ISO9001 System Document Package (42) | Internal Audit Implementation Work Instruction (Internal Auditor Manual)

Document Number: WI-QA-42　|　Document Level: Level 3 Document (Work Instruction/Internal Auditor Manual)　|　Corresponding Clause: ISO 9001:2015 9.2 Internal Audit, 9.3 Management Review Input, 10.2 Nonconformity and Corrective Action

Document Description: This work instruction is an operational expansion of the Level 2 document "Internal Audit Procedure" (QP-25) and also serves as a guide for internal auditors. The "Internal Audit Procedure" addresses procedural questions such as "who is responsible for internal audits, how many times per year, and to whom the audit conclusions are reported." This document answers the detailed questions that internal auditors face when conducting audits: how to form the audit team, what qualifications internal auditors should have and how to maintain their independence, how to compile checklists, what to say at the opening meeting, how to sample and question on-site and gather evidence, when to issue nonconformities, how to distinguish between minor and major nonconformities, how to conduct the closing meeting, how to write the internal audit report, who will follow up and verify corrective actions, and how to archive documents. It is suitable for manufacturing, trading, and service companies that have established a quality management system (QMS) and need to organize internal audits according to clause 9.2. It is especially useful for companies setting up their internal audit mechanisms for the first time, where internal auditors are often part-time and lack audit experience. Companies that have implemented IATF 16949, ISO 14001, and ISO 45001 can also use this document as a basis for integrated internal audits across multiple systems. The main body of the document includes seven complete sections: annual planning, internal auditor management, audit preparation, on-site implementation, nonconformity determination, report compilation, and follow-up verification. It also provides field lists and filling examples for the "Internal Audit Plan," "Internal Audit Checklist," "Nonconformity Report," "Internal Audit Report," and "Internal Auditor Qualification Evaluation Form," which can be directly used as controlled documents.

1. Purpose

To standardize the planning, preparation, implementation, reporting, and follow-up activities of internal audits, ensuring:

1. At least one complete internal audit covering all system requirements, processes, and shifts is conducted annually, with no more than 12 months between audits, to avoid management vacuums between audits.
2. Internal audits are conducted by qualified personnel who have no direct responsibility for the activities being audited, ensuring the objectivity and fairness of the audit conclusions.
3. Audit conclusions are based on objective evidence: each nonconformity must specify the exact clause, document item, and reproducible objective facts, rather than subjective impressions.
4. Issues identified during internal audits are converted into corrective actions with assigned responsibilities, deadlines, and verification methods, forming a closed loop of "audit—rectification—verification—closure."
5. Internal audit results and auditor capability evaluations serve as formal inputs for management review (9.3), driving continuous improvement of the system, rather than being a mere annual formality.

2. Scope

2.1 Applicable to all processes, departments, locations, and shifts covered by the company's QMS, including: management processes (policy objectives, risk opportunities, internal audits, management reviews, improvements), core processes (market and customer, design and development, procurement, production and service provision, inspection and release), and support processes (human resources, infrastructure, monitoring and measurement resources, knowledge, communication, documents and records).

2.2 Covered elements include: the suitability of system documents, the effectiveness of process operations, the completeness and control status of documented information, the extent to which personnel understand their job requirements, the rectification and implementation status of nonconformities from the previous internal and external audits, and the achievement of quality objectives.

2.3 The following activities are not within the scope of this document and should be conducted according to their corresponding documents:

2.4 For multi-site companies (including remote factories, leased warehouses, and overseas offices), each site should be included in the audit scope. A centralized planning approach by headquarters, with separate implementation at each site and a unified summary report, can be adopted, but audits should not be skipped due to the dispersion of sites.

3. Responsibilities

3.1 General Manager: Approves the annual internal audit plan and internal audit report; ensures the necessary resources, time, and personnel are allocated for internal audits; makes decisions on major nonconformities and systemic issues identified during internal audits; reviews internal audit conclusions during management reviews.

3.2 Management Representative: The highest organizer of internal audit activities. Approves the implementation plan and composition of each audit team; appoints the audit team leader; resolves scope disputes and nonconformity disagreements during the audit process; approves the internal audit report and rectification plan; explains the internal audit situation to the General Manager and certification body.

3.3 Quality Department: The department responsible for internal audits. Compiles the annual internal audit plan, maintains the auditor roster and qualification records, organizes auditor training and capability evaluations, consolidates nonconformity logs, tracks rectification verification status, and compiles the annual internal audit summary.

3.4 Audit Team Leader: Responsible for the entire process of the current internal audit—document review, implementation plan compilation and division of labor, opening and closing meeting facilitation, nonconformity grading, audit findings consolidation, internal audit report writing, and assistance in rectification tracking.

3.5 Internal Auditors: Compile checklists, conduct on-site audits, gather objective evidence, issue nonconformity reports, and participate in rectification verification according to their assigned roles. During the audit, they should not be influenced by the audited department and should record observed facts truthfully.

3.6 Audited Department Heads: Cooperate with audit arrangements, provide documents, records, and on-site conditions truthfully, and assign personnel familiar with the business to accompany the auditors. Sign off on confirmed nonconformities and complete root cause analysis and corrective actions within the specified timeframe.

3.7 All Departments: Attend the opening and closing meetings; implement rectifications for nonconformities related to their departments; maintain their departmental system records in daily work to ensure they can be readily accessed during audits.

4. Work Procedures

4.1 Annual Internal Audit Planning

4.1.1 The Quality Department should compile the "Annual Internal Audit Plan" by December 20th each year, for review by the Management Representative and approval by the General Manager.

4.1.2 The annual plan should at least include: the number of audits (usually one complete audit, with 1-2 additional specialized audits if necessary), the planned months for each audit, the scope and clause coverage, the audit team personnel arrangements, and the coordination with the previous external audit.

4.1.3 Specialized internal audits should be added under the following circumstances, without being restricted by the annual plan:

1. Significant changes in organizational structure, product scope, production processes, or location.
2. Batch quality incidents, major customer complaints, product recalls, or regulatory notifications.
3. Systemic nonconformities identified during certification or customer audits, requiring self-inspection for similar risks.
4. More than 2 major nonconformities in the previous internal audit, or widespread delays in rectification.
5. A pre-audit self-inspection is needed before the external audit.

4.1.4 When compiling the annual plan, consider the status and importance of the activities to be audited, as well as past audit results, to avoid identical audit routes year after year and the long-term omission of less familiar processes.

4.2 Qualification and Management of Internal Auditors

4.2.1 Internal auditors must meet the following conditions:

1. Have received training in ISO 9001:2015 standards and internal audit techniques, passed the assessment, and hold valid training records.
2. Be familiar with the company's production processes or business flows and possess basic professional judgment in the audited field.
3. Have the ability to write checklists, record objective facts, and prepare reports.
4. Possess communication and questioning skills to investigate facts without escalating conflicts.

4.2.2 Internal auditors are recommended by departments, reviewed by the Quality Department, and appointed by the Management Representative. The Quality Department maintains an "Internal Auditor Roster" and individual qualification files, including training records, past audit projects and durations, capability evaluation conclusions, and re-confirmation dates.

4.2.3 Independence Requirement: Internal auditors should not audit their own departments, activities they are directly responsible for, or documents they recently helped compile. Companies with sufficient human resources can adopt cross-departmental audits; companies with limited resources should ensure that "the person responsible for the audited department does not serve as the auditor for that department," and if necessary, the Management Representative can temporarily assign cross-departmental personnel or invite related companies for mutual audits.

4.2.4 The qualification of internal auditors is valid for 3 years. Re-evaluation or disqualification should occur if any of the following conditions arise: no participation in internal audits for two consecutive years, inaccurate recording or leakage of audit information, or unsatisfactory capability evaluation.

4.2.5 The Quality Department should organize an internal auditor workshop or case review at least once a year to exchange audit techniques, unify judgment criteria, and prevent the same fact from being judged differently by different auditors.

4.3 Audit Preparation

4.3.1 Forming the Audit Team: The audit team generally consists of 2-4 people, with the team leader appointed by the Management Representative. Team division should consider process or departmental focus, professional complementarity, and independence. Each team configuration should ensure a balanced workload for auditors, with no more than 6 hours of audit time per person per day.

4.3.2 Document Review: Five working days before the audit, auditors should review system documents related to the audited process, previous nonconformity reports and rectification evidence, relevant quality objectives and KPI data, customer complaints, and internal nonconformity data. Identify discrepancies between "what the documents specify" and "how things are actually done" to focus on during the on-site audit.

4.3.3 Compiling the Implementation Plan: The team leader should compile the "Internal Audit Implementation Plan" (QR-42-01) five working days before the audit. The plan should include the audit purpose, scope, and basis, audit dates and schedules, audit team members and division of labor, audited departments and corresponding clauses, and the times and locations for the opening and closing meetings.

4.3.4 The implementation plan, after approval by the Management Representative, should be sent to all audited departments three working days in advance to facilitate personnel arrangements. If there are scheduling conflicts, the audited department should notify the team leader within one working day of receiving the plan, and the team leader will coordinate accordingly.

4.3.5 Compiling the Checklist: Internal auditors should compile the "Internal Audit Checklist" (QR-42-02) according to their assigned roles. Key points for compilation:

1. Each check item should correspond to a specific clause and document item, clearly stating "what to check."
2. Questions should primarily be open-ended (e.g., how it is done, who decides, how issues are handled) with necessary closed-ended verification.
3. Specify the sampling objects and quantities, such as "sample 2 batches of production records from the last 3 months" or "sample 5 training records from this year."
4. Reserve a "findings" section to record facts on-site, avoiding conclusionary language.

4.3.6 The checklist should not be a direct copy of previous years' templates. For the same process, the sampling objects and audit entry points should be changed each year to avoid repeatedly identifying the same superficial issues.

4.4 Opening Meeting

4.4.1 The opening meeting is chaired by the team leader and attended by the Management Representative, audited department heads and accompanying personnel, and all audit team members. The meeting should last no more than 30 minutes.

4.4.2 Meeting content: Introduce the audit purpose, scope, and basis; announce the audit team division and schedule; explain the audit methods (sampling, interviews, on-site observation, document review); clarify the criteria for nonconformity determination and grading; outline the closing meeting arrangements; confirm confidentiality requirements and procedures for handling emergencies.

4.4.3 The opening meeting should result in a "Meeting Attendance Form" for record-keeping. If key participants are absent, the team leader and Management Representative should decide whether to postpone the meeting.

4.5 On-Site Audit Implementation

4.5.1 Audit Route: Follow the sequence "process input—activity—output—monitoring—improvement" rather than viewing departments in isolation. For example, when auditing the procurement process, start from procurement requirements, proceed through supplier selection, contract signing, incoming verification, supplier performance evaluation, and conclude with the handling of nonconforming suppliers.

4.5.2 Audit Methods: Focus on on-site observation, supplemented by document review and personnel interviews, with all three methods cross-verified. Relying solely on records can be misleading due to "backdating," relying solely on interviews can yield inaccurate verbal responses, and relying solely on on-site observation can miss systemic issues at the policy level.

4.5.3 Sampling Principles: Sampling should cover different batches, shifts, and operators, not just the "best" or "most recent" samples. If anomalies are found, expand the sampling range to determine if they are isolated or systemic. The sampling quantity and sample identifiers must be recorded in the checklist to ensure traceability of findings.

4.5.4 Requirements for Gathering Objective Evidence: Nonconformity objective evidence should be reproducible and identifiable, at least including: time, location, document or record number involved, product or batch involved, and a factual description. Avoid subjective comments like "poor management," "inadequate execution," or "low personnel awareness" that cannot be verified.

4.5.5 Common Abnormality Pursuit Path (General Pursuit Method for Auditors): Upon discovering a missing record, do not stop at "record missing." Instead, pursue the following questions: what is the specified record form, who is responsible for filling it out, why it was not filled out, whether anyone has checked it, when a similar issue last occurred, and whether corrective actions have been implemented, until the root causes at the policy, training, and supervision levels are identified.

4.5.6 Nonconformity Determination: A nonconformity report can only be issued if the following elements are present: a clear requirement (standard, regulation, system document, or customer requirement), an objective fact that does not meet the requirement, and a verified fact confirmed by the audited party. All three elements are essential. The following scenarios are not considered nonconformities: current documents do not specify but the actual practice is good—should be noted as an "improvement opportunity"; only non-standard wording without substantial impact—verbal guidance is sufficient; issues that fall under the responsibility of another department—should be transferred for verification and not counted as a nonconformity in the current department.

4.5.7 Nonconformity Grading:

4.5.8 Each nonconformity is recorded on a separate "Nonconformity Report" (QR-42-03), with a numbering rule NC-Year-Two-digit Serial Number (e.g., NC-2026-07). The audited department head should confirm and sign the report on-site. If there is a dispute over the determination, it can be appealed on-site, with the team leader making the final decision. If consensus cannot be reached, the Management Representative will arbitrate, and the appeal process should not affect the progress of other audit items.

4.6 Internal Audit Team Meeting and Closing Meeting

4.6.1 After the on-site audit, the audit team should hold an internal meeting to consolidate findings, unify the description and grading of nonconformities, eliminate items with insufficient evidence, and merge duplicate items, forming the audit conclusion and initial draft of the internal audit report.

4.6.2 The closing meeting is chaired by the team leader, with the same attendees as the opening meeting, and should last no more than 60 minutes. Meeting content: report on the audit implementation and sampling coverage; read out nonconformities and observations, explaining the violated clauses and document items; summarize the audit conclusion (whether the system is operating effectively, whether it can pass external audits, and key areas for rectification); announce rectification deadlines and verification arrangements.

4.6.3 After the closing meeting, the audited department head should sign the nonconformity report to confirm receipt.

4.7 Internal Audit Report

4.7.1 The team leader should complete the "Internal Audit Report" (QR-42-04) within five working days after the closing meeting, for review by the Management Representative and approval by the General Manager.

4.7.2 The report should at least include: audit purpose, scope, and basis; audit dates and team members; audited departments and clause coverage; sampling explanation; nonconformity statistics (by department, by clause, by grade); observations and improvement suggestions; overall evaluation of system effectiveness; verification status of previous internal and external audit nonconformities; conclusions and subsequent arrangements.

4.7.3 The report should provide a clear conclusion, not just a list of issues without a stance. Example conclusion language: "This year's internal audit covered X departments and Y clauses, identifying Z nonconformities (n major, m minor). The system is generally operating effectively, but there are systemic execution deviations in clauses 8.5.1 (production process control) and 7.5.3 (documented information control) that require focused rectification." The conclusion should align with the management review input.

4.8 Corrective Actions and Follow-Up Verification

4.8.1 The responsible department for nonconformities should complete root cause analysis (distinguishing between occurrence causes and escape causes, using 5Why or fishbone diagrams if necessary) and develop corrective actions within three working days of receiving the report, specifying the responsible person and completion deadline, and filling in the measures section of the "Nonconformity Report."

4.8.2 Measures should address the root cause, not just the symptoms. Typical counterexample: the cause is "inspection standards do not cover this dimension," but the measure is "strengthen inspector training."

4.8.3 Internal auditors are responsible for follow-up verification. The verification method should include two aspects: document and record evidence verification (newly issued documents, updated forms, training records) and operational effectiveness verification (data from several consecutive batches, on-site rechecks over several cycles). Document evidence alone is insufficient for closure.

4.8.4 The verification conclusion is recorded in the verification section of the "Nonconformity Report," signed by the internal auditor and the audited department head, and then closed. If the item is not closed on time, the Quality Department should report it monthly to the Management Representative and include it in the department's performance evaluation.

4.8.5 After a major nonconformity is closed, a "look back" should be scheduled in the next internal audit to confirm that the issue has not recurred.

4.9 Document Archiving and Management Review Input

4.9.1 The Quality Department should establish a "Nonconformity Log," registering each nonconformity by number, department, clause, grade, opening date, deadline, closing date, and verifier, and quarterly statistics on closure rates and overdue rates.

4.9.2 Internal audit documents (plans, checklists, nonconformity reports, reports, attendance forms, verification evidence) should be archived and retained by the Quality Department for at least three years.

4.9.3 The internal audit report and nonconformity log should be submitted as formal inputs for management review, where the following should be reviewed: the comprehensiveness of internal audit coverage, the weak links in the system reflected by nonconformity distribution, the status of rectification completion and remaining issues.

4.10 Internal Audit Implementation Flowchart (Text Version)

Annual plan compilation → Approval (review by Management Representative, approval by General Manager) → Forming the audit team and appointing the team leader → Document review (review documents, historical nonconformities, data) → Compiling the implementation plan and sending it three working days in advance → Compiling the checklist → Opening meeting → On-site audit (interviews + on-site observation + document review + sampling evidence) → Confirmation and signing of nonconformity facts → Internal team consolidation and unified judgment criteria → Closing meeting report → Compiling the internal audit report (within five working days) → Approval and distribution → Root cause analysis and corrective actions by responsible departments (submit plan within three working days) → Follow-up verification by internal auditors (document evidence + operational evidence) → Closure and log registration → Summary and statistics → Submission to management review → Escalation of un-closed items.

5. Related Records

5.1 Internal Audit Implementation Plan (QR-42-01)

Field list: Audit number, audit purpose, audit scope and basis, audit date, opening/closing meeting time and location, audit team members and division of labor, audited departments, corresponding clauses, accompanying personnel, preparer/approver/date.

Filling instructions: List each process for a department in separate rows. In the clause column, write the specific standard clause number (e.g., 8.5.1, 7.5.3), not just the chapter name. Example row:

5.2 Internal Audit Checklist (QR-42-02)

Field list: Clause number, corresponding document item, check content/question points, sampling objects and quantities, audit findings (objective facts), determination (conformity/nonconformity/observation), evidence reference.

Filling instructions: The audit findings column should only record facts, not evaluations. The determination column should be filled out before leaving the site to avoid premature conclusions affecting subsequent evidence gathering. Example row:

5.3 Nonconformity Report (QR-42-03)

Field list: Nonconformity number, audited department, audit date, clause number, nonconformity fact description, violated document item, nonconformity grade (A/B), audited party confirmation signature, root cause analysis (occurrence cause/escape cause), corrective and preventive actions, responsible person and completion deadline, verification method, verification conclusion, verifier and date.

Filling instructions: Fact descriptions should use the "should... actually..." two-sentence format; root cause analysis must distinguish between occurrence and escape causes; verification methods should specify the exact types of records to be checked. Example row:

5.4 Internal Audit Report (QR-42-04)

Chapter framework: 1. Audit Overview (purpose/scope/basis/date/members); 2. Audit Implementation (covered departments and clauses, sampling quantity explanation); 3. Nonconformity Statistics (department distribution table, clause distribution table, grade distribution); 4. Key Findings (individual issues and impact analysis); 5. Improvement Suggestions (observation list); 6. Verification of Previous Nonconformities; 7. Overall Conclusion; 8. Subsequent Arrangements (rectification deadlines, verification plans, management review submission time); preparer/reviewer/approver/date.

5.5 Internal Auditor Qualification Evaluation Form (QR-42-05)

Field list: Name, Department, Training Record (course/date/assessment result), Audit Participation (year/role/duration), Professional Familiarity, Checklist Compilation Ability, Accuracy of Fact Recording, Communication and Questioning Skills, Evaluation Conclusion (competent/conditionally competent with coaching/incompetent), Re-confirmation Date, Evaluator and Date.

Filling instructions: The evaluation conclusion should primarily be based on the auditor's performance in the most recent actual audit, not subjective impressions. Auditors who are "conditionally competent with coaching" should be assigned a follow-up audit for coaching.

Usage Instructions

1. Modify According to Actual Company Conditions

1. Determine the Audit Team Size Based on Scale: This document is written for audit teams of 2-4 people. For companies with fewer than 20 employees, one internal auditor and one assistant can complete the audit, but the principle of "independence from the audited department" must be maintained. For companies with more than 500 employees or multiple sites, the structure should be "headquarters audit team + site audit sub-teams," with additional communication and consolidation mechanisms within the audit team in section 4.3.
2. Adjust Sampling Focus Based on Industry: Manufacturing companies should focus on production process records and inspection data. Trading and service companies should shift the sampling focus to contract reviews, customer communication records, and service delivery records. Companies providing design services should add staged reviews of the 8.3 design and development process.
3. Replace Clause Numbers with Your Manual's Section Numbers: This document directly references ISO 9001:2015 clause numbers. If your company's manual and procedure documents use different numbering conventions (e.g., QP-08-03), both should be annotated in the checklist to avoid miscommunication.
4. Add a Matrix Table for Integrated Systems: For companies running quality, environmental, and occupational health and safety systems, it is recommended to add a "system—clause—department" matrix in section 4.3.3 to gather evidence for all three systems during a single on-site audit, reducing repeated disruptions.
5. Avoid Scheduling Conflicts with External Audits: Leave at least one month between the annual internal audit and the external audit to allow for actual rectification. If the internal audit is scheduled just one or two weeks before the external audit, rectification will likely be superficial.

2. Audit Focus Points (Common in Internal and Certification Audits)

1. Audit Team Independence: Can the actual assignment records of auditors prove that they did not audit their own departments, especially in the common scenario where department heads also serve as auditors?
2. Sampling Evidence Recording: Are sampling objects and quantities recorded in the checklist, and can the audit scope be reconstructed based on the checklist?
3. Quality of Objective Evidence: Do nonconformity fact descriptions specify the exact document number, batch number, and time, and can they be reproduced?
4. Nonconformity Rectification: Are the measures addressing the root cause, is there operational evidence for verification, and is the closure time earlier than the actual completion time of the measures?
5. Recurrence of Previous Year's Nonconformities: Repeated issuance of the same issues is typically escalated in external audits.
6. True Coverage of All Clauses and All Shifts: Night shifts, leased warehouses, and overseas service points are the areas most likely to be overlooked.
7. Consistency Between Internal Audit Report and Management Review Input: Do the data in both documents align?
8. Validity of Internal Auditor Qualifications and Re-confirmation Records: Are the qualifications and re-confirmation records within their validity period, and are training records verifiable?

3. Common Mistakes

1. Treating Internal Audits as "Record Checks": Auditors sit in meeting rooms flipping through records without on-site observation or process logic questioning. Solution: Mandate on-site observation time for each process in the checklist and record the observed operational conditions in the findings section.
2. Auditors Auditing Their Own Departments: The most common and easily caught issue in external audits. Solution: Create an "audit avoidance matrix" in the annual plan, and if personnel are insufficient, have the Management Representative assign other department personnel or introduce external mutual audits, with records of the assignments.
3. Nonconformity Descriptions Full of Subjective Comments: Phrases like "poor management," "inadequate execution," or "low personnel awareness" cannot be verified and make rectification difficult. Solution: Promote the "should... actually..." sentence structure, and return nonconformity reports that do not follow this format for revision.
4. Only Issuing Nonconformities, No Improvement Opportunities: Audits become one-sided accountability, leading to accumulated departmental resistance. Solution: Require at least one improvement suggestion per checklist, and start the closing meeting by acknowledging effective practices before reporting issues.
5. Rectifying Records but Not Processes: Records are updated, but the same deviations reappear in different forms the next month. Solution: Mandate operational evidence in the verification phase, with on-site follow-ups by auditors one month later, not just document reviews.
6. Auditing Only Once a Year, Only Familiar Departments: Processes like procurement, design, and after-sales are long-term omissions, leading to concentrated exposure during certification audits. Solution: List "processes not audited in the past three years" in the annual plan and prioritize their coverage in the next year.
7. Internal Audit Reports Only List Issues Without a Stance: A list of nonconformities without an overall evaluation of the system's effectiveness makes it difficult for management to make decisions. Solution: Fix the overall conclusion language in chapter seven of the report and ensure it aligns with the data in the management review input.
8. Disconnection Between Rectification Logs and Nonconformity Reports: Logs are registered, but the report does not match the log numbers, breaking the traceability chain. Solution: Use the same numbers for the logs and reports, and archive them together as an appendix to the internal audit report.

The value of internal audits lies not in finding problems, but in driving process improvements.

Knowledge code: 2.3.1

Version: v20260809

Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools to quality management practitioners, helping companies continuously improve their quality capabilities.