Free resource
A risk-based internal audit programme organised by process, with an audit record sheet for findings and effectiveness checks. Template.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Template. Read this tab first. This is a working tool for your own team - it does not replace the standard or scheme text you are certified against, and it is not a certificate or an audit.
| Topic | Detail |
|---|---|
| What this is | A risk-based internal audit programme for an ISO 9001 QMS, organised by process rather than by clause, plus an audit record sheet for findings and corrective action follow-up. |
| How to use it | Rate each process on importance and risk, then set frequency: high-risk processes more often, stable low-risk ones less often. ISO 9001 requires internal audits at planned intervals - it does not require every clause to be audited every year. |
| Independence | Auditors must not audit their own work. Fill the 'Auditor' column only with someone who does not operate or manage the process audited. The internal audit process itself must be audited by someone else too. |
| Clause references | References use main clause numbers, which the 2026 edition keeps. Check subclause numbering against the edition you are certified to. |
Sheet: Programme
Example rows show a typical service and manufacturing mix - replace them with your own processes. Risk = importance to customers x history of problems x recent change.
| Process / area | Main clauses | Risk (H / M / L) and why | Last audit and result | Planned (quarter) | Auditor (independent of area) | Method (remote / onsite) | Status |
|---|---|---|---|---|---|---|---|
| Sales, quotation and contract review | 8.2 | M - customer requirements change often; one complaint traced to a misread order | - | Q1 | - | Remote + sample of orders | - |
| Design and development (if applicable) | 8.3 | H - new product line this year | - | Q1 | - | Onsite / project review | - |
| Purchasing and supplier control | 8.4 | H - two new critical suppliers | - | Q2 | - | Remote + supplier file sample | - |
| Production or service provision | 8.5 | H - main source of nonconforming output | - | Q2 | - | Onsite, both shifts | - |
Sheet: Audit record
One row per finding. Classify each as nonconformity (NC), observation (Obs) or opportunity for improvement (OFI), cite the requirement, and record the objective evidence. Verification of effectiveness is a separate, later step.
| Audit ID / date | Process | Type (NC / Obs / OFI) | Requirement | Finding and objective evidence | Corrective action ref. | Effectiveness verified (date, by) |
|---|---|---|---|---|---|---|
| [A-2027-03] | [Purchasing] | [NC] | [8.4] | [Example: 2 of 5 sampled new suppliers had no evaluation record before the first order] | - | - |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources