Prepare thoroughly for an internal audit with a clear scope, sampling, evidence and follow-up.
Define the purpose, scope and criteria
Determine the frequency and coverage based on the applicable standard, risks, changes and previous findings. Create a risk-based programme and decide which processes, locations and areas each audit will examine.
Communicate expectations in good time, without turning the audit into a rehearsed presentation. Explore our internal audit support if you need help with preparation or delivery.
- audit purpose and scope
- applicable standard, legal and internal requirements
- auditor and required independence
- schedule, interviewees and sampling
- reporting and follow-up arrangements
Prepare evidence without staging a performance
Make policies, records, decisions and operational evidence easy to find. Select examples from normal operations: access reviews, changes, incidents, supplier assessments and recovery tests.
Do not retrospectively fix records. Missing evidence provides valuable information about a process and can lead to improvement.
Conduct the audit carefully
Ask open questions, trace data flows and check a representative sample. Distinguish between incidents, observations, nonconformities and opportunities for improvement using the agreed audit method. ISO 19011:2026 provides guidelines for developing audit programmes and conducting management system audits.
Follow up findings until the actions work
A quick fix is not always a corrective action. Investigate why the nonconformity arose, choose an action that prevents recurrence and assess its effectiveness later.
Report outstanding risks and overdue actions to the appropriate owner and, where necessary, management. With the Compliance Tool you can record findings and assign follow-up tasks to the people responsible.
Frequently asked questions
Can someone audit their own work?+
The auditor must be sufficiently objective and independent of the work being examined.
Does an internal audit have to check everything?+
Determine the frequency and coverage based on the applicable standard, risks, changes and previous findings. Document how the audit programme will achieve the required coverage.
How does it differ from an external audit?+
An external consultant can carry out your internal audit. This does not make it a certification audit. For certification, a certification body assesses the management system and decides whether to issue the certificate.
Sources and further reading
We prioritise primary sources for factual and time-sensitive information. Always check the current official publication when making important decisions.
- ISO: ISO 19011:2026 — guidelines for auditing management systemsAccessed on 20 September 2026
- ISO: ISO/IEC 27001 and information security managementAccessed on 1 August 2026
Related articles
This is general guidance and does not replace a legal assessment or the official standard.