Guidance

Monitoring and measurement

The ISO Navigator™ database hyperlinks the ISO 9000:2005 principles and the ISO 9001:2008 requirements; and explains them in plain English with practical guidance.

This guidance has been superseded by ISO 9001:2015 Clause 9.2 Internal Audit. If you want to see a comparison matrix that correlates the requirements of ISO 9001:2008 to the revised requirements of ISO 9001:2015, please click here to begin comparing.

Our range of ISO 9001:2015 quality manuals and integrated manual templates cover the requirements of ISO 14001:2015 and ISO 45001:2018, and offer an easy way to implement and document your organization's quality management system or integrated management system.

ISO 9001:2008: Internal audit 8.2.2 (superseded)

The purpose of the ISO 9001 internal audit is to assess the effectiveness of the quality management system and the organization's overall performance. Your internal audits demonstrate compliance with your ‘planned arrangements’, e.g. QMS manual, procedures or process maps and that the planned arrangements are implemented and maintained.

You can now purchase a range of internal audit checklists as standalone templates or as bundles, with no procedures or forms; just the audit questions!

The auditor’s role is to gauge how well this system is functioning by gathering of objective evidence of conformance and performance. The auditee will often be a processes owner; they are the experts of that process and as such will provide an invaluable insight into the mechanics of the process.

The auditor will verify that processes are documented, implemented and understood. They will also seek confirmation that each process complies with the necessary requirements, that the process is effective and demonstrates continual improvement. Implement an internal audit programme:

  1. Implement the internal audit procedure
  2. Establish audit schedule
  3. Plan your audits
  4. Assign audit duties
  5. Review and amend the audit checklist
  6. Do auditing
  7. Prepare and submit audit report
  8. Obtain feedback from auditees

Looking for an ISO 9001 internal audit checklist? Our internal audit templates come with an internal audit checklist, covering the requirements of ISO 9001:2008. It provides a great foundation for establishing, implementing and documenting your internal audit process.

Internal Audit Planning

Planning the internal audit schedule, whilst taking into account process status and importance (and other attributes), is one of the most disregarded requirements of ISO 9001. There is a solution however, download and use the process 'status and importance tracker' to help determine which of your processes and procedures should be audited more frequently.

Simply define your processes and procedures, then enter a score (1 to 4) to rank each process attribute. The formulas convert the individual scores to an overall average, with conditional formatting to highlight those areas that require more regular audits. A greater numerical weighting is given is to customer complaints and external corrective actions.

The resulting scores are highlighted to indicate whether the process requires more frequent auditing; based on its ability to affect the customer and how well it is performing.

This is a great way to substantiate your audit schedule as it highlights the more critical elements. You should then schedule processes with high, red scores for additional audits, perhaps or three or even more times per year.

Status:

You should consider process status in terms of maturity and stability; a more established, proven process should be audited less frequently than a newly implemented or recently modified process and should receive a lower status score. Conversely; processes which are not performing to the planned arrangements, should be assigned a higher status score.

Importance:

You should consider process importance as the degree of direct impact that process performance has on customer satisfaction; i.e. could the process provide the customer with non-conforming product? Support processes should be given a lower ranking than the manufacturing/service provision processes. In addition, the results of previous audits should be considered too. Processes that have been audited recently that have shown effectiveness and improvement should be audited less frequently.

Ranking:

Consider how a failure in quality attributes could affect your customers in terms of providing nonconforming product. In fact, why not ask your customers which attributes could affect them the most, as this method provides a great way to engage with them and to objectively justify the audit programme to top management.

Customer Complaints:

Customer complaints are ranked very highly in terms of seriousness and will elicit a red warning on the total score heat map to highlight that process as requiring greater audit scrutiny.

Corrective Actions:

The corrective actions should be included and must cover all those that were raised internally or externally. External corrective actions rank higher in terms of importance than internal corrective actions. External corrective actions might arise from customer audits, registrar audits or from other stakeholders.

Internal Audit Checklist

The ISO 9001 internal audit checklist is just one of the many tools which are available from the auditor’s toolbox that help ensure the audit addresses the necessary requirements. It stands as a reference point before, during and after the audit process and if developed for a specific audit, and used correctly will provide the following benefits:

  1. Ensures the audit is conducted systematically
  2. Promotes audit planning
  3. Ensures a consistent audit approach
  4. Actively supports the organization’s audit process
  5. Provides a repository for notes collected during the audit process
  6. Ensures uniformity in the performance of different auditors
  7. Provides reference to objective evidence
Free Downloads
Supplier Audit Checklist 21 page audit checklist covering 16 supplier aspects
Process Audit Checklist Outline generic process audit checklist

 

Selection of Internal Auditors

Implement programmes and procedures to cover internal auditor competence. Competence level may be measured by training, mentoring, participation in previous audits and experience in conducting audits.

Auditors may be external or internal personnel; however, they should be in a position to be impartial and objective. If internal personnel are selected to perform an audit, a mechanism needs to be established to ensure objectivity. For instance, a representative from another department may be selected to do the audit.

To properly conduct an QMS audit, an audit team should be established. Audits are demanding and require various forms of expertise. The size of the audit team will vary pending the size of the organization, size and type of operations and the scope of the audit.

Internal Audit Training

Formal internal audit training will provide your auditors with a broad understanding of the various organizational processes that comprise the quality management system and how it is implemented.

The aim of such training is to provide participants, who intend on performing internal audits, with the knowledge and skills needed to assess and report on the conformance and implementation of processes, and to contribute to the continual improvement of the quality management system. Internal auditor courses are normally two-days in duration and topics include:

  1. An introduction to management system standards
  2. The key requirements of ISO 9001
  3. Auditing guidelines based on ISO 19011
  4. QMS audit planning and preparation
  5. Conducting the audit
  6. Audit reporting and follow-up
Free Downloads
Internal Audit Presentation 21 slides promoting awareness of internal audits

 

Process Auditing

The process audit provides assurance that the process is being implemented as planned and provides information on the ability of the process to produce a quality output. Done properly, a process audit is much more than verification that procedures are being followed. Although preparation can take a day or two, actual audit time is about two hours per shift.

A process is a set of interrelated activities that transform inputs, such as materials, customer requirements and labour, via a series of activities into outputs, such as a finished product or service. Various stages of the process must meet various applicable clauses of the standard. There are six characteristics to look out for when auditing a process:

  1. Does the process have an owner?
  2. Is the process defined?
  3. Is the process documented?
  4. Are links between other processes established?
  5. Is the process and its links monitored?
  6. Are records maintained?
Free Downloads
Process Audit Diagram What to look for when auditing a process and its linkages
Process Audit Checklist Outline generic process audit checklist

 

As part of the process approach, the process audits must be scheduled according to the processes defined by your quality management system. The audit schedule should not be based on the clauses of the standard, or your procedures but it should be based upon the importance and criticality of the process itself. The process approach to auditing should cover three vital stages:

  1. Preparing for the audit (desk review)
  2. Auditing the process and its linkages
  3. Preparing the summary and audit report

Effective process auditing requires the auditor to identify and record audit trails that will make a difference to the organization. The audit should begin with the process owner in order to understand how the process interacts with the other process inputs, outputs, suppliers and/or customers.

The auditor should be able to determine whether the outputs are complete and that process measurements demonstrate whether all of the outputs are consistently fit for purpose and are efficiently managed. Do the customers agree with the outputs and the measures? Audit of customer processes at planned intervals to:

  1. Determine whether the process conforms to planned arrangements
  2. Determine whether the process is properly implemented and maintained
  3. Provide information on process performance to top management

Looking for ISO 9001 mandatory procedure templates? Our quality manual template provides a great foundation for establishing, implementing and documenting the six mandatory procedures that are required by the standard.

Want to know more?

SSL certification

A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.

Free PDCA guidance

ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.

Planning

ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
4.1 Organizational Context 4.1 Organizational Context 4.1 Organizational Context
4.2 Relevant Interested Parties 4.2 Relevant Interested Parties 4.2 Relevant Interested Parties
4.3 Management System Scope 4.3 Management System Scope 4.3 Management System Scope
4.4 QMS Processes 4.4 EMS Processes 4.4 OH&S Management System
 
ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
5.1 Leadership & Commitment 5.1 Leadership & Commitment 5.1 Leadership & Commitment
5.2 Quality Policy 5.2 Environmental Policy 5.2 OH&S Policy
5.3 Roles, Responsibilities/Authorities 5.3 Roles, Responsibilities/Authorities 5.3 Roles, Responsibilities/Authorities
    5.4 Consultation & Participation
 
ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
6.1.1 Address Risks & Opportunities 6.1.1 Address Risks & Opportunities 6.1.1 Address Risks & Opportunities
6.2.1 Quality Objectives 6.1.2 Environmental Aspects 6.1.2 Hazard Identifcation
6.2.2 Planning to Achieve Objectives 6.1.3 Compliance Obligations 6.1.3 Legal & Other Requirements
6.3 Planning for Change 6.1.4 Planning Action 6.1.4 Planning Action
  6.2.1 Environmental Objectives 6.2.1 OH&S Objectives
  6.2.2 Planning to Achieve Objectives 6.2.2 Planning to Achieve Objectives
 

Doing

ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
7.1.1 Resources - General
7.1 Resources 7.1 Resources
7.1.2 People 7.2 Competence 7.2 Competence
7.1.3 Infrastructure
7.3 Awareness 7.3 Awareness
7.1.4 Operational Environment 7.4.1 Communcation - General 7.4.1 Communcation - General
7.1.5 Monitoring & Measuring 7.4.2 Internal Communcation 7.4.2 Internal Communcation
7.1.6 Organizational Knowledge 7.4.3 External Communcation 7.4.3 External Communcation
7.2 Competence 7.5 Documented Information 7.5 Documented Information
7.3 Awareness    
7.4 Communcation    
7.5 Documented Information    
 
ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
8.1 Operational Planning & Control
8.1 Operational Planning & Control 8.1.1 General
8.2.1 Customer Communication 8.2 Emergency Preparedness 8.1.2 Eliminating Hazards
8.2.2 Determining Requirements
  8.1.3 Management of Change
8.2.3 Reviewing Requirements   8.1.4 Outsourcing
8.2.4 Changes in Requirements
  8.2 Emergency Preparedness
8.3.1 Design Development - General    
8.3.2 Design Development - Planning
   
8.3.3 Design Development - Inputs    
8.3.4 Design Development - Controls    
8.3.5 Design Development - Outputs    
8.3.6 Design Development - Changes    
8.4.1 External Processes - General    
8.4.2 Purchasing Controls    
8.4.3 Purchasing Information    
8.5.1 Production & Service Provision    
8.5.2 Identification & Traceability    
8.5.3 3rd Party Property    
8.5.4 Preservation    
8.5.5 Post-delivery Activities    
8.5.6 Control of Changes    
8.6 Release of Products & Services    
8.7 Nonconforming Outputs    
 

Checking

ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
9.1.1 Performance Evaluation 9.1.1 Performance Evaluation 9.1.1 Performance Evaluation
9.1.2 Customer Satisfaction 9.1.2 Evaluation of Compliance 9.1.2 Evaluation of Compliance
9.1.3 Analysis & Evaluation 9.2 Internal Audit 9.2 Internal Audit
9.2 Internal Audit 9.3 Management Review 9.3 Management Review
9.3 Management Review    
 

Acting

ISO 9001:2015 ISO 14001:2015 ISO 45001:2018
10.1 Improvement - General 10.1 Improvement - General 10.1 Improvement - General
10.2 Nonconformity & Corrective Action 10.2 Nonconformity & Corrective Action 10.2 Incident, Nonconformity & Corrective Action
10.3 Continual Improvement 10.3 Continual Improvement 10.3 Continual Improvement