An internal audit program is not a schedule. It is the only process in your management system whose output is findings about every other process — which means its maturity sets a ceiling on how fast anything else improves. This QuickStart lists the decisions that build that program, in the order that lets each one build on the last, so the audit layer is stood up deliberately rather than reconstructed before each surveillance visit.
Seven to eight pages, twenty-nine to thirty-three decisions, five stages.
Name the people. Build the program. Define a single audit. Decide what a finding is. Set the records and the rhythm. Each stage depends on the one before it, and skipping ahead is the usual reason an audit program finds paperwork problems and misses process problems.
A route through the SOP-009 Internal Audit procedure — not a replacement for it. Every decision in the list carries the section of the procedure where it is explained, so you read the reasoning before you decide rather than guessing and correcting later. Nine editions exist, one per standard and combination, and each one carries its own clause references and its own section numbers.
It also carries three things that stand on their own:
Nothing else is decided until someone owns it. The document owner, the role holders, an alternate for every role that holds up an audit or a closure, and the independence rule — what disqualifies someone from auditing a process, and who rules on a borderline case. Settling that on an organization chart is far easier than settling it in an argument about a particular finding. The combined editions add scope determination here, because the procedure runs under a determined scope before it does anything else.
Every one of these standards asks for a program before it asks for an audit, and each asks you to consider a different set of things when you establish it. Frequency that comes from the calendar rather than from those considerations is the defect this stage exists to prevent. Coverage, the basis for frequency, the ranking that sets it, the triggers that re-plan it mid-cycle, and the risks to the program itself.
Three things are defined for each audit rather than for the program as a whole: the objective, the criteria and the scope. The objective is the one most programs cannot produce, and ISO 9001:2026, ISO 14001:2026 and ISO 7101 now require it in writing. It is the question this audit exists to answer, and it is what lets the result mean something other than conformed or did not.
This is the stage that decides whether the program changes anything. What evidence is sufficient, where the threshold between one category of finding and the next sits, who the report goes to and in what form, and the split between correction and corrective action. Leave the first two to the auditor on the day and you get findings that are argued about rather than acted on.
What exists afterward, and what makes the program improve rather than repeat. Under the 2026 editions the audit records are available, not only retained, so this stage asks who produces each one today — a different question from how long it is kept. It closes with the decision the procedure most wants you to make deliberately: how far up the maturity ladder this program goes.
Nine editions, each written to its own clauses rather than renumbered from a quality base. The section numbers differ between them because the procedures differ, so the edition you pick matches the procedure you hold.
Already buying the procedure?
This QuickStart is included free with the matching procedure package. Buy it on its own only if you want the route without the document it routes through — or if you already hold an internal audit procedure of your own and want the decision order.
The Internal Audit procedure is one family of fifteen. If you are building a system rather than fixing one process, the packages carry the whole set in a single purchase:
Quality, environmental, safety and healthcare managers who already hold the procedure and want the implementation order, and consultants scoping the work before committing to it. Also useful as a planning document for a management team deciding who owns the audit program before the documentation starts — and for anyone whose certification body has just raised a finding in an area their own program had passed.
No. It is seven to eight pages that route you through a full procedure. It lists the decisions and points at the section where each is explained; it does not contain the explanation, the worked examples or the MSI notes. Adopting an audit program from this sheet alone would leave obligations unmet.
Most people should not. It is included free with the procedure, and that is the better purchase. This standalone exists for the narrower case: you already have an internal audit procedure of your own and want the decision order, or you are scoping the work before committing budget.
Because Clause 9.2.1 asks whether the system is effectively implemented, and effectiveness is not a yes or no answer. A program that reports only conformity tells an audited manager they passed, which gives them nothing to do. Recording a maturity level alongside the finding turns the audit into a direction, and that single change does more for the processes the program looks at than any individual finding does. A maturity level is never a nonconformity, and the sheet is explicit about keeping the two apart.
The combined edition for the standards you hold. The differences between these audit clauses are real and they are the place combined systems fail — ISO 9001:2026 reports to relevant managers while ISO 14001:2026 reports to relevant management, ISO 14001 requires the audit program itself to be available while ISO 9001 does not, and ISO 45001 requires results to reach workers and their representatives while neither of the others does. The combined editions carry every one of those divergences rather than averaging them.
The stages and the decision order do. The clause references and the section numbers are ISO 9001:2026, and the sheet opens with what changed from the 2015 edition, so it is a useful transition document in its own right.
Editable Microsoft Word (.docx), with a PDF edition for circulation.
Yes. Call MSI at 760-434-9141 or use the invoice request on this page. Access is released once payment clears rather than when the invoice is issued, so allow time if you are working to a deadline.
Yes. Call MSI at 760-434-9141 to schedule a planning session. The purchase price is credited in full against ISO consulting, SurePath or SureResults.
Many organizations cannot pay for training or documentation by card. Tell us what you need and we will raise an invoice.
Complete the form below and we will send an invoice, usually the same business day. Delivery is identical whether you pay by card or by invoice.
Prefer to speak to someone? Call 760-434-9141 and we will handle it directly.
