Internal Audits

An Internal Audit in Sertiq is a planned, documented review of part of your quality management system, carried out by your own people rather than a third party. Each audit has a scope, a lead auditor, an audited department, one or more ISO clauses in scope, and a list of findings. When a finding is real, you convert it to an NCR in one click and the CAPA flow takes it from there.

Internal audits are how you satisfy ISO 9001:2015 clause 9.2 — Internal audit: planned intervals, documented programme, defined criteria and scope, objective auditors, and retained evidence. The matching reference page is ISO 9001 §9.2.

The module is typically driven by the Quality Manager (who maintains the programme) and a Lead Auditor per audit (who carries it out and writes findings). Both must be active users of your organisation.

Plan tier gating

Internal Audits sit on Pro and Enterprise plans. Below Pro, the section renders as a locked card with an upgrade link.

Plan	Internal audits
Free / Starter	Locked. Card visible, “Upgrade to Pro” link.
Pro	Up to 12 audits per calendar year per organisation.
Enterprise	Unlimited.

The quota is checked server-side inside the create_internal_audit RPC against the current calendar year, so the cap cannot be bypassed by direct API calls.

Plan an audit

1. Open Internal Audits → New. Sertiq pre-fills the next available number in the AUDIT-YYYY-NNNN series for your organisation.

2. Enter a short title describing the audit (e.g. “Q2 incoming inspection process review”).

3. Fill the scope field — what is in and out of the audit. This shows on the PDF and is the first thing an external auditor will read.

4. Pick the audit type:

   • planned — part of the annual programme.
   • unplanned — triggered by an event (recurring NCR, customer complaint, management decision).
   • follow_up — verifying actions from a previous audit.

5. Set the planned date. This is the scheduled execution date, not the creation date.

6. Assign a lead auditor from the typeahead. The list is scoped to active members of your organisation; the RPC re-checks the user belongs to your org.

7. Pick the audited department from the dropdown. The list comes from your Organization → Departments register and is org-scoped.

8. Tick the ISO clauses in scope from the multi-select. The common 9001 options are pre-populated: 4.4, 5.3, 6.1, 7.1.5, 7.5, 8.4, 8.5, 8.7, 9.1, 9.2, 9.3, 10.2. You can pick one or several.

9. Click Create audit. Sertiq inserts the row, returns AUDIT-YYYY-NNNN, and routes you to the audit detail page.

Note

The number is assigned inside a SECURITY DEFINER RPC (create_internal_audit) and is sequential per organisation per calendar year. Two users creating audits at the same instant cannot collide on the same number.

Audit lifecycle

draft ─► scheduled ─► in_progress ─► completed
   │
   └──────────────► cancelled

• draft — the planning record exists; not yet on the programme.
• scheduled — published to the programme; lead auditor notified.
• in_progress — audit is being executed; findings can be raised.
• completed — audit finished. closed_at is stamped automatically and the PDF report becomes the audit artefact.
• cancelled — audit was abandoned. Reason should be in the activity log.

Only scheduled and in_progress audits accept new findings. Closing the audit freezes the finding list.

Findings

Each finding lives under exactly one audit and is numbered F-001, F-002, … sequentially per audit (not per org). The list is what the auditor walks through during the closing meeting.

A finding has:

• Severity — see the table below.
• ISO clause — the specific 9001 clause this finding is written against. Defaults to one of the audit’s in-scope clauses but can be set independently.
• Description — what was observed, with enough detail that someone reading it cold can act on it.
• Evidence — sample IDs, record references, photo descriptions, dates. This is the bit auditors care about most.
• Responsible employee — who owns the action. Scoped to your organisation; the RPC re-checks.
• Due date — when the action needs to be completed by.

Severity options

Severity	When to use
observation	A neutral comment — no failure, but worth recording. Often used to flag drift before it becomes a finding.
opportunity	Opportunity for Improvement (OFI). The system works but could be strengthened. No corrective action required.
minor	A single, isolated failure of a clause. Action required but no systemic risk.
major	Systemic failure of a clause, or a single failure with significant impact (safety, regulatory, customer). Will usually drive an NCR and a CAPA.

observation and opportunity are informational; minor and major are real non-conformances and almost always become NCRs.

Convert finding to NCR

This is the workflow’s keystone. Every finding has a Convert to NCR button. Clicking it:

1. Creates an NCR with source = internal_audit and supplier_id = NULL.
2. Copies the finding’s description into the NCR description.
3. Maps the finding severity onto the NCR severity:

Finding severity	NCR severity
observation	minor
opportunity	minor
minor	minor
major	major

4. Copies the finding’s ISO clause onto the NCR. If the finding does not have one, the NCR defaults to clause 9.2 (the audit clause itself).
5. Stamps the finding with the resulting ncr_id so the link is permanent.

The conversion is single-shot. The RPC refuses to create a second NCR for the same finding — if you delete the NCR you can convert again, but you cannot accidentally produce duplicates by clicking twice.

Tip

Internal NCRs work exactly like supplier NCRs — same numbering series (NCR-YYYY-NNNN), same status lifecycle, same CAPA linking, same audit timeline. The only difference is source and the empty supplier_id. See Supplier vs internal NCRs.

PDF export

Click Download PDF on the audit detail page. The request hits a Route Handler at /api/reports/internal-audit/[id] which builds the document with pdfkit on the server and streams it back. Layout:

• Header — Sertiq logo, organisation name, audit number, status badge.
• Meta block — organisation, status, type, lead auditor, planned date, audited department, finding count.
• Scope — the scope text in full.
• ISO clauses in scope — list of clauses.
• Summary — count of findings by severity.
• Per-finding cards — one card per finding with number, severity, ISO clause, description, evidence, responsible employee, due date, and the linked NCR number (if converted).

This document is the retained documented information that ISO 9.2.2 (e) asks for. Save it to your audit folder.

Numbering

• Audits: AUDIT-YYYY-NNNN, sequential per organisation per calendar year. Assigned in create_internal_audit (SECURITY DEFINER).
• Findings: F-001, F-002, … sequential per audit. Assigned in create_internal_audit_finding (SECURITY DEFINER).

Both RPCs validate that the actor belongs to the audit’s organisation and that referenced rows (lead_auditor, department_id, responsible_employee_id) also belong to it. Cross-org leakage is impossible by construction.

Related

• NCR — including the new source field and supplier_id rules.
• CAPA — every major or minor finding’s NCR ends up here.
• ISO 9001 §9.2 — the clause this module implements.