How to run an internal audit in a small company (ISO 9001:2026, clause 9.2)

Short answer: to run an ISO 9001:2026 internal audit in a small company, plan a short programme based on risk, use auditors who do not audit their own work, build an evidence-based checklist, grade findings simply, and track every nonconformity to closure with an owner and a due date. Feed the results into management review. Clause 9.2 sets the requirement.

Internal audit is where a small company finds its own problems before a certification body does. Clause 9.2 asks you to audit at planned intervals to check that the system meets your requirements and the standard, and is effectively implemented and maintained. Here is a practical way to do it when you have few people and little time.

What clause 9.2 expects

In summary: plan an audit programme that takes account of the importance of processes and past results, define the objectives, criteria and scope of each audit, choose auditors who are objective and impartial, report the results to relevant management, correct and take corrective action without undue delay, and keep records as evidence. Check the exact wording in your licensed copy of the standard.

Step 1: Plan the programme

List your processes and decide how often each is audited. Higher-risk processes and those with past problems come up more often. A small company can often cover the whole system in a year with four to six short audits. Put the dates in a shared calendar.

Step 2: Choose objective auditors

Auditors must not audit their own work. In a small team, swap: the production lead audits purchasing, the quality manager audits production. If you cannot find an impartial person internally, an outside auditor for part of the programme is a reasonable option.

Step 3: Build the checklist

Start from the clauses and your own procedures. Good questions ask for evidence: show me how you decide, show me the last three records, who approved this? A ready-made bank of questions saves hours. QMS Workspace includes 253 audit questions you can pull into a checklist for each audit. If you prefer Excel, see our internal audit checklist guide for the new edition.

Step 4: Run the audit

• Open with a short meeting: scope, timing, how findings are graded.
• Sample records and watch the work. Ask open questions.
• Note evidence, not opinions.
• Close with a summary so there are no surprises.

Step 5: Grade and write up the findings

Use simple grades, for example conforming, minor nonconformity, major nonconformity and opportunity for improvement. Each finding should state the requirement, the evidence and the gap in one or two sentences.

Step 6: Follow up

Each nonconformity needs a correction, a root-cause analysis where appropriate, a corrective action with an owner and due date, and a check that the action worked (clause 10.2). Track them in one list and review them at management review.

Common mistakes

• Auditing the paperwork, not the work.
• A checklist so long that nobody finishes it.
• Findings with no owner or date.
• The same person auditing and fixing their own area.
• Not feeding audit results into management review.

Doing it in QMS Workspace

In QMS Workspace Full you plan the programme, build checklists, grade each question, raise findings that flow into the corrective action register, and print the report. Watch the internal audit tutorial to see it end to end. Full is a one-time $499 with 6 months of email support included.

Frequently asked questions

How often should we audit?

At planned intervals based on risk and past results. Many small companies cover everything annually.

Can the quality manager audit their own system?

They should not audit their own work. Use someone else or an external auditor for those areas.

Do we need a trained lead auditor?

The standard asks for competent, objective auditors. A formal qualification is not required, but training helps.

Next: how to run management review.