How to Become an ISO 9001 Internal Auditor in 2026

An ISO 9001 internal auditor is a person who checks, on behalf of their own organization, whether the quality management system meets ISO 9001 and the organization's own requirements, and whether it works in practice. Clause 9.2 of ISO 9001:2026 requires planned internal audits, and clause 7.2 requires you to show that the people doing them are competent. No law or ISO rule says an internal auditor must hold a particular certificate. What matters is evidence of competence.

Last updated: October 2026.

What does an internal auditor do?

Internal auditors plan audits from the audit programme, interview people, look at records and observe work, compare what they find with the requirements, and report conformities, nonconformities and opportunities for improvement. ISO 9001 requires auditors to be selected so that audits are objective and impartial, which in practice means you do not audit your own work.

Six steps to become an ISO 9001 internal auditor

1. Learn ISO 9001:2026 clause by clause. You cannot audit a requirement you do not understand. Focus on clauses 4 to 10 and on what changed from the 2015 edition: quality culture and ethical behaviour, separate handling of risks and opportunities, climate change in context, and planning of changes.
2. Learn audit method from ISO 19011. ISO 19011 gives guidance on audit principles, managing an audit programme and conducting audits. Most internal auditor courses are built on it.
3. Practise the audit cycle. Write an audit plan, build a checklist from process risks rather than clause numbers, run an opening meeting, gather objective evidence, grade findings and write a report.
4. Shadow two or three audits with an experienced auditor, then lead one under supervision.
5. Get your competence recorded. Your organization should keep a training record, a supervised-audit record and a sign-off that you are competent to audit, because clause 7.2 requires documented information as evidence of competence.
6. Keep it current. Update your knowledge when the standard or your processes change, and audit regularly.

Online or classroom training?

Classroom and live online courses from certification bodies usually run for two days and cost several hundred to over a thousand US dollars. Self-paced online courses cost less and let you study around work. Both are acceptable evidence of training. What auditors of your system will look for is whether your internal auditors can actually audit, so combine any course with supervised practice.

Internal auditor, lead auditor or lead implementer?

An internal auditor audits their own organization. A lead auditor leads third-party or supplier audits and usually holds an accredited lead auditor certificate (for example CQI/IRCA or Exemplar Global recognised). A lead implementer builds and runs the management system. Read our comparison of lead auditor and lead implementer roles.

Frequently asked questions

Do internal auditors need to be certified?

No. ISO 9001 does not require internal auditors to hold a certificate. It requires the organization to determine the competence needed and keep evidence of it. A training certificate plus records of supervised audits is a common way to show this.

How long does ISO 9001 internal auditor training take?

Most courses take 15 to 24 hours of study, including practice exercises. Becoming confident usually takes a few supervised audits on top of the course.

Can I audit my own department?

You should not audit your own work. ISO 9001 requires audits to be objective and impartial, so most organizations assign auditors to processes they are not responsible for.

About our certificates: ISO Cloud Consulting courses award a certificate of completion. We are a new training provider and our certificates are not yet accredited by an external body; we plan to apply for international recognition before the end of 2027.