Free resource
Plan one internal audit programme across ISO 9001, ISO/IEC 27001 and ISO/IEC 42001 without dropping each standard's own requirements. Template.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Template. Read this tab first. This is a working tool for your own team - it does not replace the standard or scheme text you are certified against, and it is not a certificate or an audit.
| Topic | Detail |
|---|---|
| What this is | A planning matrix for internal audits of an integrated management system: one programme across ISO 9001, ISO/IEC 27001 and ISO/IEC 42001, organised by process. |
| The rule | A combined audit shares the visit, not the requirements. Each standard's own requirements still have to be sampled - an IMS audit that only checks shared clauses misses most of the system. |
| Competence | Assign auditors per standard. One auditor can cover several standards only where they are competent in each. See the 'Auditor competence' tab. |
| Independence | Nobody audits their own work - including the IMS manager, who should not audit the management system they run. |
Sheet: Audit matrix
Mark which standards apply to each process, then list the standard-specific requirements to sample. Example rows show a typical 9001 + 27001 + 42001 mix.
| Process | 9001 | 27001 | 42001 | Shared clauses to audit once | Standard-specific requirements to sample | Auditor(s) | Planned |
|---|---|---|---|---|---|---|---|
| Leadership and management review | X | X | X | 5, 9.3 (inputs per standard) | 9001 customer focus; 27001 ISMS performance inputs; 42001 AI system performance | - | - |
| Risk and opportunity management | X | X | X | 6.1 framework | 27001 information security risk assessment and SoA (6.1.2, 6.1.3); 42001 AI risk and impact assessment (6.1.4); 9001 risks and opportunities | - | - |
| Supplier management | X | X | X | Supplier selection and monitoring | 9001 external providers (8.4); 27001 Annex A supplier controls; 42001 third-party AI | - | - |
| Product / service delivery | X | - | - | - | 9001 operational controls (8.5) | - | - |
Sheet: Auditor competence
Record which standards each auditor is competent to audit, and which areas they must not audit because they work in them.
| Auditor | ISO 9001 | ISO 27001 | ISO 42001 | Basis of competence | Must not audit (own work) |
|---|---|---|---|---|---|
| [Name] | - | - | - | [Lead Auditor course, experience, sector knowledge] | [Areas they operate or manage] |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources