Twelve weeks to ISO 9001:2026, week eleven: the first internal audit.

Why is the first internal audit not a formality?

This is week eleven of twelve weeks to ISO 9001:2026. The system has been live for a short while and records are building up. This week we audit it ourselves, before anyone from outside does. The first internal audit is not a formality. It is the best chance you will get to find problems while they are still cheap to fix.

Who should audit?

Start with who audits. Auditors must not audit their own work. In a small company that is the hardest rule to follow, because the project owner wrote most of the system. There are three good options. Train two or three people from different departments to audit each other's areas. Bring in an outside auditor for the processes the project owner runs. Or combine both. Whoever audits needs to understand the standard well enough to know what evidence to look for, and to be respected enough that people take findings seriously.

How do you plan the audit?

Then the plan. This first audit should cover the whole system and every requirement of the standard, because the certification body will need to see that. Plan it process by process, using the process map from week three. For each process, name the auditor, the date, the auditee and the main things to check. Give the new themes of the 2026 edition specific attention: leadership and quality culture, context and climate, opportunities, planned changes and knowledge.

How do you sample?

Next, sampling. An audit is not a conversation about how things work. It is a check of evidence. For each process, pick real records and trace them. Pick three orders and follow them from review to delivery. Pick two suppliers and check their approval and their last deliveries. Pick a nonconformance and follow it through to its decision and any corrective action. Write down exactly which records you looked at, by reference. An audit report that does not list its samples is not evidence of anything.

How do you write findings?

Then write findings properly. Each finding states the requirement, what was found, and the evidence. Grade them as nonconformities, where a requirement is not met, or as observations and opportunities for improvement. Be honest. A new system with no findings at all usually means the audit was not thorough, and certification auditors know that.

What happens next?

Finally, what happens next. Every nonconformity goes into the corrective action process from week nine, with an owner and a date. Where you can fix something quickly, do it before the management review. And send the audit report to the sponsor, because it is a key input to next week.

By the end of week eleven you should have a completed audit of the whole system, a report with sampled evidence, and corrective actions opened for every nonconformity.

The ISO 9001:2026 Internal Audit Checklist has two hundred and fifty-three audit questions, each with the evidence to look for, and flags the 2026 changes. For a deeper look at sampling and findings, watch the ISO 9001:2026 internal audit deep dive. Both tools are in the ISO 9001:2026 templates collection. Next week, the final episode: management review and choosing a certification body.