PRACTICAL GUIDANCE
What this review is for
Follow work from requirement to result. An internal audit tests whether agreed arrangements are implemented and effective, with findings tied to evidence rather than the appearance of a document set.
Who this is for. For organisations operating a management system that need a focused audit, a review of a high-risk process, or help shaping a proportionate audit programme.
SERVICE SPECIFICATION
Scope and evidence
What the review covers
- Set audit objectives, criteria, boundaries and sampling priorities using process importance, changes and previous results.
- Plan interviews and record reviews around operational workflows, including handovers and outsourced activities.
- Check both the relevant standard and the organisation’s own stated arrangements where these form the agreed criteria.
- Document findings using the requirement, the evidence and a clear explanation of any gap.
- Review proposed corrective actions and define how effectiveness could be checked when follow-up is included.
Evidence to prepare
- The current audit programme, previous reports and open corrective actions.
- Process descriptions, role responsibilities and the criteria to be audited.
- A representative set of operating records, including exceptions and unsuccessful outcomes.
- Performance measures, complaints, incidents and management-review decisions.
- Information about who designed or operates the activities, so independence and conflicts can be assessed.
What the review is intended to produce
- An audit plan with process coverage, participants and sampling limits.
- A report explaining the evidence considered and conclusions reached.
- A findings register that separates nonconformities from observations and improvement suggestions.
- An action log with owner, due date and a place to record completion and effectiveness evidence.
- Programme recommendations where repeated issues or changes justify different future audit coverage.
How the work is structured
Choose a useful scope
Select processes and risks that matter. Calendar coverage alone does not show that an audit programme is effective.
Protect objectivity
Review competence and conflicts before assigning an auditor. Separate evaluation from decisions the auditor made while designing or running the activity.
Trace real work
Use interviews, records and appropriate observation to follow a sample through the process. Record contradictions and seek corroboration.
Close the loop
Management owns correction and corrective action. Follow-up should test whether the cause was addressed, rather than merely whether a task was marked complete.
Service boundaries
- Certification audits are carried out by independent certification bodies, ideally accredited by UKAS. ISOaudit does not issue certificates and is independent of ISO, UKAS and certification bodies.
- An internal audit samples defined activities. It does not establish that every transaction conforms or remove management’s responsibility for the system. Remote suitability depends on the evidence needed.
- This page describes a proposed service method. An audit brief records your needs; it does not place an order or confirm scope, availability or delivery terms.
The specification does not constitute an offer or an agreed engagement. Trading identity, price, availability, scope, liability and service terms must be confirmed before a paid engagement can be accepted.
Common questions
Can an external provider carry out an internal audit?
Yes. Internal describes the purpose of the audit, not whether the auditor is an employee. Competence, objectivity and an appropriate scope still need to be established.
Must every topic be audited in one visit?
An audit programme can distribute work across processes and periods. Its coverage and frequency should reflect the relevant requirements, process importance, changes and previous results.
Can a finding be closed when the procedure is updated?
Sometimes the immediate correction is a document change, but closure may also require evidence that people use the revised process and that the underlying problem is not recurring.
FICTIONAL WORKED EXAMPLE
Fictional example: a demonstrated departure from an internal rule
A fictional business audits how changed customer requirements are approved. The facts below are invented for education and do not describe a client finding.
| Criteria to establish | The example's agreed internal procedure requires approval before a changed order is delivered. A real audit would also identify the relevant licensed standard requirements and scope. |
|---|---|
| Evidence and sample | Trace selected changed orders through the change log, approval record and delivery record. Explain the population, selection reasons and limits of the sample. |
| What the evidence shows | The fictional records date approval after delivery, and the process owner confirms that no earlier approval occurred. Those facts demonstrate a departure from the stated internal rule, beyond a missing document alone. |
| Next step | Record the criterion, evidence and affected process. Assess whether the issue extends to other work, investigate the cause and check later orders after the corrective action has operated. |
The example conclusion depends on its invented, corroborated facts. Actual findings require evidence, fair evaluation and the agreed audit criteria; sample results cannot establish universal conformity.
YOUR NEXT STEP
Make the scope concrete.
Describe your organisation, objective and constraints. Download the brief and review it before commissioning work.
Prepare an audit brief ↗SOURCES & REVIEW
Check the underlying information.
These are independent summaries and implementation suggestions, not the copyrighted standard text. Use an authorised copy of the applicable standard for its full requirements.
Reviewed 1 November 2026 · Next editorial review 1 December 2026 · Editorial policy
The displayed review date records an editorial source check. Named specialist review is still to be assigned for this private edition. The 2 November 2026 content update added an original fictional worked example and related guidance; source corrections are recorded in the project change log.