How to run an internal audit that isn't theater

The internal audit that produces zero findings is not a success. It is a signal that the audit was not designed to find anything.

Both ISO 9001:2015 and ISO/IEC 27001:2022 require internal audits at planned intervals under clause 9.2, to establish whether the management system conforms to your own requirements and the standard’s, and whether it is effectively implemented and maintained. That second part is the one theater skips. An audit that only confirms documents exist answers the conformity question on paper and leaves the effectiveness question untouched.

Start with the programme, not the checklist

Clause 9.2.2 in both standards asks for an audit programme, not just a set of audits. Paraphrasing, the programme should take into account the importance of the processes concerned and the results of previous audits, and ISO 9001 adds changes affecting the organisation. Each audit needs defined criteria and scope, auditors chosen so the process is objective and impartial, results reported to relevant management, and documented information retained as evidence.

In practice, that means the programme should look different from one year to the next. A useful planning pass:

Weight by risk and importance. Processes that directly affect customers, or that handle your most sensitive information, get audited more often or more deeply.
Follow change. New systems, reorganised teams, new suppliers, and revised procedures are where gaps appear first.
Follow previous results. Areas with past nonconformities deserve a check that the corrective action under clause 10.2 actually worked.
Cover the whole system over the cycle. Every clause and every applicable control should be audited within the certification cycle, even if not every year.

On impartiality: auditors shouldn’t audit their own work. In a small organisation that can be awkward. Cross-auditing between departments, or bringing in an external auditor for the areas the quality or security manager runs, are common answers. ISO 19011:2018 gives general guidance on managing audit programmes and is worth a read if you are setting one up.

Sampling that finds things

The most common failure mode is sampling. Auditors interview the same people every cycle, review the same documents, and ask questions whose answers are already known. Effective sampling requires intentional variation:

Pick processes that changed since the last audit.
Pick periods when the team was understaffed or under pressure, such as year end, a product launch, or a system migration.
Pick transactions at the boundary of a procedure’s scope, not the textbook cases in the middle.
Pick from the records yourself. If the auditee chooses the samples, you are auditing their best examples.
Trace in both directions. Start from a requirement and look for the record, then start from a record and check it against the requirement.

A worked example, for an audit of supplier control under ISO 9001 clause 8.4:

Weak sample	Better sample
The three longest-standing suppliers	Two suppliers added in the last six months, one with a recent quality issue
Supplier evaluations stored in the shared folder	Purchase orders from the accounts system, traced back to an approved supplier
The supplier procedure document	The last time a supplier was rated poorly, and what happened next
Interview with the purchasing lead	Interview with someone who raised an order without the purchasing lead’s help

The better samples are not harder to collect. They just start from where the process is most likely to bend.

Questions that aren’t leading

Question design is the second lever. Leading questions (“You do review supplier risk quarterly, right?”) produce affirmative answers that tell you nothing. Open questions (“Walk me through the last time a supplier performance issue reached management”) produce narratives that reveal whether the process is real or documented but dormant.

Some patterns that help:

Ask for the last instance, not the general rule. “Show me the last access review” beats “How do you do access reviews?”
Ask what happens when it goes wrong. Exceptions show whether a process is understood or just followed.
Ask the people who do the work, not only the process owner.
Ask to see, not just to hear. Every claim should end in a record you can look at.

When an auditee pauses or redirects, that pause is data. The auditor’s job is to follow the thread, not move to the next checklist item. A checklist is there to make sure you don’t miss anything, not to set the pace of the conversation.

Grading findings consistently

Inconsistent grading undermines an audit programme quickly. If one auditor calls a missing record a nonconformity and another calls it an observation, management stops trusting either. Agree definitions before the audit, and write them into the programme. A common set:

Nonconformity: a requirement of the standard or of your own documented system is not met, with objective evidence to show it.
Observation: not yet a nonconformity, but a weakness that could become one.
Opportunity for improvement: the requirement is met, but there is a better way.

Every nonconformity should state the requirement, the evidence, and what was found, in that order. If you can’t name the requirement, it is probably an observation.

Reports people read

Audit reports fail when they are written for the certification body rather than for management. A report that lists clause references and finding codes is technically correct and practically useless. The reports that get read say, in plain language, what each finding means for the business: what went wrong, what could go wrong next time, and what a meaningful corrective action looks like.

Write the executive summary first. If you cannot summarise the audit in three sentences, you do not yet understand what you found. Then keep the rest short:

Scope, criteria, auditors, and dates
Findings, each with requirement, evidence, and impact
What is working well, briefly and specifically
Agreed actions, owners, and target dates

Then close the loop. Nonconformities should become corrective actions with a root cause, not just a correction, and audit results are an input to management review under clause 9.3 in both standards. An audit that doesn’t change anything was theater, however thorough the checklist.

Where StayEvident fits

StayEvident keeps internal audit programmes, checklists and findings in one place, with findings that can raise CAPAs and records that can be linked as evidence against the clause they relate to. Everything is written to an immutable audit trail. See the features overview for the full picture.