Internal Auditor ISO 9001 – online training

18 modules · about 89 minutes · final test with 25 questions, 20 correct to pass · certificate of participation as PDF

What this course is about

Whoever conducts internal audits under ISO 9001 needs evidence of competence for it: clause 9.2 of the standard requires an audit programme, defined criteria and auditors who ensure objectivity and impartiality; clause 7.2 requires documented information as evidence of competence.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 18

Basics: what an internal audit is — and what it is not

According to ISO 9000 an audit is a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Behind the definition is something very practical:

• Stocktaking of the current situation — how is work actually done today?
• Review of processes and documents against the requirements (standard, own rules, customer requirements)
• Sample — not everything can be checked; the auditor selects and says what he has seen
• Uncover improvement potential and nonconformities before a customer or the certification body finds them
• At planned intervals — in practice every area at least once a year
• Never audit your own work

The three audit types

This course covers the first-party audit: the internal audit under ISO 9001. Much of it also applies to supplier audits.

The three objectives of the internal audit

1. Conformity check: does the QMS meet the requirements of the standard and the company's own requirements?
2. Effectiveness check: are the quality objectives achieved — does the system work, or is it only on paper?
3. Improvement: where is there potential for optimisation? What works well and can be a model for other areas?

To remember

An audit is not a search for the mistakes of employees. It checks processes and the system, not people. Whoever says this clearly at the start of every interview gets honest answers — and finds more.

Module 2 of 18

The normative frame: ISO 9001 clause 9.2, ISO 19011 — and the outlook on ISO 9001:2026

Two documents carry the internal audit. One requires, the other explains how.

ISO 9001:2015, clause 9.2 — the requirement

“The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system conforms to the organization's own requirements and the requirements of this International Standard, and is effectively implemented and maintained.” (in substance, clause 9.2.1)

Clause 9.2.2 names what the organisation shall do for it:

The standard names no fixed frequency (“at planned intervals”) and no form of training for auditors — it requires competence (clause 7.2) and impartiality. The practice of certification bodies: every area and every clause of the standard at least once in the certification cycle, as a rule a complete internal audit annually.

ISO 19011:2018 — the guideline

ISO 19011 is not a requirements document but a guideline: it contains recommendations on audit principles (clause 4), managing an audit programme (clause 5), conducting an audit (clause 6) and the competence of auditors (clause 7). You cannot be certified to ISO 19011 — but whoever works according to it fulfils clause 9.2 of ISO 9001 professionally. The current edition is 2018; it replaced the 2011 edition and added, among other things, the risk-based approach as an audit principle and notes on remote audits.

Outlook: ISO 9001:2026

The revision was published on 16 September 2026 as ISO 9001:2026. Clause 9.2 remains in content; new in the auditor's field of view are the topics climate change in the context of the organisation, quality culture and ethical behaviour and the sharpened separation of risks and opportunities. Certificates to ISO 9001:2015 remain valid during the transition period — 36 months from publication, i.e. expected until 30 September 2029. Binding dates are given by your own certification body.

To remember

ISO 9001 clause 9.2 says that and what, ISO 19011 says how. Whoever is asked why he audits the way he audits has the right answer with “according to ISO 19011”.

Module 3 of 18

The seven audit principles under ISO 19011:2018

ISO 19011:2018 puts seven principles before all auditing activity (clause 4). They are the yardstick against which an auditor must let himself be measured — and the best argument when an auditee questions the approach.

The seventh principle was added with the 2018 edition. It links the audit with the risk-based thinking of ISO 9001: an audit programme that allocates the same time to every process every year is not risk-based.

What the principles mean for you

• You report what you have seen — not what you suspect.
• You name positives just like nonconformities (fair presentation).
• You pass on nothing from the audit that does not belong in the report.
• You decline an audit assignment if you are responsible for the area yourself or have worked there.

To remember

Seven principles — and speed is not one of them. An audit that races through the checklist in record time violates due professional care and finds nothing.

Module 4 of 18

Competence and independence of the internal auditor

ISO 9001 requires that auditors are selected so that objectivity and impartiality of the audit process are ensured — and that they are competent (clause 7.2). ISO 19011 clause 7 describes what this competence consists of.

Four fields of competence

Independence in concrete terms

An auditor may never audit his own area of work. This also applies to areas he supervises technically, whose results he is responsible for or where he worked until recently. In small companies this is solved as follows:

• Cross-auditing: sales audits production, production audits sales.
• The quality manager audits everything — except the QMS itself; management or an external auditor takes that over.
• External internal auditor: a consultant conducts the internal audit on behalf of the organisation — it remains a first-party audit.

How competence is demonstrated

The standard prescribes no particular training. Usual and recognised by certification bodies: a documented training course (like this one), participation in audits under guidance, entry in the qualification matrix and regular evaluation by the person managing the audit programme (ISO 19011, 7.6).

To remember

Competence is knowledge plus skill plus behaviour. The certificate proves the knowledge. The skill comes from the first accompanied audit, the behaviour from every further one.

Module 5 of 18

The audit programme: annual planning with management

Before the first audit takes place, the frame is needed: the audit programme. ISO 9001 requires it explicitly (clause 9.2.2 a), ISO 19011 devotes a whole clause to it (clause 5).

Two planning levels

Involve the management level

The audit programme is a matter for management — not only for the quality manager. A short preliminary talk with the managing director has proven itself:

• Ask about objectives: what should the audit achieve this year? Where does the shoe pinch?
• Set priorities: new processes, complaint hotspots, staff changes
• Present the benefit: economic efficiency, image with the customer, recognising risks early
• Make managers participants — as experts for their area, not as examinees

Plan risk-based

Important topics are audited more intensively and more often. Critical processes, areas with frequent nonconformities, new employees, changed procedures and open actions from the last audit get more time. A process that ran three years without a finding may get less — but it may not be dropped from the cycle entirely.

Example: audit programme as a multi-year matrix

Mandatory elements under clause 9.2.2: frequency, methods, responsibilities, planning requirements and reporting — and consideration of the importance of the processes, of changes and of the results of previous audits.

To remember

The audit programme answers the certification body's question: “Show me that in three years every clause of the standard and every area was audited internally once.” Without a matrix that cannot be answered.

Module 6 of 18

The audit plan for the single audit

From the audit programme an audit plan is made for each single audit. ISO 9001 requires that audit criteria and scope are defined per audit (clause 9.2.2 b); ISO 19011 clause 6.3.2 describes the plan in detail.

Content of an audit plan

On site or remote?

ISO 19011 treats both forms as equivalent (Annex A.1); what matters is that the audit objectives can be achieved with the chosen method. A walk-through of production can be replaced by video only to a limited extent.

Communicate in good time

The audit plan goes to all participants at least two weeks in advance — a practical rule, not a deadline of the standard. It gives the interview partners time to get evidence ready and keep appointments, and takes the ambush character out of the audit. Whoever postpones at short notice keeps the plan up to date and informs again.

To remember

An audit plan without criteria is a list of appointments. Only “clause 7.2 using the qualification matrix and three training records” makes it an audit.

Module 7 of 18

Audit preparation: announced or unannounced, who is sitting opposite me?

Good audits are won at the desk. Three questions in advance decide quality and atmosphere.

Announced or unannounced?

Decision aid: is it the first audit in this area? Is the person new? Were there incidents, conflicts, complaints? If yes — always announce. Unannounced samples make sense with experienced teams and well-practised routine processes, never as an ambush of newcomers.

Who is my interview partner?

• Do I already know the person? What character, what experience does he or she have?
• In which department does the person work — which clauses of the standard can I check there at all?
• Is the person new to the company? Has he or she already been through an audit?
• What must my interview partner know beforehand — purpose, duration, documents needed?

Preparation checklist

1. Check previous audit results — which actions are open, which should be effective?
2. Look through process documents, procedures, KPIs of the area (ISO 19011, 6.3.1)
3. Recapitulate the clauses of the standard that are in the audit plan
4. Prepare the question catalogue — as a memory aid, not as a script
5. Agree the date, send the audit plan, clarify room and technology
6. Inform the interview partner: purpose, procedure, no evaluation of persons

To remember

The first question of every preparation is: what became of the last audit? Whoever does not follow up open actions devalues every future audit.

Module 8 of 18

Conducting the audit: the five phases and the audit interview

ISO 19011 clause 6.4 describes the conduct step by step. For practice five phases suffice:

In an internal audit in a small company the opening meeting can take two minutes — it should not be omitted. It sets the tone.

Tips for the audit interview

What auditors do wrong

• Stubbornly by checklist — the auditee is just talking about a real problem, the auditor asks the next line.
• Only looking for errors — strong performance goes unmentioned, the area experiences the audit as punishment.
• Not looking at evidence — “Yes, we have that” is an assertion, not evidence.
• Dictating solutions — the auditor finds, the area decides on the action.

To remember

Work out solutions together, do not just look for errors. Acknowledge strong performance — in the interview and in the report. That is not a tip on being nice but the principle of fair presentation.

Module 9 of 18

Audit methods: TOP/FLOP, auditing backwards, deputies, turtle

Whoever always asks the same questions always gets the same answers. Four methods from practice bring movement into the audit — all are variants of the sampling that ISO 19011 describes in Annex A.6.

Four methods

The turtle method for process analysis

The “turtle” lays out a process in six fields — exactly the elements that ISO 9001 clause 4.4.1 requires for every process:

With the turtle every process can be audited in a structured way in 20 minutes — and the auditee notices that it is about his process, not about paragraphs of the standard.

To remember

Auditing backwards is the sharpest method: a delivery note from last week, and in 15 minutes you know whether inspection, release, purchase order and quotation are documented.

Module 10 of 18

Questioning techniques and active listening

The audit is a conversation in which the auditee talks and the auditor listens, asks follow-up questions and checks. ISO 19011 Annex A.17 gives guidance on interviews; practice has made clear rules of it.

The golden rule: 80/20

80 % the auditee talks, 20 % the auditor. An auditor who talks more explains the standard instead of checking whether it is practised.

The five question types

The most important W-questions

• WHO is responsible? Who is the deputy?
• WHAT are the inputs and outputs?
• HOW is the process carried out?
• WHEN is it done — and how often?
• WHERE does it take place, where is it documented?
• WITH WHAT is the work done — which tools, measuring equipment, software?
• “CAN YOU SHOW ME …?” — the most important question: it fetches the evidence.

Caution with “Why?”: too many why-questions feel like an interrogation and trigger justification. Better: “For what reason is that laid down this way?”, “What was the occasion for this rule?”

Active listening

• Keep eye contact — do not stare at the laptop
• Do not interrupt, let the person finish; endure pauses
• Paraphrase: “If I understand you correctly, …”
• Take notes — openly, not secretly
• Ask in case of ambiguity instead of interpreting

To remember

Every interview ends positively: acknowledge strong performance, summarise results, say thank you. Whoever leaves the audit with a good feeling comes to the next one with open documents.

Module 11 of 18

Practice audit questions I: context, objectives, competence, documented information

A certification auditor asks these questions in practically every audit — and that is exactly why they belong in every internal audit. On every topic the auditor has documents shown as evidence. The compilation comes from more than 1,000 audits conducted.

Statutory and regulatory requirements (clause 4.2)

• Which statutory requirements apply to your company? Which regulatory ones?
• Does your customer require you to work to particular standards?
• Which further rules apply (e.g. chemical regulations such as REACH in the EU, product safety, sector rules)?
• How do you ensure that you work to currently valid requirements?

Evidence: legal register / list of standards, update note, customer requirements.

Quality objectives (clause 6.2)

• Were company and quality objectives defined — measurable, with a date?
• Which actions lead to the objectives? Who is responsible?
• Are there further documents on it (budget plan, KPI sheet)?
• Are the objectives known to the employees — at least those that concern them?

Evidence: quality objectives document, action plan, KPIs, management review.

Training and competences (clause 7.2)

• How do you plan training? How do you know that a training course was effective — or poor?
• Is there an overview of the qualifications of your employees?
• Which skills does someone need for this activity?
• How are new employees inducted?

Evidence: training plan, qualification matrix, training records, induction plan, evaluation of effectiveness.

Documents and records (clause 7.5)

• What happens with outdated documents? How are documents controlled and approved?
• Where are the retention periods laid down?
• Do the employees know the quality manual or the process descriptions that apply to them?

Evidence: document list with revision status, retention rule, example of a controlled work instruction at the workplace.

To remember

Every question comes with a “Please show me …”. The answer “We do that” is the beginning of the conversation, not the end.

Module 12 of 18

Practice audit questions II: operation, suppliers, customer satisfaction, QMS in general

Part II of the questions that always come. Again: every question ends with evidence.

Production and service provision (clause 8)

• How do employees notice that they have to pay attention to something special in an order?
• What happens with internal errors and defective products (clause 8.7)? Is the cost of poor quality recorded?
• Does your customer provide material, tools or data — how is customer property protected (clause 8.5.3)?
• Is there an incoming goods inspection — what does it look like, who decides in case of deviations?
• How are machines, vehicles, measuring equipment maintained? Are there maintenance plans or contracts (clauses 7.1.3, 7.1.5)?

Evidence: order documents with special features, defect list / quarantine area, goods receipt record, maintenance plan.

Suppliers (clause 8.4)

• Which suppliers are there — which are quality-relevant?
• Have you prepared a supplier evaluation? By which criteria, how often?
• Were there problems with a supplier recently? What was done to improve?

Evidence: supplier list, evaluation, complaints to suppliers.

Customer satisfaction (clause 9.1.2)

• How do you determine customer satisfaction? — this question comes in every audit
• Do you prepare an evaluation of it? Did actions have to be initiated?
• How do you communicate with your customers — also in case of complaints?

Evidence: customer survey or equivalent method (complaint rate, repeat purchase rate, conversations), evaluation, complaint list, action plan.

General questions on the QMS

• Are responsibilities defined (clause 5.3)? Are the tasks of the quality manager defined?
• Was an internal audit carried out across the whole company (clause 9.2)?
• Have you prepared a management review (clause 9.3)?
• Are there regular meetings? How do employees learn important things (clause 7.4)?

To remember

Three pieces of evidence the certification body wants to see in every audit: internal audit, management review, customer satisfaction. Whoever checks them in the internal audit has no surprise in the external one.

Module 13 of 18

Classifying and wording findings and nonconformities correctly

Evidence becomes findings (ISO 19011, 6.4.8): the auditor compares what he has seen with the audit criteria. The result is conformity — or not.

Types of findings

ISO 9001 and ISO 19011 know only the term nonconformity (ISO 9000: non-fulfilment of a requirement). The division into major and minor comes from the rules for certification bodies (ISO/IEC 17021-1) — internally you may adopt it but do not have to. What matters is that the categories are used consistently in the company.

A finding has three elements

1. WHAT was found? — the concrete, verifiable evidence (document, date, sample)
2. AGAINST WHAT does it offend? — clause of the standard or internal requirement
3. WHAT IMPACT does it have? — the risk for customer, product, system

The good finding names the sample (3 of 5), the evidence (training plan 2026), the reference to the standard (clause 7.2) and the impact. It is verifiable — and it accuses nobody.

Clarify findings in the interview

Every finding is told to the auditee before the closing meeting and the evidence is looked at together. Unresolved differences of opinion go into the report with both views (fair presentation).

To remember

Evidence — reference to the standard — impact. If one is missing, it is an opinion, not a finding.

Module 14 of 18

The audit report

The audit report is the only lasting result of the audit. It goes to relevant management (ISO 9001, 9.2.2 d), feeds the management review (clause 9.3.2) and is the evidence the certification body wants to see.

What the audit report contains (ISO 19011, 6.5.1)

An internal audit report comprises 2 to 4 pages: for a two-hour audit in a small company two are enough, for a full-day system audit across all processes it is more like four. Length is not a quality feature — verifiability is.

Rules for the report

• No surprises: everything in the report was said in the closing meeting.
• No evaluation of persons: processes and evidence are in the report, no grades for employees.
• Prompt: within the agreed period, in practice within one to two weeks (ISO 19011, 6.5.2).
• Actions always with date and responsible person — the area defines the action, the auditor later checks the effectiveness.
• Retain: programme, plans, reports and action tracking are documented information (clause 9.2.2 f); usual is retention over at least one certification cycle (three years).

To remember

A report without date and responsible person for every action is not a report but minutes. The certification body asks first for exactly this column.

Module 15 of 18

Follow-up: corrective actions and effectiveness check

The audit does not end with the report. ISO 9001 requires corrections and corrective actions without undue delay (clause 9.2.2 e) and describes in clause 10.2 how: react — evaluate the cause — implement the action — review effectiveness.

Correction is not corrective action

Whoever only corrects finds the same nonconformity again in the next audit.

The PDCA cycle as frame

Organise follow-up

• Clarify responsibility: who tracks the actions — quality manager, auditor, management? With which list?
• Check effectiveness — after three months. Before that the action is implemented but not proven. The check can take place in the follow-up audit or as a separate appointment (ISO 19011, 6.7).
• If actions are not implemented: determine the reasons — lack of time, wrong responsibility, action unsuitable? That is a new finding, not a question of blame.

When is an action closed?

Not when it has been implemented. Not when the auditor is satisfied. But when effectiveness has been demonstrated (clause 10.2.1 d):

• Is the problem really fixed?
• Does the nonconformity no longer occur — also in the sample?
• Is the action sustainable — anchored in the process, not dependent on one person?

To remember

If nothing happens after the audit, “audit” and “QM” lose their meaning in the company. Follow-up is the part where you can tell whether a company takes its QMS seriously.

Module 16 of 18

Practice case: internal audit in purchasing — from preparation to effectiveness check

The situation: metalworking company, 18 employees. Ms B., head of sales and trained internal auditor, audits purchasing (head: Mr K.). Audit programme 2026: purchasing with clause 8.4, focus supplier evaluation — in the last certification audit there was an observation on it.

Preparation

Ms B. reads the audit report 2025 (observation: supplier evaluation without criteria), the process description “Procurement” and the supplier list. Audit plan: Tuesday, 9:00–11:00, criteria clause 8.4 and process description, method: auditing backwards on two goods receipts of last week. The plan goes to Mr K. two weeks in advance — with the request to have the supplier list and evaluation ready.

Conduct

Opening (3 minutes): “I am checking the procurement process, not your work. Everything we discuss comes on the table before it goes into the report.”

Auditing backwards: delivery note steel profiles of 14 October → incoming goods inspection documented, release by Mr K. ✓ → purchase order with specification ✓ → supplier “Müller Steel” on the supplier list ✓ → supplier evaluation 2026: for 2 of 6 quality-relevant suppliers no evaluation available, for the other four without date.

Ms B. asks openly: “How does the evaluation work with you?” — Mr K.: “I know my suppliers, I notice problems immediately.” — “Can you show me where that is recorded?” — There is an Excel list, last updated in 2024.

TOP/FLOP: Ms B. has one smooth and one problematic order shown. For the FLOP (delivery delay, powder coater) a complaint was made but not entered in the evaluation.

Evaluation and finding

Finding (minor nonconformity): for 2 of 6 quality-relevant suppliers no evaluation is available; the evaluations of the other suppliers date from 2024, criteria are not defined (clause 8.4.1: determine and apply criteria for evaluation, selection and monitoring of performance). Impact: delivery problems (case powder coater) do not flow into supplier selection — risk for on-time delivery to customers.

Positive: incoming goods inspection documented without gaps, purchase orders with complete specification, complaint to supplier verifiable.

Why minor and not major? The process exists and works at its core (goods receipt, complaint); the nonconformity concerns a partial aspect, not the effectiveness of the system. Why not a mere recommendation? Clause 8.4.1 explicitly requires criteria and evaluation — that is a requirement, not an option.

Closing meeting and report

Ms B. first names the strengths, then the finding, shows the Excel list. Mr K. himself proposes: define evaluation criteria (on-time delivery, quality, response to complaints), evaluate annually in January, enter complaints immediately. Action: Mr K., by 30 November 2026. The report goes to management on Thursday — two pages.

Effectiveness check

At the beginning of March 2027 — around three months after the date — Ms B. checks the new evaluation: 6 of 6 suppliers with criteria and date, the complaint from October is entered. Action closed — effective, not just implemented. The management review 2027 takes up the result.

To remember

The whole course in one case: programme → plan → auditing backwards → open question and “show me” → finding with evidence, reference to the standard, impact → action with date → check effectiveness after three months.

Module 17 of 18

Procedure in our company

Your company completes this module. The general part of the training ends here — how internal audits actually run in your company, only your company knows.

This information belongs in it:

For management

The independence rule is the point that most often remains unclear in a small company. Lay down in writing who audits whom — and who checks the QMS itself when the quality manager built it.

Module 18 of 18

Records: auditor competence and audit evidence

Finally, what makes this training an evidence — and what the certification body wants to see on the topic of internal audits.

Evidence of auditor competence (clause 7.2)

ISO 9001 requires documented information as evidence of competence. For internal auditors that means in practice:

• Training certificate — this certificate with date, contents and result
• Entry in the qualification matrix or in the training plan: “internal auditor ISO 9001”
• optional: participation in an audit under guidance, evaluation by the person managing the audit programme (ISO 19011, 7.6)
• Refresher: the standard names no period. Usual is a refresher at a revision of the standard (ISO 9001:2026!), after a longer break and at the latest every three years.

A certificate alone does not make an auditor — but without a certificate or equivalent evidence the certification body lacks the basis to recognise the competence.

Evidence of the audit programme (clause 9.2.2 f)

What is on this certificate

Name, course, date, result, the complete list of training contents with reference to the standard and a verifiable certificate number. This makes the evidence what an auditor would demand himself: verifiable.

To remember

The certification body asks two questions: “Who carried out the internal audit — and how do you demonstrate his competence?” Certificate plus qualification matrix answer both.

Final test

25 questions, one correct answer each. You need 20 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result