To run an ISO internal audit, plan an audit programme, prepare for each audit, open with a meeting, collect evidence by interview, observation and records, grade your findings against the audit criteria, report, and follow up on corrective action. ISO 19011:2018 is the guidance standard that lays out this flow for any management system audit.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of ISO 19011:2018, which gives guidance on auditing management systems. We confirmed its seven auditing principles against several secondary summaries. It is a paid document and we have not reproduced its text. Check the current edition. ISO 19011 is guidance, not a requirement you certify against. The requirement to audit internally sits in each management system standard, for example clause 9.2 of ISO 9001:2015.
Edition note (17 October 2026). ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 after a transition of about three years. Sources give slightly different end dates (around September 2029), and the International Accreditation Forum and your certification body set the rules, so ask yours. ISO 14001:2026 was published in April 2026 with a similar three-year transition. This guide uses the 2015 clause structure, because we could not verify the 2026 clause numbering. If you audit to a 2026 edition, check each reference against it.
What ISO 19011 is, and what it is not
A management system is the set of policies, processes and records a company uses to meet a goal such as quality, security or safety. ISO 19011:2018 explains how to audit one. It covers the principles of auditing, how to manage an audit programme, how to conduct an audit, and how to judge the competence of auditors.
It does not set requirements for the company being audited. You cannot be "certified to ISO 19011". It is a good model for your internal audit, and certification bodies work to a related standard, ISO/IEC 17021-1.
The seven principles
ISO 19011:2018 lists seven principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. In plain terms: be honest, report what you actually found, take care, keep information private, stay free of bias, rely on verifiable evidence and focus on what matters most.
Step 1: Set up the audit programme
The audit programme is the plan of audits for a period, usually a year. It states the objectives, which processes or sites to cover, the timing, the auditors and the resources.
Give more attention to processes that are higher risk, changed recently or had problems in earlier audits. Record who manages the programme.
Step 2: Start the individual audit
Agree the objectives, scope and criteria. Criteria are what you audit against: the ISO standard, the company's own procedures, and legal requirements that apply. Confirm the team and make first contact with the auditee, the person or team being audited.
Step 3: Prepare
- Review documents: procedures, past audit reports, open corrective actions.
- Prepare an audit plan: who, when, which process, which auditor.
- Assign work to team members.
- Prepare working documents, such as a checklist and a form to record evidence.
Share the plan with the auditee in advance so the right people are available.
Step 4: Conduct the audit
Opening meeting. Confirm the plan, the method, how findings will be graded and how you will report. Keep it short.
Collect evidence. Use three routes, and check one against another:
| Route | Example |
|---|---|
| Interview | Ask the process owner to walk you through the process |
| Observation | Watch the work, the environment, the equipment |
| Document and record review | Pick a sample of records and trace them |
Information only counts as audit evidence once it can be verified. Record the source and the date for each item. A statement from one person that "we always do this" is a lead, not evidence, until you see the record.
Generate findings. Compare evidence with the criteria. A finding can show conformity, a nonconformity (a requirement not met), or an opportunity for improvement. Write each nonconformity with three parts: the requirement, the evidence and the gap.
Closing meeting. Present the findings so the auditee understands them and agrees the facts. Agree a timeframe for corrective action. Disagreements about facts should be settled here, not in the report.
Step 5: Report and distribute
The audit report should be complete, accurate and clear. It usually states objectives, scope, criteria, dates, team, the findings and conclusions. Send it to the agreed recipients by the agreed date. See ISO audit nonconformities: major vs minor for how to word and grade findings.
Step 6: Complete the audit and follow up
The audit is complete when the planned activities are done and the report is issued. Keep records as your programme requires. Follow-up checks whether corrective action was taken and worked. This is part of the follow-up in ISO 19011, though it is not always treated as part of the audit itself.
Competence of auditors
An internal auditor needs knowledge of the standard, the company's processes and audit method, plus personal qualities such as being ethical, observant and diplomatic. Training and records of competence matter, since a certification body or a customer may ask for them.
Tips from practice
- Do not audit a process you are responsible for.
- Sample on purpose. Pick records from different periods, shifts or sites.
- Ask open questions: "show me", "walk me through", "how do you know".
- Stay on the evidence. Do not suggest the fix as part of a finding.
- Write the report the same week while it is fresh.
Frequently Asked Questions
Is ISO 19011 a certifiable standard?
No. It is guidance on auditing management systems. Companies are certified to standards such as ISO 9001, not to ISO 19011.
Do I need ISO 19011 to do internal audits?
You do not need to follow it, but it is a widely used reference for method. The requirement to audit internally comes from the standard you follow, for example clause 9.2 of ISO 9001:2015.
How long should an internal audit take?
It depends on scope, size and risk. We have not listed a fixed number, since none applies to every company. Plan time per process rather than copying a figure.
What is the difference between an opening meeting and a closing meeting?
The opening meeting confirms the plan and method before fieldwork. The closing meeting presents findings and agrees the facts and the time for corrective action.
Can one person audit alone?
Yes, in a small company, as long as the person is impartial and competent and does not audit their own work.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error