not audit their own work.
- Audit Criteria: Auditors should consider the process effectiveness mentioned in clause 9.2.1 above and the effectiveness of the quality management system in achieving the organization’s quality objectives.
- Audit Evidence: Auditors should collect and report objective, verifiable factual information relevant to the audit criteria as audit evidence.
- Audit Records: Records of the audit program and audit results (audit reports of findings) should be maintained as documented information.
Audit Process
- Audit Program: The audit process starts with the audit program, which details which audits will be conducted, which processes they cover, and when they will be performed.
- Audit Plan: Next, the lead auditor will draw up an Audit Plan that specifies the criteria and scope of the audit, the audit methods that will be used, the audit objectives, the audit criteria, who the auditors are, and what role (lead auditor, internal auditor, guide, translator, or observer) they may have.
- Audit Evidence: Next, the auditor(s) will use the audit methods to collect objective evidence for each applicable clause. The audit methods consist of walking around and observing processes, reviewing documented information, interviewing personnel, or comparing current practices and performance metrics against industry benchmarks, best practices, or previous audit findings. Sampling is used to select a representative subset of documents, records, or processes for review and analysis to assess compliance and effectiveness.
- Audit Report: Finally, an audit report contains a summary evaluation of the QMS, audit findings that explain the clause and the evidence collected to support each finding, and opportunities for improvement (OFI). Any findings produced will require immediate corrective action. On the other hand, OFIs are suggestions from the auditor and do not have to be implemented in the same timely manner.
Clause 9.2 Example Manufacturing Company
Audit Program: The company establishes an annual audit program covering critical processes, including production, quality control, and supplier management. The program specifies the frequency of audits and the methods used.
Audit Objectives: The audit objectives include assessing the conformance of the production process to planned arrangements, ISO 9001 requirements, and the company’s quality objectives.
Selection of Auditors: Trained auditors from different departments are selected to ensure objectivity. The auditor responsible for the production process cannot audit their department.
Audit Criteria: The audit criteria include process effectiveness, adherence to ISO 9001 requirements, and achievement of quality objectives.
Audit Evidence: Auditors collect evidence through interviews, observations, and review of documents to verify conformance.
Audit Records: Comprehensive records of the audit program, including planning, results, and corrective actions, are maintained for review and improvement.
ISO 9001:2015 Clause 9.2 Internal Audit
Internal audits are a crucial “Check” step of the process approach (PDCA) for ensuring the QMS’s effectiveness, identifying improvement areas, and maintaining compliance with ISO 9001 and organizational requirements. Clause 9.2.1 emphasizes the importance of a systematic, well-planned approach to internal audits, ensuring they contribute to the continual improvement of the quality management system.
Great breakdown of Clause 9.2! I especially appreciated the distinction between “check the box” audits and actual process effectiveness. One thing I’ve been grappling with lately is how internal audit frequencies should shift when an organization integrates new, highly regulated digital service sectors. For instance, when looking at the compliance structures and technical auditing standards required for emerging markets at https://guiadebetnacionalbrasil.com, I noticed they emphasize real-time RNG and platform integrity monitoring. Do you think ISO 9001 internal audit programs should move toward a more “continuous” monitoring model similar to those high-stakes digital industries, or is the traditional “planned intervals” approach still the gold standard for maintaining QMS integrity?
Great question, and I think you’re touching on an important evolution in how internal audits are performed.
ISO 9001 deliberately uses the phrase “planned intervals” in Clause 9.2 rather than prescribing a fixed schedule because the audit frequency should be risk-based and process-based. The audit program should be dynamic and consider the importance of processes, changes affecting the organization, and results of previous audits when determining frequency.
That flexibility is key when organizations enter highly regulated or digital environments. In traditional manufacturing, a stable process might only need an annual audit, while new, complex, or high-risk processes might require quarterly or even monthly reviews until confidence is established and the process becomes stable.
Where your observation becomes interesting is the shift toward continuous monitoring. Digital platforms—especially those requiring real-time integrity checks like RNG validation or platform security, often rely on automated monitoring rather than periodic sampling. In that sense, continuous monitoring doesn’t replace ISO internal audits, it complements them.
Think of it this way, continuous monitoring is about operational controls and real-time assurance. Internal audits are about independent evaluation of system (or process) effectiveness.
ISO 9001 audits are a “check” step meant to determine whether the QMS conforms to requirements, is effectively implemented, and maintained, not to serve as the operational monitoring mechanism itself.
So the “gold standard” is likely becoming a hybrid model using continuous digital monitoring for high-risk processes combined with risk-based internal audits at planned intervals to validate the entire system. In other words, audits remain periodic, but the evidence they review is increasingly continuous.