Prepare thoroughly for an internal audit with a clear scope, sampling, evidence and follow-up.
Define the purpose, scope and criteria
An audit does not have to cover every detail every year. Create a risk-based programme and decide which processes, locations, standards and previous findings each audit will examine.
Communicate expectations in good time, without turning the audit into a rehearsed presentation.
- audit purpose and scope
- applicable standard, legal and internal requirements
- auditor and required independence
- schedule, interviewees and sampling
- reporting and follow-up arrangements
Prepare evidence without staging a performance
Make policies, records, decisions and operational evidence easy to find. Select examples from normal operations: access reviews, changes, incidents, supplier assessments and recovery tests.
Do not retrospectively fix records. Missing evidence provides valuable information about a process and can lead to improvement.
Conduct the audit carefully
Ask open questions, trace data flows and check a representative sample. Distinguish between incidents, observations, nonconformities and opportunities for improvement using the agreed audit method.
Follow up findings until the actions work
A quick fix is not always a corrective action. Investigate why the nonconformity arose, choose an action that prevents recurrence and assess its effectiveness later.
Report outstanding risks and overdue actions to the appropriate owner and, where necessary, management.
Frequently asked questions
Can someone audit their own work?+
The auditor must be sufficiently objective and independent of the work being examined.
Does an internal audit have to check everything?+
No. Use a multi-year, risk-based programme that provides sufficient coverage overall.
How does it differ from an external audit?+
An internal audit supports self-assessment and improvement; an external auditor assesses from an independent external position.
Sources and further reading
We prioritise primary sources for factual and time-sensitive information. Always check the current official publication when making important decisions.
- ISO: official informationAccessed on 1 August 2026
Related articles
This is general guidance and does not replace a legal assessment or the official standard.