ISO 9001:2015 §9.2 — Internal audit

ISO 9001:2015 clause 9.2 — Internal audit — is the part of the standard that forces you to check your own quality management system on a planned cadence, in writing, with objective auditors. It is one of the clauses external auditors lean on hardest, because if your internal audit programme is strong, most other findings would have surfaced before they got to them.

This page summarises what the clause asks for, splits it into the 9.2.1 and 9.2.2 halves, and shows where in Sertiq each requirement is covered.

What the clause requires

In plain English, clause 9.2 says you must:

• Run internal audits at planned intervals.
• Maintain an audit programme (a calendar of what gets audited and when), based on the importance of the processes, changes affecting your organisation, and the results of previous audits.
• Define criteria and scope for each audit (what standard / process is being audited, against which requirements).
• Pick objective auditors — auditors must not audit their own work.
• Report results to relevant management.
• Take correction and corrective action without undue delay.
• Retain documented information as evidence of the programme and the audit results.

9.2.1 vs 9.2.2

The clause has two sub-clauses with different jobs.

9.2.1 — What you must do

“The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system conforms to its own requirements and to ISO 9001.”

This is the outcome half. You have to actually run audits, and they have to give you information about conformance — both to your own documented system and to ISO 9001 itself. “Planned intervals” is read by auditors as at least annual coverage of all processes, with critical or recently-changed processes audited more often.

9.2.2 — How you must run the programme

“The organization shall plan, establish, implement and maintain an audit programme … define the audit criteria and scope … select auditors and conduct audits to ensure objectivity … ensure results are reported to relevant management … take appropriate correction and corrective actions … retain documented information.”

This is the process half. ISO 9.2.2 lists six lettered duties (a–f) that the programme itself must meet. They map cleanly onto fields and features in Sertiq’s Internal Audit module.

How Sertiq covers each requirement

9.2 requirement	Where it lives in Sertiq
Planned intervals / audit programme	Internal Audits — every audit has a planned_date. The list view sorted by date is the programme.
Criteria and scope per audit	The scope field and the ISO clauses in scope multi-select on each audit.
Audit type (programme vs reactive)	The planned / unplanned / follow_up type field.
Objective auditor	The lead auditor field. Pick someone who does not own the audited process. The auditor’s name is on the PDF report.
Audited area	The audited department field, sourced from your Departments register.
Results reported to management	The Download PDF export — a one-page-per-finding audit artefact you hand to the QM and to relevant management.
Correction and corrective action	The Convert finding → NCR button on every finding. The NCR creates a CAPA in turn.
Documented information retained	The audit row + findings + linked NCRs persist for the life of the organisation. The PDF is the printable evidence.

Common auditor questions and where the answer lives

External auditors tend to ask the same handful of questions during the 9.2 part of a stage 2 or surveillance visit. For each:

• “Show me your audit programme for this year.” — Internal Audits list filtered by year. The audits with planned_date in scope, ordered, are the programme.
• “How did you decide what to audit?” — the audit type and the scope text say it. unplanned audits should reference the triggering event in scope or in a finding.
• “Who audited this process? Are they independent of it?” — lead_auditor on the audit. Independence is the QM’s call; the data lets you defend it.
• “Show me the findings from this audit.” — the audit detail page, Findings tab.
• “What did you do about that major finding?” — the linked NCR (via Convert) and its CAPA chain. Click through the NCR number on the finding.
• “Where is the documented information?” — Download PDF. Hand them the file.
• “How often do you re-audit a process that had a major finding?” — follow_up audits referencing the original audit’s number in the title or scope.

If the answer to any of those is not one click away, the programme is weaker than it should be.

Related

• Internal Audits — the feature that implements 9.2 end to end.
• NCR — where audit findings land after conversion. Note the source = internal_audit field.
• CAPA — clause 10.2 corrective action, downstream of every major finding.
• ISO 9001 clause 8.4 mapping — sister reference for the supplier side.