QM Bench

ISO 9001 internal audit: theory, how to run it and case study

How to plan and run an ISO 9001:2015 internal audit, the difference between minor and major nonconformities and opportunities for improvement, how to write a finding, and a worked example.

Ľubomír Blažek
Automotive quality manager · updated 2026-10-25

Try it while you read

Open the free ISO 9001 Internal Audit tool and click Load sample: it reproduces the case study below.

Open the tool

Theory: the quality system checks itself

ISO 9001:2015 clause 9.2 requires internal audits at planned intervals to check that the quality management system conforms to the organisation’s own requirements and to the standard, and that it is effectively implemented. Internal audits are the organisation’s early warning system: a finding in an internal audit costs far less than the same finding by the certification body or a customer.

The standard is structured in clauses 4 to 10 following the Plan-Do-Check-Act cycle: context (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10).

Rating scale

  • Conform: the requirement is met with evidence.
  • Opportunity for improvement (OFI): met, but could be more effective.
  • Minor nonconformity: a single lapse or partial failure.
  • Major nonconformity: a missing or broken process.

Key point

A good finding has three parts: the requirement (clause or procedure), the objective evidence, and the gap between them. No opinions, no names.

Step by step with the tool

  1. Start an audit and fill auditee, area, auditor and team.
  2. Remove out-of-scope questions with “Edit checklist”.
  3. Rate each question; minor or major opens fields for evidence, finding and corrective action.
  4. Write the summary and add photos of evidence.
  5. Download the PDF report with the action plan and track the actions to closure.

Case study: production and purchasing

An internal audit of production and purchasing covers 30 requirements (the Load sample audit).

  • Result: 0 major, 2 minor nonconformities, 1 OFI; conformity 96.7 %.
  • Minor, clause 7.2: training effectiveness not evaluated for 3 of 12 sampled operators. Action: add an effectiveness check after 4 weeks to the training form.
  • Minor, clause 9.2: purchasing not audited in the last 18 months. Action: add to the Q1 audit plan.
  • OFI, clause 5.2: the quality policy is known but not linked to department objectives.

Result

No finding threatens certification, but both minors would likely be raised by the external auditor. They are closed before the surveillance audit.

Common mistakes

  • Checking documents only, without looking at the actual work.
  • Findings without objective evidence.
  • Corrective actions that fix the example but not the cause.

Automotive suppliers should add the IATF 16949 checklist. The questions in the tool are our own wording; the standard itself is sold by ISO and national bodies.

Frequently asked questions

Can I audit my own department?

No. ISO 9001 clause 9.2.2 requires auditors to be objective and impartial, which in practice means not auditing their own work.

How is a major nonconformity defined?

The absence or total breakdown of a required process, or a situation that casts serious doubt on the ability to deliver conforming product. Several related minor findings can together be a major.