What must an internal auditor be able to do under ISO 9001?
Check, at planned intervals, that the quality management system conforms to the company’s own requirements and to those of the standard, and that it is effectively implemented and maintained. That is the purpose of clause 9.2 of ISO 9001. Internal auditor training makes this check reliable, repeatable and useful to management.
Clause 9.2 gives these responsibilities to the organisation, not to the auditor alone. The table links each of them to what a trained auditor must be able to do.
Requirement of clause 9.2 (summary) | What the internal auditor must master |
|---|---|
Conduct internal audits at planned intervals | Keep to the calendar set by the audit programme |
Establish a programme that takes into account the importance of the processes, changes affecting the organisation and the results of previous audits | Propose priorities based on risks, complaints and past nonconformities |
Define the audit criteria and scope for each audit | Read the standard, internal procedures and customer requirements that apply to a process |
Select auditors so as to ensure objectivity and impartiality | Refuse to audit one’s own work and report any conflict of interest |
Report the results to relevant management | Write a clear report, with findings backed by evidence |
Take correction and corrective action without undue delay, and retain evidence | Verify that actions are effective and archive the audit file |
This table describes the internal audit requirement in plain terms, without reproducing the text of the standard; the Global ACI transition document does not list this requirement among those amended by ISO 9001:2026. Reread it in your copy of the standard before updating your procedure.
Two other points frame the role. Clause 7.2 requires the organisation to determine the competence needed, to ensure that people are competent on the basis of their education, training or experience, and to keep evidence of it. ISO 9001 therefore imposes no auditor diploma: it imposes demonstrated competence. For method, the standard points to the guidelines of ISO 19011.
On the ground, the stakes are concrete. The certification body’s auditor reads internal audit reports to judge whether the system is improving. In our assignments, the same symptom keeps coming back: reports that conclude “nothing to report” on every process while customer complaints rise. Such a report is not reassuring; it is a finding in itself. The 2026 edition of the standard also makes audits more demanding on some topics, such as quality culture or the review of changes: we cover this in our article on what ISO 9001:2026 changes for internal auditors.
What do the ISO 19011:2026 guidelines say about the auditor’s job?
They give the method shared by all management system audits: seven principles, managing an audit programme, conducting an audit and the competence of auditors. According to the ISO page for the standard, the fourth edition, ISO 19011:2026, was published on 27 May 2026 and replaces the 2018 edition, now withdrawn.
ISO 19011 is not a certifiable standard: it provides guidelines, not requirements. Its introduction states that it focuses on internal audits, known as first-party audits, and on audits an organisation conducts on its external providers, known as second-party audits. It is therefore the natural reference for internal auditor training, whether the system is built on ISO 9001, ISO 14001 or several standards at once.
The seven principles of auditing
All the guidance in the standard rests on seven principles, each with its own subclause in the 2026 edition (4.2 to 4.8).
- Integrity. Work honestly and impartially, and audit only what you are competent to audit.
- Fair presentation. Truthful and accurate findings, conclusions and reports, which mention the obstacles encountered and any unresolved diverging opinions.
- Due professional care. A diligent, sound approach, from the first interview to the report.
- Confidentiality. Protecting the information obtained during the audit.
- Independence. The basis of impartial conclusions; internally, it starts with not auditing your own work.
- Evidence-based approach. Verifiable conclusions, drawn from a sample of the information available.
- Risk-based approach. Focus the audit on what matters to the auditee and to the audit objectives.
Programme, audit, competence
The next three clauses give the course its structure. Clause 5 covers managing the audit programme: objectives, programme risks and opportunities, resources, choice of methods and teams, monitoring and improvement. Clause 6 follows an audit from start to finish: initial contact with the auditee, preparation and audit plan, opening meeting, collecting and verifying information, findings, conclusions, closing meeting, report, completion and follow-up. Clause 7 covers the competence and evaluation of auditors: personal behaviour, knowledge and skills, achieving competence, evaluation criteria and methods, maintaining competence.
One detail matters for a company training its first auditors: the definition of the audit team allows it to include auditors in training. Pairing an experienced auditor with a new one is therefore a recognised way to build experience. The 2026 edition also expands its guidance on remote audit methods; this point is covered in our article on what changes in 2026 for internal auditors.
What does good ISO 9001 internal auditor training include?
The requirements of the standard, the audit method and, above all, practice. A course that stops at reading the standard produces readers, not auditors.
Module | Content | What the participant produces |
|---|---|---|
ISO 9001:2026 requirements | Structure of the standard, process approach, amended clauses (5.1.1, 5.2.1, 6.1, 6.3, 7.3, 9.3.2) | A reading of one company process against the standard |
Audit principles and vocabulary | Seven principles, criteria, evidence, findings, conclusions | The difference between a fact, an opinion and a finding |
Audit programme and plan | Programme priorities, scope, criteria, timing, people to meet | An audit plan for a real process |
Checklist | Questions drawn from the process, its risks and its indicators | A checklist specific to the audited process |
Conducting the audit | Opening meeting, open questions, observation, sampling, closing meeting | Role-play interviews, then interviews on the shop floor |
Writing findings | Requirement, finding, evidence; nonconformity or opportunity for improvement | Findings written and reviewed as a group |
Report and follow-up | Report, corrective actions, verification of effectiveness | Audit report and action follow-up log |
Practical audit | Audit of a company process, in pairs, with feedback | A first real audit file |
The writing module is the one that makes the difference. A useful finding has three parts: the requirement concerned, what was observed and the evidence examined. “Document control is inadequate” triggers no action. “Of the 10 set-up sheets checked at workstation 3, 4 carried a revision older than the one on the master list” triggers one, and its correction can be verified.
In-company, our courses end with a real audit of one of your processes, with feedback to the process owners concerned. Participants leave with a plan, a checklist and findings they can use from the first audit cycle. The step-by-step method for that first audit is the subject of our article on the first ISO 9001 internal audit after training.
For auditors already trained on the 2015 edition, an upgrade is usually enough: the clauses amended by ISO 9001:2026, what they change in the checklist, and the methodological updates in ISO 19011:2026. The amended clauses are presented in our article on the ISO 9001:2026 transition, clause by clause.
How long does the training take, and what does the participant receive?
In ACG’s 2027 catalogue, the internal auditor module lasts 2 days. The duration of an ISO 9001:2026 upgrade or a QHSE version depends on the scope and the share of practice. The participant receives a training certificate, but it is the company that qualifies its auditors.
Four factors drive the duration:
- Scope. ISO 9001 alone, or an integrated quality, health and safety and environment (QHSE) system audited in a combined way.
- Starting level. Participants who are new to the standard must first understand its logic; experienced process owners move on faster to audit method.
- The practical audit. A real on-site audit, with preparation, interviews, writing and feedback, takes time, and it is the most useful time of the course.
- Format. One continuous classroom session, or modules spread out with an audit carried out between two sessions, face to face or online.
At the end of the course, each ACG participant receives a numbered training certificate. The course leaves other evidence behind: placement test, QR-code attendance, automatically marked final test, end-of-course evaluation and training report, described on our before, during and after page.
The certificate proves that the training was attended; on its own, it does not make a qualified auditor. ISO 19011:2026 devotes several subclauses to the criteria and methods for evaluating auditors, and ISO 9001 requires evidence of competence. A simple, written qualification rule meets both.
Internal auditor or Lead Auditor: which course should you choose?
The one that matches the audit you will carry out. An internal auditor audits the system of their own organisation, or of a site in their group. A Lead Auditor learns to lead an audit and an audit team; a course certified by the CQI (Chartered Quality Institute) and its IRCA register follows the assessment rules set by that body, and the certificate is issued under its rules.
Your situation | Suitable course |
|---|---|
You audit your site’s processes for your ISO 9001 certification | ISO 9001 internal auditor |
Your system integrates quality, health and safety and environment | Internal auditor for combined QHSE audits |
You run the audit programme of several sites in a group | Internal auditor, then Lead Auditor if the group requires it |
You audit suppliers on behalf of your company | Internal auditor plus second-party auditing; Lead Auditor if your group or your customers require it |
You are aiming for a career as a certification body auditor | CQI/IRCA-certified Lead Auditor course, then the certification body’s own qualification requirements |
The CQI and IRCA also certify internal auditor courses, such as the Internal QMS Auditor course, under their own rules. If your customer or your group requires a certified course, check the course’s status on the CQI website before enrolling.
ACG’s trainers are IRCA CQI qualified. The status of each course in the catalogue, CQI/IRCA-certified or not, is stated on its course page. The Lead Auditor course is presented on our ISO standards training page.
How do you choose internal auditor training in Morocco?
On criteria you can verify before signing: the editions of the standards taught, the trainer’s qualification, the share of practice, the language and the evidence produced. Price is compared only afterwards, for equal content.
Questions to ask the training provider:
The choice of format depends on headcount. A single auditor to train joins an open session or an online session on OmniLearn, ACG’s online learning platform. From a small group upwards, in-company training lets participants audit your own processes. The factors that drive cost are covered in our article on ISO 9001 internal auditor training cost, and a full deployment example in our case study of an SME training six QHSE internal auditors.
On funding, a company operating in Morocco may have internal auditor training covered in part by special training contracts (contrats spéciaux de formation, CSF). This is the scheme through which OFPPT, the Office de la formation professionnelle et de la promotion du travail, Morocco’s public vocational training office, reimburses part of the continuing training that companies organise for their employees. The reference rules, those of the CSF procedures manual of May 2006 and its Amendment No. 2 of 2 June 2014, are 70% of the retained cost for planned training delivered by an external provider and 40% for unplanned training, within a ceiling calculated on the vocational training tax (taxe de formation professionnelle, TFP) the company declares. The resulting amount is indicative, before ceilings, with no commitment. The gap between the two rates is decided when the training plan is drawn up: the session must be in the plan before it takes place. ACG is CSF-eligible; we simulate the reimbursement on your figures, without promising an amount. See our page on CSF and OFPPT funding.
Finally, internal auditor training is not decided in isolation. It fits into the calendar of your certification or of your transition to ISO 9001:2026: you need trained auditors to complete a full cycle of internal audits before the certification body’s audit. Our ISO 9001 certification page sets out that calendar.