Tell a production supervisor that the internal auditor is coming, and watch what happens. Work instructions get dusted off, logs get hastily completed, and everyone suddenly remembers where the procedures are filed. In many small manufacturers, the internal QMS audit feels less like a quality tool and more like an interrogation everyone has to survive.
ISO 9001 (Clause 9.2) doesn’t ask for a ritual you endure. Done well, internal audits are the cheapest quality improvement tool you have: they catch the gaps your external auditor would have found, while you still have time to fix them.
Why do internal audits have such a bad reputation? #
Most bad internal audits share the same root causes:
- Auditors auditing their own work. Uncomfortable questions never get asked.
- The audit is a surprise. Nobody prepared, so the whole exercise feels like a gotcha.
- Findings go nowhere. The report lands in a drawer — no corrective actions or follow-up — so next year’s audit finds the same problems.
- It’s all checklist, no understanding. The auditor ticks boxes without grasping what’s being checked, so real risks slip through while trivialities get flagged.
None of this is about the standard. It’s about how the audit is run — fix the process and the dread fades.
How do you build an internal audit program that actually works? #
An audit program is the year-long plan: which processes get audited, when, and by whom. ISO 9001 wants the program to consider process importance, changes, and past results. In plain language:
- Audit risky and changed processes more often. New equipment, new suppliers, processes with last year’s findings — these earn a closer look.
- Spread audits across the year. A steady rhythm — a couple of processes each month — keeps findings fresh and workloads manageable.
- Keep auditors independent. Nobody audits their own work (Clause 9.2.2c). In a small company this is the hard part: cross-train people across departments. The warehouse lead can audit production; the quality technician can audit purchasing. An outsider asks the “obvious” questions insiders stop asking.
- Invest in auditor competence. Send auditors to an internal auditor course, let new auditors shadow experienced ones, and give them a written audit procedure to follow.
Publish the schedule. When people can see the year’s plan, the audit stops feeling like a surprise raid.
How do you plan an individual internal QMS audit without disrupting production? #
Share a short audit plan with the area a week or two in advance:
- Define the scope and criteria. Which process, which ISO clauses, which procedures. “Audit shipping against SOP-SHP-012 and ISO 9001 Clause 8.5.4” is a plan; “go look at shipping” is not.
- Build a focused checklist. Translate procedures and clauses into specific questions: Are pick lists verified against the sales order before packing? Good checklists ask what evidence should exist.
- Agree the schedule with the process owner. Work around production, not against it — auditing the shipping dock during the morning rush guarantees resentment and thin evidence.
- Review previous findings first: verify last audit’s non-conformances were actually fixed — not just closed in a spreadsheet.
What do good auditors actually ask on the shop floor? #
The best internal auditors act like curious colleagues, not inspectors:
- Ask open questions. “Walk me through what happens when a batch fails inspection” beats “Do you follow procedure QP-08?” every time.
- Ask for evidence, politely. “Can you show me the last three calibration records for this gauge?” Evidence-based auditing is what separates a real audit from a chat.
- Sample across time — January, June, and September records, not just last week’s neat ones. Problems hide in old, boring records.
- Write it down as you go — memory is unreliable.
- Give feedback in real time: if you find an issue, say so on the spot. Immediate feedback turns findings into learning, not punishment.
One more rule: separate people from problems. “The work instruction WI-14 was not at the workstation” is a finding. “The operator doesn’t follow instructions” is not.
How do you report findings without starting a war? #
The audit report is where credibility is won or lost. Keep it factual and fair:
- Classify findings clearly. Non-conformances (requirement not met) versus observations or opportunities for improvement. Reserve “major” for systemic breakdowns, not typos.
- Describe requirement, evidence, gap — in that order. “Procedure QP-08 requires gauge calibration every 6 months. Gauge G-114 was last calibrated 14 months ago (calibration log reviewed Oct 6).”
- Include the positives — it makes the report credible and reminds everyone this isn’t a punishment exercise.
- Get agreement on the facts first: walk the process owner through findings before finalizing.
Circulate the report within a week. A report that takes two months to appear tells everyone the findings didn’t matter.
How do you make sure findings actually get fixed? #
This is where most internal audit programs die. Close the loop properly:
- Link every non-conformance to a corrective action with an owner and due date. Root cause analysis isn’t optional.
- Verify effectiveness, not just completion: “retrained the operator” is a claim — check the error rate actually dropped, or re-sample in 60 days.
- Feed results into management review (Clause 9.3). Trends — repeat findings, rising issues — are exactly what top management needs to see.
- Track overdue actions visibly. Nothing kills an audit program faster than findings that quietly expire in spreadsheets and email threads.
What changes when audits live in one QMS? #
Everything above works with paper, clipboards, and discipline. But manual audit programs fail in familiar ways: the schedule in one spreadsheet, findings in another, corrective actions in email — nothing connected. That’s how findings go nowhere.
When internal audits run inside an integrated QMS like Artintech’s audit management software, the loop closes itself: schedule, checklists, findings, and corrective actions live in one place, and findings flow straight into CAPA records with owners, due dates, and effectiveness checks. Auditors pull evidence — the current procedure, a calibration history, training records — from the same system instead of hunting across drives, because document control and training records are already there. When the external auditor asks for last year’s internal audit results, the answer is a report, not a scavenger hunt.
You don’t need software to audit well. But software is what makes the good habits stick when people get busy — precisely when the manual system breaks down.
Start before the next audit cycle #
Pick one process with known pain, run a small audit the way this article describes, and close every finding. Internal audits stop being dreaded the moment people see them catch real problems and fix real things.
Ready to run your audit program from one place instead of five spreadsheets? Start a free trial of Artintech and see what changes when audits, findings, and corrective actions live in one QMS.
