This policy procedure sets out how internal audits are scheduled, planned, carried out and followed up, and how to prepare for external ISO certification audits.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on internal auditing:

• Internal Auditing Explained
• Audit Planning and Scope
• Conducting an Internal Audit
• Internal Auditing knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help setting up your internal audit schedule and checklists, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Internal Auditing and ISO Compliance Policy Procedure Template

The Internal Auditing and ISO Compliance Policy Procedure is a Word template that sets out how a business plans, carries out and follows up its internal audits. It covers audit criteria and auditor independence, the audit schedule, planning and opening meetings, sampling and documenting evidence, reporting and logging findings, closing meetings, auditor and auditee responsibilities, and preparing for ISO certification audits.

It adds detail to the IMS1 manual, referring to IMS1 for the significant problems procedure and for responses to external audit findings. Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use footer classification support document control.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of auditing, its scope of internal and external audits against regulatory, ISO and internal requirements, and who it applies to
• Introduction to audit criteria - what auditing is, the criteria audits check against, auditor competence and independence, and the need for evidence and a schedule
• Audit scheduling and planning - the internal audit schedule of areas, auditors and frequency, preparing checklists and the agenda for an opening meeting
• Conducting and documenting the audit - following audit trails, sampling, interviewing where documents are missing, and recording evidence and auditee responses on the checklist or audit report
• Audit findings and closing meeting - reporting findings diplomatically, logging them for action, review at management review, and agreeing actions and timescales at the closing meeting
• Auditor and auditee responsibilities - what the internal auditor must do before, during and after an audit, and what is expected of the auditee
• ISO certification audits - how external certification audits are run, the evidence to prepare, a premises tour, inducting external auditors and responding to the report

Built for Internal and Certification Audits

• An internal audit schedule naming the area, assigned auditor and frequency, weighted by risk and past findings
• An opening meeting agenda covering scope, criteria, special requirements such as PPE and the previous audit report
• Guidance on wording findings, keeping nonconformance for very significant issues and using observation otherwise
• Audit findings logged for action and reviewed formally at management review
• An evidence checklist for external audits, from management review records to staff training and recent jobs

Who Needs an Internal Auditing and ISO Compliance Policy Procedure?

Businesses running an ISO management system that need to plan and record internal audits and prepare for certification audits. It is used by internal auditors, the managers whose areas are audited and whoever looks after the audit schedule.

How the Policy Fits Together

Audits are planned on the ER11 Audit Schedule or F-Q17 Internal Audit Schedule and carried out using the F-Q2 Audit Checklist. Findings that need action are logged and tracked on the ER1 Issues Actions Register, with significant findings also raised on the F-Q10 Significant Problem, Incident and Complaint Form.

Using the Policy

Edit the arrangements to match your own, such as who carries out internal audits, how audits are documented and reported, and the evidence you prepare for certification audits. Name the person responsible in the Controlled By field, give it top level approval and brief auditors and auditees on their responsibilities.

Related Documents

The GG-1-10 Internal Audits Guidance and TT-1-10 Internal Audits Training Talk help train internal auditors and brief staff on what to expect during an audit.