ISO 9001 Internal Audit Programme Guide: Build A Risk-Based Clause 9.2 Schedule

Why Clause 9.2 Makes Internal Audit A Programme, Not A Calendar

ISO 9001:2015 does not simply ask you to run an audit once a year. Clause 9.2.1 requires internal audits at planned intervals. The purpose is to confirm that your quality management system conforms to your own requirements and to ISO 9001, and that it is effectively implemented and maintained. That wording matters: an audit programme is a managed cycle, not a single event. This ISO 9001 internal audit programme guide focuses on the practical steps that turn Clause 9.2 into a repeatable, risk-based process.

A programme coordinates frequency, methods, responsibilities, planning requirements, and reporting. It also considers process importance, changes affecting the organization, and previous audit results. In other words, the programme should adapt to risk and performance, not just repeat last year's schedule.

What The Standard Actually Requires: Clause 9.2.1 And 9.2.2

Clause 9.2.1: Build The Programme

Clause 9.2.1 sets the foundation. You must plan audit intervals and define how the programme operates. At minimum, the programme should address:

• Frequency: how often each process, area, or project is audited.
• Methods: interviews, process observation, sampling, document review, remote checks, or a mix.
• Responsibilities: who owns the programme, who leads audits, who receives reports.
• Planning requirements: how scope, criteria, timing, and resources are set.
• Reporting: what is reported, to whom, and in what format.

The standard also expects you to consider the importance of processes, changes, and previous results. A process with high customer impact, recent changes, or repeated nonconformities may need more attention than a stable, low-risk support process.

Clause 9.2.2: Run Each Audit Properly

Clause 9.2.2 adds the controls for individual audits. For each audit, you must define criteria and scope. Criteria are the requirements you audit against, such as ISO 9001 clauses, internal procedures, customer-specific requirements, or regulatory obligations. Scope defines the boundaries: locations, shifts, processes, product lines, or projects.

The clause also requires auditors to be selected and audits to be conducted so that objectivity and impartiality are preserved. Results must be reported to relevant management. Finally, you must retain documented information as evidence that the programme was implemented and that audit results exist. That documented information is often reviewed during certification audits.

Designing A Risk-Based Audit Programme

A practical ISO 9001 internal audit programme guide should start with a simple risk and performance scan. List your processes, then score them on factors such as customer impact, process complexity, change volume, supplier dependence, previous findings, and key performance indicators. Use that scan to set audit frequency and depth.

For example, a design and development process with recent tool changes may be audited twice a year. A mature calibration process with stable results may be audited once every 18 months. The standard does not prescribe fixed intervals, but it does require planned intervals and a rationale. Keep the rationale simple and documented.

Methods should also fit the risk. High-risk processes may need on-site observation and sample testing. Lower-risk or remote processes may be covered through document review and interviews. If you use remote auditing, define how you will verify evidence and maintain confidentiality.

Responsibilities need clear ownership. One person should manage the overall programme, while individual lead auditors plan and conduct each audit. Auditees should know what to prepare and when. The programme owner should also track completion, findings, and follow-up actions.

Documented information supports the programme. If you are tightening your records, see this ISO 9001 documentation requirements guide for a clause-by-clause view.

From Programme To Audit Plan: Scope, Criteria, And Evidence

Audit Criteria And Scope

Before each audit, write an audit plan. It should name the process, define scope, list criteria, identify auditors, set dates, and outline the audit trail. Criteria might include Clause 8.5.1 for production control, Clause 8.7 for nonconforming outputs, or your own purchasing procedure. Scope might cover one site, one shift, or one product family.

Evidence should be sufficient and traceable. Use sampling to test records, interviews to understand practice, and observation to confirm what happens on the floor. Record what you saw, what you read, and what you were told. Avoid conclusions that are not supported by evidence.

A checklist can help, but do not let it replace critical thinking. The best checklists are tailored to the process and the risks. For a structured starting point, review this ISO 9001 documentation requirements checklist.

If your management system also covers environmental processes, integrated audits can reduce duplication. An ISO 14001 environmental aspects register checklist can help align environmental criteria with your quality audit programme. Keep the audit criteria separate, even when the audit team is shared.

Auditor Competence, Reporting, And Follow-Up

Clause 9.2.2 requires objectivity and impartiality. In practice, that means auditors should not audit their own work. A production supervisor should not audit the production process they manage. A document controller should not audit document control if they are the only person performing it.

Competence matters too. Clause 7.2 requires people doing work affecting quality to be competent. For auditors, that includes knowledge of ISO 9001, audit techniques, process knowledge, and relevant requirements. Training records, qualifications, and audit experience are common evidence.

ISO 19011 provides useful guidance on audit principles, programme management, and auditor competence. It is not a requirement of ISO 9001, but it is a practical reference for building a consistent audit approach. Use cross-functional teams when technical expertise is needed. The lead auditor remains responsible for the audit conclusion.

After the audit, report results to relevant management. The report should distinguish conformity, nonconformity, observations, and opportunities for improvement. Nonconformities need correction and corrective action under Clause 10.2. The standard expects action without undue delay. That means assigning an owner, setting a due date, and verifying effectiveness.

Track findings in a register. Review overdue actions at management meetings. Internal audit results are an input to management review under Clause 9.3.2. This closes the loop: audit results inform decisions about resources, process changes, and future audit frequency.

A good ISO 9001 internal audit programme guide also builds in programme review. At least annually, check whether the programme covered all processes, whether intervals were appropriate, whether auditors remained impartial, and whether findings led to improvement. Update the programme when risks, processes, or results change.

Common Pitfalls And A Practical Cadence

Common pitfalls include treating the audit programme as a calendar, using the same checklist for every process, assigning auditors to their own areas, and closing findings without verifying effectiveness. Another pitfall is failing to retain documented information. Without records, you cannot demonstrate that Clause 9.2 was implemented.

A practical cadence can be simple:

• Annual: approve the audit programme, assign process owners, and set risk-based intervals.
• Quarterly: review progress, adjust for changes, and check overdue actions.
• Per audit: issue the plan, collect evidence, report results, and log findings.
• Post-audit: verify corrective actions and feed results into management review.

Use this ISO 9001 internal audit programme guide as a working model, not a rigid template. The goal is a programme that gives management reliable information about conformity and effectiveness. When the programme is risk-based, impartial, and well documented, Clause 9.2 becomes a driver of improvement rather than a paperwork exercise.