{"id":3433,"date":"2024-10-29T15:55:44","date_gmt":"2024-10-29T08:55:44","guid":{"rendered":"https:\/\/audithink.com\/?p=3433"},"modified":"2026-10-13T13:23:31","modified_gmt":"2026-10-13T06:23:31","slug":"iso-internal-audit","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/audit-internal-iso\/","title":{"rendered":"ISO Internal Audit: Definition, Standards Basis, and Steps"},"content":{"rendered":"

An ISO internal audit is an audit that an organization carries out on its own management system. ISO management system standards, such as ISO 9001 for quality, ISO 14001 for the environment, ISO 45001 for occupational health and safety (OHS), and ISO\/IEC 27001 for information security, require the organization to conduct internal audits at planned intervals.<\/p>\n\n\n\n

This article explains the definition, the standards basis, whether this audit is mandatory, its types, requirements, and steps. Information on standard editions refers to the iso.org pages as of 13 October 2026.<\/p>\n\n\n\n

What is ISO Internal Audit?<\/h2>\n\n\n\n
\"ISO
Source: Freepik<\/figcaption><\/figure>\n\n\n\n

An ISO internal audit is a first-party audit of a management system: a systematic and independent process of obtaining evidence and evaluating it objectively, to assess whether the system conforms to the organization's requirements and ISO standards and is implemented and maintained effectively.<\/p>\n\n\n\n

An internal audit is carried out by the organization itself or by another party on its behalf. The results are reported to the relevant managers, and the organization then responds to nonconformities, investigates their causes, and implements corrective action. Compliance with laws and regulations is a separate topic, covered in a compliance audit<\/a>.<\/p>\n\n\n\n

The term ISO audit can mean an internal audit by the organization itself, or a certification audit by a certification body. The difference is covered below.<\/p>\n\n\n\n

One term, two meanings.<\/strong> The term internal audit is also used for the corporate internal audit function that reports to the board of directors and board of commissioners, and for internal quality audits at universities. This page covers internal audits of ISO management systems. For the corporate internal audit function, read what internal audit is<\/a>. For universities, read internal quality audit<\/a>.<\/p>\n\n\n\n

Which Standards Are the Basis for an ISO Internal Audit?<\/h2>\n\n\n\n

The table below summarizes standard editions according to the iso.org pages as of 13 October 2026.<\/p>\n\n\n\n

Standards<\/th>Focus<\/th>Current edition<\/th><\/tr><\/thead>
ISO 9001<\/td>Quality management system<\/td>ISO 9001:2026<\/a> (published 16 September 2026). ISO 9001:2015 has been withdrawn.<\/td><\/tr>
ISO 14001<\/td>Environmental management system<\/td>ISO 14001:2026 (published April 2026). The 2015 edition has been withdrawn.<\/td><\/tr>
ISO 45001<\/td>OHS management system<\/td>ISO 45001:2018<\/a>. A revision is planned and has not yet been published.<\/td><\/tr>
ISO\/IEC 27001<\/td>Information security management system<\/td>ISO\/IEC 27001:2022<\/a><\/td><\/tr>
ISO 19011<\/td>Guidelines for auditing management systems, not a certification standard<\/td>ISO 19011:2026<\/a> (published May 2026). The 2018 edition has been withdrawn.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

In management system standards that use the ISO harmonized structure, the internal audit sits in clause 9.2, under performance evaluation. It covers: audits at planned intervals, an audit program, criteria and scope for each audit, auditors who are objective and impartial, and results reported to the relevant managers. Clause numbers may differ between editions, so check the text of the standard you hold.<\/p>\n\n\n\n

ISO 19011 provides guidance on managing an audit program, conducting audits, and auditor competence. This standard does not itself produce certification. According to a certification body's review, the 2026 edition expands guidance on remote audits and virtual locations.<\/p>\n\n\n\n

Organizations certified to ISO 9001:2015 need to transition to the 2026 edition in line with their certification cycle. Ask your certification body for the schedule. ISO 9001 criteria and checklists are covered in ISO 9001 audit<\/a>. For other standards, read Environmental audit<\/a> and Information Systems audit<\/a>, as well as combined audit<\/a> when several standards are audited at once.<\/p>\n\n\n\n

Is an ISO Internal Audit Mandatory?<\/h2>\n\n\n\n

The answer depends on the context. There are three levels:<\/p>\n\n\n\n

    \n
  1. Requirement of the standard.<\/strong> For organizations that implement an ISO management system standard, an internal audit at planned intervals is a requirement of the standard.<\/li>\n\n\n\n
  2. Applying ISO is voluntary.<\/strong> ISO and SNI are basically voluntary unless made mandatory by a regulator, and certification is the organization's choice. See the explanation from BSN<\/a> on the application of SNI.<\/li>\n\n\n\n
  3. SMK3 is regulated by law.<\/strong> SMK3 internal audits have their own regulatory basis, covered in the SMK3 section below.<\/li>\n<\/ol>\n\n\n\n

    This article does not cover other sector-specific obligations.<\/p>\n\n\n\n

    What Is the Purpose of ISO Internal Audit?<\/h2>\n\n\n\n

    According to the text of the ISO harmonized structure, an internal audit provides information on the condition of the management system. Its main objectives:<\/p>\n\n\n\n