An ISO internal audit is an audit that an organization carries out on its own management system. ISO management system standards, such as ISO 9001 for quality, ISO 14001 for the environment, ISO 45001 for occupational health and safety (OHS), and ISO/IEC 27001 for information security, require the organization to conduct internal audits at planned intervals.
This article explains the definition, the standards basis, whether this audit is mandatory, its types, requirements, and steps. Information on standard editions refers to the iso.org pages as of 13 October 2026.
What is ISO Internal Audit?
An ISO internal audit is a first-party audit of a management system: a systematic and independent process of obtaining evidence and evaluating it objectively, to assess whether the system conforms to the organization's requirements and ISO standards and is implemented and maintained effectively.
An internal audit is carried out by the organization itself or by another party on its behalf. The results are reported to the relevant managers, and the organization then responds to nonconformities, investigates their causes, and implements corrective action. Compliance with laws and regulations is a separate topic, covered in a compliance audit.
The term ISO audit can mean an internal audit by the organization itself, or a certification audit by a certification body. The difference is covered below.
One term, two meanings. The term internal audit is also used for the corporate internal audit function that reports to the board of directors and board of commissioners, and for internal quality audits at universities. This page covers internal audits of ISO management systems. For the corporate internal audit function, read what internal audit is. For universities, read internal quality audit.
Which Standards Are the Basis for an ISO Internal Audit?
The table below summarizes standard editions according to the iso.org pages as of 13 October 2026.
| Standards | Focus | Current edition |
|---|---|---|
| ISO 9001 | Quality management system | ISO 9001:2026 (published 16 September 2026). ISO 9001:2015 has been withdrawn. |
| ISO 14001 | Environmental management system | ISO 14001:2026 (published April 2026). The 2015 edition has been withdrawn. |
| ISO 45001 | OHS management system | ISO 45001:2018. A revision is planned and has not yet been published. |
| ISO/IEC 27001 | Information security management system | ISO/IEC 27001:2022 |
| ISO 19011 | Guidelines for auditing management systems, not a certification standard | ISO 19011:2026 (published May 2026). The 2018 edition has been withdrawn. |
In management system standards that use the ISO harmonized structure, the internal audit sits in clause 9.2, under performance evaluation. It covers: audits at planned intervals, an audit program, criteria and scope for each audit, auditors who are objective and impartial, and results reported to the relevant managers. Clause numbers may differ between editions, so check the text of the standard you hold.
ISO 19011 provides guidance on managing an audit program, conducting audits, and auditor competence. This standard does not itself produce certification. According to a certification body's review, the 2026 edition expands guidance on remote audits and virtual locations.
Organizations certified to ISO 9001:2015 need to transition to the 2026 edition in line with their certification cycle. Ask your certification body for the schedule. ISO 9001 criteria and checklists are covered in ISO 9001 audit. For other standards, read Environmental audit and Information Systems audit, as well as combined audit when several standards are audited at once.
Is an ISO Internal Audit Mandatory?
The answer depends on the context. There are three levels:
- Requirement of the standard. For organizations that implement an ISO management system standard, an internal audit at planned intervals is a requirement of the standard.
- Applying ISO is voluntary. ISO and SNI are basically voluntary unless made mandatory by a regulator, and certification is the organization's choice. See the explanation from BSN on the application of SNI.
- SMK3 is regulated by law. SMK3 internal audits have their own regulatory basis, covered in the SMK3 section below.
This article does not cover other sector-specific obligations.
What Is the Purpose of ISO Internal Audit?
According to the text of the ISO harmonized structure, an internal audit provides information on the condition of the management system. Its main objectives:
- Assess conformity of the management system with the organization's own requirements and the requirements of the standard.
- Assess whether the system is implemented and maintained effectively.
- Provide input for management review and system improvement.
- Identify nonconformities so that the organization follows up with corrective action. Learn about follow-up on audit findings.
Business benefits such as competitive advantage come from a well-functioning management system. The internal audit provides information to improve it.
What Are the Types of ISO Internal Audit?
By Who Performs the Audit
The ISO harmonized structure distinguishes first-party audits, that is internal audits, from external audits carried out by second or third parties.
| Types | Executor | Example of |
|---|---|---|
| First party | The organization itself or another party on its behalf | ISO internal audit |
| Second party | A party with an interest in the organization | For example, a supplier audit by a customer |
| Third parties | An independent party outside the organization | For example, a certification audit by a certification body |
By Scope (Common Practice)
In practice, internal audits are often divided by scope. This division is commonly used, but it is not an official ISO classification.
- System Audit: assesses the management system as a whole, including whether the requirements of the standard have been implemented across all parts of the system.
- Process Audit: analyzes a specific process, whether it runs as planned and achieves the intended results. This audit suits high-risk processes and helps identify improvement opportunities.
- Product Audit: verifies conformity of the product at the design, production, and delivery stages against the specified requirements, such as dimensions, function, and packaging.
What Is the Difference Between an ISO Internal Audit, a Certification Audit, and a Corporate Internal Audit?
| Aspect | ISO internal audit | ISO certification audit | Corporate internal audit function |
|---|---|---|---|
| Executor | The organization itself or another party on its behalf | Certification body (third party) | The organization's internal audit unit |
| Focus | Conformity and effectiveness of the management system | Conformity of the system with the standard for certification | Governance, risk management, and control |
| Criteria | The organization's requirements and the standard | Standards | Internal audit professional standards and regulations |
| Results | Findings reported to the relevant managers | Basis for the certification decision by the certification body | Report to management and the board |
The corporate internal audit function is covered in what internal audit is. A broader comparison is available in differences between internal and external audit.
What Are the Requirements for a Good ISO Internal Audit?
For the results to be useful, an internal audit needs to meet the following three criteria, which are in line with the internal audit text of the ISO harmonized structure.
1. Systematically scheduled
Internal audits are conducted at planned intervals within an audit program. The company needs to provide adequate resources, including the auditor team, time, and budget.
2. Be Independent
Auditors are selected so that the audit process is objective and impartial, for example by not auditing their own work (common practice). Auditor competence requirements refer to ISO 19011 and organizational policy. Read requirements to become an internal auditor.
3. Well documented
The organization retains documented information as evidence of the implementation of the audit program and of audit results. Evidence can take the form of observations, measurement results, tests, or other relevant and measurable means. Learn about audit evidence.
What Are the Steps for Conducting an ISO Internal Audit?
Here are the steps for carrying it out. This flow is common practice, while the standard sets requirements for the audit program and reporting.
1. Planning Audit Schedule
A clear schedule helps every department understand that the audit aims to drive improvement, not to find fault. The parties involved also have time to prepare before the audit is carried out.
The standards do not set a number of audits per year. The organization sets the frequency in the audit program, considering the importance of the processes and the results of previous audits. Objectives, criteria, and scope are set for each audit. See audit planning and internal audit work program.
2. Plan The Audit Process
The audit process involves auditor team and auditee (the audit object), so communication during planning is important. Good collaboration makes the audit run smoothly. Prepare a checklist per standard; examples are available in internal audit checklist examples.
3. Menguasai Ms. Office
The audit starts with a meeting between the auditor and the auditee. The auditor collects data through interviews, direct observation, and review of relevant documents.
4. Reporting Audit Findings
Audit results are reported to the relevant managers. The auditee learns which aspects do not yet conform, and the auditor then prepares a formal report of findings. Learn about audit report.
5. Implement Improvement Recommendations
The organization responds to nonconformities: controlling and correcting them, investigating causes, and then implementing corrective action. Monitoring follow-up helps ensure improvements are actually carried out by the relevant departments.
What About SMK3 Internal Audits (Government Regulation 50/2012)?
SMK3 is an OHS management system under Indonesian law, different from ISO 45001, which is a voluntary standard. Government Regulation 50/2012 Article 14 requires employers to monitor and evaluate OHS performance, among others through internal SMK3 audits by competent personnel, and the results are used for corrective action. The obligation to implement SMK3 applies to companies with at least 100 workers or a high hazard potential (Article 5). Full guidance is available in SMK3 audit.
Examples Of Internal Audit Questions
For those who want to carry out an internal audit in their company, here are sample questions that can be used as a reference.
- What are your roles and responsibilities in the quality management process?
- What training is provided to new employees to ensure they understand quality standards?
- What measures are taken to guarantee that the products produced meet the specified specifications?
- Do you note any pattern of non-conformance on the product? If so, what steps are being taken to address it?
- To what extent do employees understand the company's quality-related policies and objectives?
- How has the number of complaints from customers developed over time?
- What tools or methods do you use to analyze the causes of the complaints received?
- How are the results of improvements and achievements conveyed to all employees?
How Does Software Help with ISO Internal Audits?
Audithink is customizable internal audit management software. For ISO internal audits, the relevant features are risk assessment to set priorities, audit planning to prepare schedules and programs, work program templates to prepare checklists per standard, notifications for schedule and deadline reminders, follow-up monitoring to track the correction of findings, and automatic reports. The software helps manage the process, while the audit is still carried out by auditors. For the education context, read internal quality audit application.
FAQ About Internal ISO Audits
What is an internal ISO audit?
A first-party audit of a management system, carried out by the organization itself or by another party on its behalf. The process is systematic and independent, to assess whether the system conforms to the organization's requirements and ISO standards and is effectively implemented.
Is an ISO internal audit mandatory?
For organizations that implement an ISO management system standard, an internal audit is a requirement of the standard. Applying and certifying to ISO itself is voluntary unless a regulator makes it mandatory. For OHSMS (SMK3), Government Regulation 50/2012 requires OHS performance evaluation, including through internal audits.
What is the difference between an ISO internal audit and a certification audit?
An ISO internal audit is carried out by the organization itself or by another party on its behalf. A certification audit is carried out by a certification body as a third party to assess conformity of the system with the standard for the purpose of certification.
Which ISO standards require an internal audit?
Management system standards that use the ISO harmonized structure, such as ISO 9001, ISO 14001, ISO 45001, and ISO/IEC 27001, require the organization to conduct internal audits at planned intervals.
How often are internal ISO audits conducted?
The standards do not set a number of audits per year. The organization sets the frequency in the audit program, considering the importance of the processes and the results of previous audits.
Who can be an ISO internal auditor?
Auditors are selected so that the audit process is objective and impartial. Competence requirements refer to ISO 19011 and organizational policy.
Is ISO 9001:2015 still valid?
According to iso.org as of 13 October 2026, ISO 9001:2015 has been withdrawn and replaced by ISO 9001:2026, published on 16 September 2026. Ask your certification body about the certificate transition schedule.
What is the difference between an ISO internal audit and an SMK3 audit?
An ISO internal audit assesses a management system against voluntary ISO standards. An SMK3 internal audit is based on Government Regulation 50/2012 and is part of the OHS performance evaluation required of certain companies.
Conclusion
An ISO internal audit is a first-party audit that helps an organization find out whether its management system conforms to requirements and works effectively. In standards that use the ISO harmonized structure, this audit is a requirement of the standard.
With a planned audit program, objective auditors, and follow-up of findings, internal audits support continuous improvement. To see how Audithink helps with this process, Contact us for a free demo.
