How to plan and run an internal audit

A useful internal audit checks practice against your own procedures and the standard, by someone who does not own the area. Write a risk-based programme, plan each audit with criteria and scope, sample real records, grade each finding with its evidence, report to management, and send every nonconformity into corrective action. Then adjust the programme from what you found.

When you need this

ISO 27001:2022 9.2.1 requires audits at planned intervals to check that the system meets your own requirements and the standard’s and is effectively implemented and maintained. ISO 27001:2022 9.2.2 requires a programme, criteria and scope for each audit, objective and impartial auditors, results reported to management, and records kept. ISO 9001:2015 9.2 and ISO 42001:2023 9.2 say the same. ISO 13485:2016 8.2.4 adds a documented procedure and states outright that auditors must not audit their own work. SOC 2 CC4.1 asks for evaluations of whether controls work, and CC4.2 for deficiencies to reach the people who fix them.

The triggers are the yearly programme, the run-up to stage 2, and a major change or incident. A trained colleague or an external auditor does the audit.

This is guidance to help you understand the requirement, not legal advice.

Before you start

You need the standard, your own policies and procedures for the area, the previous audit reports, the corrective action log and the risk register. Line up the auditee and someone who can pull records on the day.

For a firm of 20 to 50 people, an audit of one area takes half a day to plan, a day on site or online, and half a day to write up. A full programme covering the whole system is usually four to eight such audits a year.

Steps

Write the audit programme. List the areas, how often each is audited, the methods and who is responsible, and weight frequency towards high-risk areas, earlier findings and areas where evidence is thin. Done when every clause and applicable control is covered within the certificate cycle.

Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
Audit readiness is visible to administrators only for now.
Only evidence from the last 12 months counts towards readiness.

Appoint an auditor for each audit who does not own or run the area. Done when each audit has a named, impartial auditor with evidence of competence.
Plan the audit. Set the criteria, the scope, the dates, the people to interview and the sample sizes, and send the plan to the auditee a week ahead. Done when the auditee has confirmed.
Build the checklist from the criteria: the standard’s clauses and your own procedure’s rules. Write questions that ask for records, not opinions. Done when every criterion has a question and a record to request.
Collect evidence. Interview, observe and sample records, such as 10 leavers or five supplier reviews. Done when every question has evidence recorded against it.
Grade each finding and write it in three parts: the requirement, the evidence and the statement of nonconformity. Done when every finding can be traced to a record.
Hold a closing meeting and agree the facts of each finding with the auditee. Done when there is no dispute about the facts.
Issue the report to the area’s manager and to top management. Include what conforms as well as the findings. Done when the report is filed and acknowledged.
Raise a corrective action for each nonconformity, with an owner and a due date (ISO 27001:2022 10.2). Done when every nonconformity has an action.
Review the programme. Bring an area forward when it produced findings, and move a stable area to a longer interval. Done when the programme shows the change and why.

Grading and writing findings

Use four grades, defined in your audit procedure, so findings read the same from every auditor.

Grade	Meaning	What follows
Major nonconformity	A requirement is not met at all, or the process cannot achieve its result	Corrective action before the next certification audit
Minor nonconformity	An isolated lapse in a process that otherwise works	Corrective action with a due date
Observation	No requirement broken yet, but a trend or weak point	Owner decides; recorded
Opportunity for improvement	A better way, with nothing wrong	Optional

Requirement, evidence, statement

Write every nonconformity in three parts. The requirement: “The access control policy requires accounts to be disabled within one working day of leaving.” The evidence: “Two of 10 leavers sampled from January to March 2026 had active accounts 12 and 30 days after leaving.” The statement: “Leaver accounts are not disabled on time.” Without the evidence, the finding is an opinion; without the requirement, the auditee cannot tell what to fix.

Auditing your own work

You can’t. Impartiality means the auditor has no stake in the result, so the person who runs a process cannot audit it, and the person who wrote the system cannot audit the system alone.

Marking your own homework

Small firms solve this three ways. Two trained colleagues swap areas. A neighbouring firm’s quality lead trades audits with yours. Or an external auditor covers the areas nobody else is independent of, usually the security or quality lead’s own work. Record in the programme who audits what and why that is impartial.

Worked examples

ISO 27001, a first-cycle audit before stage 2

Pellow Systems, 22 staff, audits access control and supplier management on 14 and 15 April 2026, eight weeks before its stage 2. The operations manager audits access control; an external auditor audits suppliers, because the security lead runs them. Findings: a minor nonconformity against access rights (ISO 27001:2022 Annex A 5.18), the two late leavers above; a minor nonconformity against supplier monitoring (ISO 27001:2022 Annex A 5.22), with two of five critical suppliers unreviewed; and an observation that access review records do not say who decided. The report goes to the CEO on 22 April. Two corrective actions are due by 20 May, and both are closed and checked before stage 2 on 9 June.

ISO 13485, a supplier-control process audit

Tarn Surgical audits its purchasing process on 3 February 2026 against ISO 13485:2016 7.4.1 and its own procedure. The auditor, a quality engineer with no purchasing role, samples 12 approved suppliers. Two critical sterilisation suppliers are past their re-evaluation date by four and seven months, which the auditor grades as a minor nonconformity. Under ISO 13485:2016 8.2.4 the purchasing manager must act without undue delay: the suppliers are re-evaluated within 30 days, and the follow-up audit verifies it.

ISO 9001, the same programme for quality

ISO 9001:2015 9.2 follows the ISO 27001 example step for step, with quality processes as the areas.

ISO 42001, auditing an AI management system

ISO 42001:2023 9.2 follows the ISO 27001 example, with the AI system life cycle processes among the areas.

SOC 2, a readiness assessment as an evaluation

SOC 2 does not require an internal audit by that name. A readiness assessment run with steps 3 to 9 is a separate evaluation under CC4.1, and reporting its deficiencies to the control owners and senior management meets CC4.2.

Checklist

How Sted helps

For ISO 27001 clause 9.1 and 9.2 Sted’s knowledge base carries the Internal Auditing Procedure (PRC-IAP) with its Internal Audit Schedule (REC-IAS), Internal Audit Plan (REC-IAP) and Internal Audit Report (REC-IAR), and the Monitoring and Measurement Procedure (PRC-MMP) with its Monitoring and Measurement Framework Record (REC-MMFR) and Monitoring and Measurement Record (REC-MMR).
Records are part of the Full Management System plan.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
Sted’s knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure.
Records are part of the Full Management System plan.

Sted holds the audit schedule, plan, report and corrective actions. It does not audit you; a competent, impartial auditor you appoint does.

ISO 27001 internal audit: what clauses 9.1 and 9.2 require, and the evidence auditors expect.
ISO 13485 measurement and analysis: internal audit for medical devices.
Root-cause analysis for a CAPA: what happens to each nonconformity.
How to run a management review: where the audit results go next.
Internal audit: the term, and how it differs from a certification audit.
Audit readiness: the gaps list to plan audits from.

Frequently asked questions

Can I audit my own work for ISO 27001?

No. ISO 27001:2022 9.2.2 asks for auditors chosen so the audit is objective and impartial, and certification auditors read that as nobody auditing a process they own or run. In a small firm, two colleagues audit each other’s areas, and an external auditor covers the person who wrote the system.

How often should we run internal audits?

At intervals you plan and justify. Most small organisations audit the riskiest areas every year and cover every clause and applicable control at least once in a three-year certificate cycle. Certification bodies expect at least one internal audit before stage 2.

Does an internal auditor need a qualification?

No certificate is required, but the auditor must be competent, and you should keep evidence of that. A short course on auditing management systems, based on ISO 19011, plus knowledge of the standard is the usual answer.

What is the difference between a major and a minor nonconformity?

A major nonconformity means a requirement is not met at all or the system cannot deliver its intended result; a minor one is an isolated lapse. Certification bodies define the grades in their own rules, and many organisations use the same grades internally so findings read the same way.