Should the auditee be told before an internal audit?

Yes. ISO 19011:2026 provides for initial contact with the auditee and an audit plan prepared in advance. An internal audit is not a surprise inspection: the process owner must know what will be audited, when, with whom, and which documents to have available.

What if the auditee disputes a finding?

Go back to the evidence at the closing meeting: the requirement, the fact observed, the record examined. If the disagreement persists, the report says so. The principle of fair presentation in ISO 19011 calls for unresolved diverging opinions between the audit team and the auditee to be recorded.

Who writes the corrective actions, the auditor or the auditee?

The auditee. The process owner analyses the causes and proposes corrections and corrective actions; the auditor records the finding, then later verifies that the actions have been carried out and are effective. An auditor who writes the actions loses their impartiality for the follow-up.

Do all processes need to be audited every year?

ISO 9001 sets no frequency. It requires a programme that takes into account the importance of the processes, changes and the results of previous audits. A critical or struggling process is audited more often than a stable one; the programme must cover the whole scope over the period the company has set itself.

Can one internal audit cover ISO 9001, ISO 14001 and ISO 45001 at once?

Yes, that is a combined audit, which ISO 19011:2026 recognises. The checklist covers the shared requirements once, then the requirements specific to each standard. For a first audit, however, it is better to master auditing one standard before combining.

How many findings make a good audit?

There is no right number. A successful audit produces findings that are accurate, evidenced and useful, including strengths and opportunities for improvement. An audit with no findings at all on a process that generates complaints should be reviewed by the audit programme manager.

First ISO 9001 Internal Audit: Programme, Plan, Report

Where do you start after internal auditor training?

With the programme, not the checklist. A new auditor fresh from training wants to audit; first you need to know what to audit, in what order and with whom. The audit programme manager, often the quality manager, sets this framework before the first audit.

Three decisions set up a good start:

A well-chosen first process. Important to the company, but known to the auditor and stable: purchasing, document control, staff training. For a first audit, avoid the most contentious process on the site.
A pair. ISO 19011:2026 allows an audit team to include auditors in training. The new auditor leads the audit; the experienced auditor observes, fills the gaps and reviews the report.
A written impartiality rule. Nobody audits their own work. In an SME in Kenitra where the purchasing manager is also an auditor, he audits production, and a colleague audits purchasing.

If your auditors were trained on the 2015 edition, check that they have taken the upgrade on the amended clauses: see our article on what ISO 9001:2026 changes for internal auditors.

How do you build the year’s audit programme?

By ranking processes against the three criteria set by clause 9.2 of ISO 9001: their importance, changes affecting the company and the results of previous audits. Frequency follows from them.

Example programme (illustrative) for an industrial SME:

Process	Importance	Recent changes	Previous results	Proposed frequency
Review of customer requirements and orders	High	New export customer	Complaints about lead times	Twice a year
Production and release	High	New line commissioned	Nonconformity on the recording of settings	Twice a year
Purchasing and subcontracting	Medium	New surface treatment subcontractor	No nonconformity	Once
Human resources and competence	Medium	Temporary staff recruited	Incomplete training records	Once, focused on induction
Management and management review	High	Transition to ISO 9001:2026	Review judged too formal	Once, after the review

The programme also specifies the auditors assigned, the methods (on site, or remote for a distant site), the criteria (the standard, internal procedures, customer requirements) and how results are reported. It is approved by management and retained: clause 9.2 requires evidence of the implementation of the programme and of the audit results to be kept.

For a site preparing its transition, the year’s programme includes an audit against the 2026 edition covering the amended clauses, changes in context and any other changes needed: these are the topics the transition audit examines at a minimum, according to the Global ACI transition document.

How do you prepare the audit plan and the checklist?

Start from the process’s documented information, then write a short plan and a checklist specific to that process. ISO 19011:2026 places this preparation before any activity on the ground: review of documented information, audit planning, assignment of tasks, preparation of work documents.

The audit plan is sent to the process owner a few days before the audit. It fits on one page.

Plan heading	Content
Objective	What the audit must establish, for example control of settings on the new line
Scope	Process, workshops, teams and period covered
Criteria	Clauses of ISO 9001:2026, internal procedures, requirements of the customer concerned
Date and times	Opening meeting, interviews, site visit, closing meeting
People to meet	Process owner, team leader, operators, storekeeper
Audit team	Audit team leader, auditor in training
Methods	Interviews, observation, sampling of records; on site or remote
Language	French or Arabic, depending on the people met

The checklist is not the standard copied out. It starts from the process: its inputs and outputs, its risks, its indicators, its past nonconformities. For each point, it sets out the open question, the evidence to ask for and the sample. “Do you have a set-up procedure?” invites a yes. “Show me how this morning’s set-up was validated” invites evidence.

A good checklist leaves room for what the auditor will discover along the way. It guides the audit; it does not lock it in.

How do you conduct the audit on the ground?

By following the ISO 19011:2026 sequence: opening meeting, collecting and verifying information, findings, conclusions, closing meeting. Time spent at the workstation is worth more than time spent in the office.

The opening meeting recalls the objective, scope, schedule and confidentiality. It lasts a few minutes and puts the auditee at ease.
Interviews take place at the workstation, with open questions: how, show me, what happens when. The auditor listens more than they talk.
Observation completes the interview: what the operator does, what the screen shows, what the nonconforming product bin contains.
Sampling covers records chosen by the auditor, not by the auditee: a few production orders from a given month, a few complaints, a few training records.
Verification cross-checks the sources: what the process owner says, what the record shows, what the auditor observes.
The closing meeting presents the findings, strengths and opportunities for improvement, and checks that they are understood.

In a workshop where part of the team works in Arabic, the interview is conducted in the operator’s language. A finding based on a misunderstood question does not stand.

How do you write the findings and the report?

Each finding cites the requirement, the fact observed and the evidence examined. The report brings together the findings, strengths, opportunities for improvement and the audit conclusion, and it goes to the relevant management.

Avoid	Write
“Document control is inadequate.”	“Requirement: document control procedure, current revision at the workstation. Finding: 3 of the 8 set-up sheets checked at workstation 2 carry a revision older than the master list.”
“Staff are not aware.”	“Requirement: ISO 9001:2026, 7.3. Finding: 2 of the 4 operators interviewed do not know whom to report a doubtful product to at the end of a shift.”
“Nothing to report.”	“Points checked: March orders, 6 files; no nonconformity; strength: requirements review recorded for every export order.”

The figures in this table are drafting examples. Findings are classified according to the rules of your own procedure: nonconformity, observation, opportunity for improvement. The report also mentions any obstacles encountered and unresolved disagreements, as the principle of fair presentation requires.

How do you follow actions through to effectiveness?

By separating three stages: immediate correction, corrective action on the cause, then verification of its effectiveness. Clause 9.2 requires correction and corrective action to be taken without undue delay; ISO 19011:2026 treats audit follow-up as a step in its own right.

The process owner analyses the causes and proposes actions, each with an owner and a date. The auditor, or the audit programme manager, comes back to check at the due date. A completed action plan is not evidence of effectiveness: you check, on a new sample, that the nonconformity does not recur.

The results then feed into the management review, whose inputs include audit results. With ISO 9001:2026, the review “shall include” each of its inputs: an internal audit that never reaches management becomes an easy nonconformity to raise. Audits and actions can be managed on a platform such as Normativa, ACG’s standards compliance platform, to keep the evidence attached to each finding.

Which mistakes should you avoid in a first internal audit?

We see them often in the first audits we support:

auditing the standard clause by clause instead of auditing the process;
spending the audit in the office, without going to the workstation;
letting the auditee choose which records to show;
writing findings without evidence, or judgements about people;
closing the audit as soon as the action plan is filled in;
keeping a 2015 checklist for an audit against the 2026 edition.

Before closing your first audit, check that:

The full framework of the training is described in our guide to ISO 9001 internal auditor training.

By expertise

By sector

First ISO 9001 Internal Audit: A Step-by-Step Method After Training

Key takeaways