Internal audit

Plain-language summary

Checking your own EMS at planned intervals — against the standard and your own arrangements — using objective auditors and acting on what they find.

What the clause is really asking

Internal audit is the system checking itself before the certifier does. You must run internal audits at planned intervals to confirm the EMS conforms to your own requirements and to the standard and is effectively implemented and maintained. You need an audit programme based on importance and past results, defined criteria and scope, objective auditors, reporting to management, and correction of findings. The intent is genuine self-scrutiny that drives improvement, not a rubber stamp.

What auditors look for

Auditors review your audit programme for risk-based planning and full coverage of the EMS over time. They check auditor objectivity — people not auditing their own work — and competence. They sample audit reports for real findings, look for follow-up to closure, and judge whether internal audits actually catch issues or just confirm everything is fine.

Typical evidence

Risk-based internal audit programme and schedule; defined audit criteria and scope; auditor competence and independence records; audit reports with findings; corrective actions to closure.

How to comply — recommendations

Plan a programme that covers the whole EMS over the cycle, weighted to your higher-risk and poorer-performing areas. Use auditors who do not audit their own work and who are trained to audit against ISO 14001. Make audits substantive — sample evidence and walk the floor rather than tick boxes. Report findings to management and track them to closure so the audit drives real correction.

Common nonconformities

No audit programme or incomplete coverage of the EMS; auditors auditing their own work; superficial audits with no real findings; findings not closed out; programme not risk-based.

Resources for this clause

• ArticleHow to write an ISO 9001 audit nonconformity that won't get thrown out
• Free downloadNC Writing ChecklistWrite audit nonconformities that hold: requirement, evidence, statement — in that order, checked before the finding is issued.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.