Direct Answer: ISO internal audits are only as trustworthy as the person conducting them, and the standard says so directly — ISO 19011:2026 makes auditor competence and independence the load-bearing requirements of the whole activity. Seven marks separate a real internal auditor from someone holding a checklist: demonstrable independence from the process under audit, documented competence against defined criteria, evidence discipline, consistent finding classification, defensible sampling judgment, reporting that survives management review, and follow-through to closure. Evaluate your auditor against all seven before your next cycle, not after a certification body does it for you.
The uncomfortable truth about ISO internal audits is that two organizations can run identical ISO internal audits on identical schedules, produce identical report templates, and log identical numbers of findings — and one of those programs is protecting the business while the other is manufacturing paperwork. The difference is almost never the procedure. It is the person.
A certification body auditor figures this out in roughly twenty minutes. They ask to see the ISO internal audits records for one process, read three findings, and ask the internal auditor a single follow-up question about how a sample was selected. The answer tells them whether the internal audit function is a genuine control or a ritual. Everything after that in the certification audit is calibrated to what they learned in those twenty minutes.
This article is the evaluation framework — seven marks, each one testable this week, each one anchored to something a standard or an accreditation rule actually requires. It applies whether the person running your ISO internal audits is a colleague from another department, a full-time quality professional, or an outside specialist you contract. And it applies to ISO 9001, ISO 13485, ISO 14001, ISO 45001, and ISO 7101 alike, because auditor competence is the one requirement none of them let you scope out.
The Requirement Behind the Requirement
What Do ISO Internal Audits Actually Require of the Auditor?
Competent. Independent. Accountable.
Direct Answer: Every management system standard requires ISO internal audits conducted by auditors selected to ensure objectivity and impartiality, but none of them tell you how to prove it. That proof comes from ISO 19011:2026, the international guidance on auditing management systems, which defines the competence criteria, the seven auditing principles, and the evaluation process a credible program uses to qualify its people.
The requirements clauses governing ISO internal audits are short to the point of being unhelpful. ISO 9001 asks the organization to select auditors and conduct audits in a way that ensures objectivity and impartiality of the audit process. ISO 14001:2026 asks the same, and adds a normative requirement that every audit have defined objectives. ISO 45001 layers on worker consultation. None of them define competence. None of them tell you what independence looks like operationally.
That vacuum is deliberate, and it is why so many ISO internal audits are conducted by people nobody ever qualified. The detail lives in ISO 19011, whose fourth edition published on 27 May 2026 and withdrew the 2018 edition immediately, with no transition period. Because ISO 19011 is guidance rather than a requirements standard, nobody is audited against it — which is precisely why so many programs never opened it. MSI covers the full clause-level picture in its breakdown of the ISO 19011:2026 changes and the edits your internal audit procedure needs to absorb them.
The seven principles ISO 19011 sets out — integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach, and the risk-based approach — carry forward intact into the 2026 edition. They are not aspirational language. They are the criteria against which a mature program evaluates the people running its ISO internal audits, and they map cleanly onto the seven marks below.
A certification body cannot cite you for failing ISO 19011. It can, and routinely does, cite you for an internal audit program whose auditors cannot demonstrate the competence the organization itself defined as necessary.
This is the trap most programs fall into. The organization writes a procedure saying the auditors conducting its ISO internal audits shall be competent, defines no criteria, keeps no evaluation records, and then discovers during a surveillance audit that it has raised a nonconformity against its own documented requirement. The finding is not about auditing skill. It is about the absence of evidence.
The Framework
The 7 Proven Marks of a Real Internal Auditor
Test. Observe. Decide.
Direct Answer: The seven marks of an auditor who can be trusted with ISO internal audits are: independence written as a decision test rather than an intention; competence defined against criteria and evidenced in records; evidence discipline that separates observation from inference; finding classification that means the same thing regardless of who raised it; sampling judgment that can be explained; reporting that gives management review something to act on; and follow-through that verifies effectiveness rather than accepting a status update.
Each mark below includes what to look for in ISO internal audits, and the specific question that exposes its absence. The questions are the useful part — they take under a minute each and they are almost impossible to bluff.
Mark 1 — Independence Written as a Decision Test
In ISO internal audits, independence is the principle everyone claims and almost nobody documents. The standard language — auditors shall not audit their own work — is easy to write and surprisingly hard to apply in a forty-person company where the quality manager wrote every procedure in the system.
A real program converts the principle into a rule that produces the same answer regardless of who applies it. Something closer to: an auditor may not audit a process in which they hold approval authority, wrote or approved the controlling document within the current revision cycle, or report to the process owner. That is a test. “Auditors should be objective” is a wish.
The question: Show me the rule that would have disqualified you from this audit, and show me a time it did. A program that has never disqualified anyone either has no rule or does not apply it. In organizations too small for clean separation, the honest answer is a documented compensating control — an external reviewer, a second-auditor sign-off, or an outsourced audit for the highest-risk processes. MSI's internal audit services exist substantially for that case.
Mark 2 — Competence Defined, Evaluated, and Recorded
ISO 19011 describes competence as a combination of knowledge and skills evaluated against criteria the organization sets. The 2026 edition expands what belongs in those criteria: alongside standard knowledge, audit method, and sector understanding, auditor competence now explicitly includes digital and information-security awareness — the judgment to evaluate electronic evidence and to handle live system access responsibly.
Certificates matter less in ISO internal audits than most people assume. A training certificate evidences attendance and, in a good course, a demonstrated practice audit. It does not evidence continuing competence three years later. Mature programs evaluate auditors periodically against the criteria, using observation during a live audit, review of finding quality, and auditee feedback — and they keep the records. MSI's ISO Internal Auditor Workshop and its ISO Internal Auditor training both build toward a documented qualification rather than an attendance slip, and the deeper picture of what the role demands is covered in MSI's internal auditor guide.
The question: What are the competence criteria for this role, and when was this auditor last evaluated against them?
Mark 3 — Evidence Discipline
Audit evidence in ISO internal audits is records, statements of fact, or other verifiable information relevant to the audit criteria. The operative word is verifiable. A weak auditor writes findings built on impressions — the area seemed disorganized, training appeared inconsistent. A strong auditor writes findings that another person could confirm from the same records without having been in the room.
The 2026 edition sharpened this considerably for digital evidence, because a screenshot from a live system raises questions a paper record never did: was the view filtered, who has edit rights, is this the controlled revision. Programs auditing software-mediated processes — and by now that is most of them — need an evidence-reliability step built into the procedure, not improvised at the desk. MSI's work on auditing AI agents pushes this further, into processes where the thing being audited makes decisions on its own.
The question: Take any finding from the last cycle. Can a second person reach the same conclusion from the evidence cited alone?
Mark 4 — Finding Classification That Holds Its Meaning
In too many ISO internal audits, whether something is a major nonconformity, a minor, or an observation depends entirely on who wrote it and how the week was going. That inconsistency destroys the data. Trend analysis across cycles becomes meaningless, management review sees noise, and the corrective action system receives work sorted by mood rather than severity.
A real program publishes classification criteria — typically some combination of whether a requirement is absent versus imperfectly applied, whether the failure is systemic or isolated, and whether the effect reaches the customer, the environment, the patient, or the worker. Written down, the criteria make the classification arguable, which is the point. Arguable beats arbitrary.
The question: Two auditors, same evidence — would they classify it the same way, and what document says so?
Mark 5 — Sampling Judgment That Can Be Explained
Ask an auditor running your ISO internal audits why they pulled those six records and not another six. The answer separates the professional from the amateur faster than any other question in this article. “They were the ones on top” is a real answer that real auditors give. So is “the system exported them in that order.”
Defensible sampling reflects risk: recent changes, processes with corrective action history, high-consequence steps, periods spanning a personnel or system transition, and a deliberate random component so the sample cannot be curated by the auditee. This is the same risk logic that governs program-level scheduling, which MSI lays out in its guide to internal audit planning and its treatment of internal audit risk mitigation strategies.
The question: Why these records? Reconstruct the reasoning.
Mark 6 — Reporting That Survives Management Review
An audit report from ISO internal audits that lists findings has done half the job. An audit report that states what the audit set out to learn, how it was conducted, whether the objective was met, and what the pattern across findings suggests has given leadership something to decide with.
This matters more since ISO 14001:2026 made per-audit objectives a normative requirement — an audit without a stated objective now has a compliance problem, not just a quality problem. Reporting is also the handoff point into management review, where audit results are a required input under every one of the standards MSI implements. MSI's ISO Management Review Toolkits are built around exactly that handoff, and the wider connection is explored in MSI's work on government internal audit, where audit output becomes leadership input.
The question: What did the last audit report change?
Mark 7 — Follow-Through to Verified Effectiveness
The seventh mark is where most ISO internal audits quietly fail. A finding is raised, a corrective action is entered, someone marks it complete, and the loop closes on a status field rather than on evidence. The next cycle raises the same finding, and nobody connects the two.
Verified effectiveness means the auditor returns to evidence: the updated procedure, the training record, the output of the process running the new way, the metric before and after. Closure is a judgment, not a checkbox. MSI covers the full mechanics in its guide to internal audit follow-up, and the program-level view in building an internal audit program.
The question: Show me a finding closed last year and the evidence that it stayed fixed.
Across 200+ certification and surveillance audits attended, the single most common root cause MSI observes behind a failed internal audit program is not incompetence. It is an auditor who was never given criteria, never evaluated, and never told what “good” looked like — then blamed when a certification body found what the internal audits missed.
The Build-or-Buy Decision
Should ISO Internal Audits Be Run In-House or Outsourced?
Capacity. Independence. Depth.
Direct Answer: Run ISO internal audits in-house when you have enough separation of duties to satisfy Mark 1 and enough audit volume to keep auditors current. Bring in an outside auditor when the organization is too small for genuine independence, when the highest-risk processes are owned by the people who would otherwise audit them, when internal capacity cannot cover the cycle, or when the program needs an honest calibration against what a certification body will see.
The choice of who conducts ISO internal audits is usually framed as cost, which is the least interesting variable. The real variables are three.
Independence capacity. Below roughly forty people, most organizations cannot construct a clean audit assignment for their core processes. Everyone with the knowledge to audit purchasing also approves purchase orders. This is not a failure of will; it is arithmetic. An outsourced auditor solves it structurally.
Currency. An auditor who conducts two audits a year does not build judgment. They build a routine. Sampling instinct, interview technique, and the ability to recognize when an answer is being managed all come from volume. If the program cannot supply volume, the auditors need either external practice or external help.
Blind spots. An internal auditor knows the system's stories — why that exception exists, what the workaround is for. That knowledge is an asset for efficiency and a liability for detection. Organizations typically report that the first outside audit of a mature system surfaces findings the internal team had stopped seeing years earlier.
Most healthy programs land on a blend: internal auditors handle the routine cycle, an outside auditor takes the two or three highest-consequence processes and the annual calibration. Multi-site organizations face this most acutely, since the cycle must cover every site plus the central function — a capacity problem MSI addresses in its guide to multi-site ISO certification. Externally provided processes complicate it further, as MSI's work on purchasing and supplier control and ISO 14001 externally provided processes both document.
A quick way to decide
Write down your three highest-consequence processes. For each, name the person who would audit it and the person who owns it. If any name appears twice, you have located the part of your program that needs outside help — and you have located it in about ninety seconds.
What the Registrar Opens
What Does a Certification Body Check in Your ISO Internal Audits?
Records. Reasoning. Records.
Direct Answer: A certification body examining your ISO internal audits looks for four things in sequence: the audit program itself and evidence it was implemented, the competence records for the people who conducted the audits, the findings and their classification, and the corrective actions with evidence of effectiveness. Auditors accredited under ISO/IEC 17021-1 are required to sample your internal audit function because it is the control that tells them how much of the rest of your system they can trust.
Certification bodies operate under ISO/IEC 17021-1, accredited by bodies whose international coordination now sits with Global ACI, which commenced operations on 1 January 2026 replacing both IAF and ILAC. In the United States, ANAB is the accreditation body most organizations encounter. None of these permit a registrar to skip the internal audit function.
The sequence of what a registrar samples in ISO internal audits matters more than the list. The registrar starts with the program because it reveals intent — does the schedule reflect risk, or is it twelve processes divided by twelve months? They move to competence records because the program is only as good as its people. Then findings, because finding quality reveals auditor skill more reliably than any certificate. Then corrective action, because closure quality reveals whether the organization takes its own audits seriously.
One under-appreciated detail: ISO 14001:2026 requires the audit program itself to be available as documented information, where ISO 9001 and ISO 45001 require retained evidence of its implementation. Organizations running an integrated system frequently satisfy the weaker obligation and assume it covers all three. It does not. MSI's guidance on ISO procedure order works through where these divergences sit, and the broader lifecycle view is in MSI's overview of the ISO audit and its perspective on ISO consulting for confident certification audits.
The Silent Failure
The Auditor Qualification Records Trap in ISO Internal Audits
Written. Undone. Cited.
Direct Answer: The most common nonconformity MSI observes against ISO internal audits is not a missed audit — it is an organization that defined auditor qualification requirements in its own procedure and then kept no evidence of meeting them. The procedure becomes the accusation. Either evidence the requirement or rewrite the requirement to something you will actually maintain.
The pattern repeats across ISO internal audits with unusual consistency. A procedure written years ago, often copied from a template, states that internal auditors shall complete formal internal auditor training, shall have three years of relevant experience, and shall be evaluated annually. Nobody checks whether that sentence describes reality. Three certification cycles later, an auditor asks for the annual evaluations, and there are none.
This is entirely avoidable, and the fix takes an afternoon. Read your own internal audit procedure as if you were the registrar. Every “shall” applying to auditors is a commitment you must evidence. Then make one of two choices for each: produce the evidence going forward, or amend the procedure to state a requirement you will genuinely maintain. Both are legitimate. Leaving the mismatch in place is not.
Ready-made procedure text helps here, because a well-built template states the qualification requirement at a level an organization can actually sustain and names the record that evidences it. MSI's ISO Procedure Templates and Guides handle this across fifteen procedure topics and five standards, and the IMS Internal Audit Procedure Template and Guide writes auditor independence as a decision test rather than an intention — the exact construction Mark 1 calls for. The companion ISO manual templates cover the layer above.
What Changed in 2026
How ISO 19011:2026 Raised the Bar for ISO Internal Audits
Remote. Digital. Accountable.
Direct Answer: ISO 19011:2026 changed ISO internal audits in four ways that touch auditor evaluation directly: remote and hybrid auditing is embedded across the audit lifecycle rather than treated as an exception, auditor competence now explicitly includes digital and information-security capability, the risk-based approach to program design is strengthened, and attention to supply chains and interconnected operations is expanded. Competence criteria written before May 2026 are almost certainly incomplete.
In ISO internal audits, remote auditing moved from a pandemic workaround to a designed method. The practical consequence for evaluation is that method selection is now an auditor competence — knowing when a process can be audited remotely, when it cannot, and how to compensate. An auditor who defaults to video calls because they are convenient is making a competence error, not a logistics choice.
The information-security dimension is the genuinely new one for ISO internal audits. Granting an auditor access to live systems creates obligations that did not exist when audits ran on paper and a conference room. Platform-specific competence, evidence-reliability judgment, and data-handling discipline all now belong in the criteria. Most organizations have not updated the criteria, which means most organizations are evaluating auditors against a 2018 standard that no longer exists.
Two other 2026 currents shape the same work. ISO 14001:2026 published on 15 April 2026 with a transition deadline of 30 April 2029, and its per-audit objectives requirement changes what an audit plan must contain. ISO 9001:2026 is confirmed for publication on 16 September 2026 with an expected three-year transition — which means audit programs built this year will be auditing a revised quality standard within the same cycle. Organizations that treat ISO internal audits as the place where transition readiness gets tested will find the transition considerably less eventful than those that do not.
Related reading
ISO 19011:2026 Changes · Internal Audit Procedure: The Essential Edits · Internal Audit Skills · Integrated Management Systems · ISO Overview
Ninety Days
A 90-Day Sequence to Qualify the People Running Your ISO Internal Audits
Define. Evaluate. Evidence.
Direct Answer: Qualifying the people who conduct your ISO internal audits takes about ninety days of part-time effort: three weeks to define criteria and reconcile them with your existing procedure, four weeks to train or refresh, four weeks to evaluate through observed audits, and a final two weeks to build the record set and wire the outputs into management review.
Weeks 1–3 — Define and reconcile. Write competence criteria covering standard knowledge, audit method including remote and hybrid, sector or process knowledge, and digital evidence handling. Then read your existing internal audit procedure against them and resolve every mismatch. This is the step that prevents the qualification records trap.
Weeks 4–7 — Train or refresh. Formal training for new auditors; a targeted refresh on the 2026 changes for experienced ones. Experienced auditors resist this and should not: the digital and remote content is genuinely new, and they are the ones most likely to be auditing on autopilot.
Weeks 8–11 — Evaluate through observation. Every auditor conducts one audit with an experienced observer present. The observer scores against the criteria and writes it down. This single step produces more improvement in finding quality than any classroom hour, and it produces the record a registrar will ask for.
Weeks 12–13 — Evidence and wire in. Build the competence record set — criteria, training, evaluation, and a review date for each auditor. Then confirm the reporting format gives management review what it needs, because an audit program that does not reach leadership is an expense rather than a control.
Organizations that would rather not run the qualification of their ISO internal audits alone have options across the spectrum. SureFinish compresses advisory into six weeks. SurePath delivers certification turnkey. SureResults maintains the system year-round once certified. And The Portrait provides the independent operational read that Mark 1 asks for when internal separation is not available.
Choose Your Path
Five Ways to Strengthen Your ISO Internal Audits This Quarter
Templates. Training. Judgment.
1 — Get the procedure that already makes the judgment calls
Twenty-eight years of practice, written down. Fifteen procedure topics across five standards and their combinations, editable Word, with the decisions already made — including the auditor independence rule written as a decision test rather than a hope.
2 — Rebuild the internal audit procedure itself, integrated
One procedure serving ISO 9001, ISO 14001:2026, and ISO 45001 together, with all twenty-two clause obligations cross-referenced, every divergence resolved to the stricter standard, and a scoreable eight-element maturity ladder built in. Written for the organization that has to satisfy three registrar expectations with one document.
3 — Bring in an independent auditor for the processes you cannot audit yourself
If Mark 1 exposed a process whose auditor and owner are the same person, that is the process to outsource first. MSI conducts internal audits as a service and assesses the maturity of existing programs — an independent read that surfaces the finding while you still control the timeline.
4 — Build the bench, and get the record that proves it
The ISO Internal Auditor Workshop is the low-commitment on-ramp; the two-day ISO 9001 internal auditing course goes to the depth a lead auditor needs. Both finish with a documented qualification a registrar will recognize — which is the part an online certificate does not give you.
ISO Internal Auditor Workshop → · 2-Day ISO 9001 Internal Auditing →
5 — Close the loop into management review
Audit results are a required management review input under ISO 9001, ISO 13485, and ISO 14001. If your audit output arrives as a stack of findings rather than a read on system performance, the toolkits fix the format — agendas, input templates, and the record structure that makes the review defensible.
Not sure which of the five you need?
A thirty-minute planning session will tell you whether your internal audit function needs a procedure, a person, or a rebuild. No prepared materials required — bring your last audit report and your internal audit procedure.
Call 760-434-9141 · See how MSI ISO consulting works → · Contact MSI →
Questions
ISO Internal Audits: Frequently Asked Questions
Ask. Answer. Apply.
Who is allowed to conduct ISO internal audits?
Anyone the organization has determined to be competent, provided they do not audit their own work. ISO internal audits may be conducted by employees from other departments, by a dedicated quality function, or by contracted external auditors acting on the organization's behalf — all three count as first-party audits. There is no requirement for an external certificate; there is a requirement that the organization define competence criteria and hold evidence that its auditors meet them.
How often must ISO internal audits be conducted?
At planned intervals, determined by risk rather than by calendar convenience. No standard specifies a frequency. In practice most certified organizations cover every process and every clause across an annual cycle, weighting higher-risk processes more often. ISO internal audits should also be triggered by events — a significant process change, a customer complaint pattern, a major nonconformity, or a new site coming into scope.
Does ISO 19011:2026 apply to internal audits?
Yes, and it is the primary guidance for them. ISO 19011 addresses first-party (internal) and second-party audits specifically. It is guidance rather than a requirements standard, so you are not audited against it directly — but it supplies the competence criteria, auditing principles, and program management approach that make ISO internal audits defensible. The 2026 edition published on 27 May 2026 and withdrew the 2018 edition with no transition period.
Can the same person write a procedure and audit it?
Not without a compensating control. Auditing a document you authored within the current revision cycle fails the independence principle, and a registrar will treat it as an objectivity concern. Small organizations that cannot avoid this should document the compensating control explicitly — a second-auditor review, an external reviewer, or outsourcing that specific audit. ISO internal audits tolerate constrained resources; they do not tolerate an undocumented conflict.
What records must be kept for ISO internal audits?
The audit program, evidence that it was implemented, and evidence of the audit results — plus, in ISO 14001:2026, the audit program itself must be available as documented information. Alongside these, keep auditor competence records: criteria, qualification evidence, evaluation results, and a review date. ISO internal audits lose most of their defensibility when the competence records are the missing piece.
How will the 2026 standard revisions change ISO internal audits?
Three ways. ISO 19011:2026 raised competence expectations to include digital and remote capability. ISO 14001:2026, published 15 April 2026 with a 30 April 2029 transition deadline, made per-audit objectives a requirement and asks for the audit program to be available. ISO 9001:2026, confirmed for publication on 16 September 2026 with an expected three-year transition, will bring the quality standard into the same wave. ISO internal audits are the natural place to test transition readiness before a certification body does.
References and further reading
ISO 19011, Guidelines for auditing management systems, fourth edition. International Organization for Standardization. iso.org
ISO 9001, Quality management systems — Requirements. International Organization for Standardization. iso.org
ISO 14001, Environmental management systems — Requirements with guidance for use, fourth edition. International Organization for Standardization. iso.org
ISO 45001, Occupational health and safety management systems. International Organization for Standardization. iso.org
ISO 13485, Medical devices — Quality management systems. International Organization for Standardization. iso.org
ISO/IEC 17021-1, Requirements for bodies providing audit and certification of management systems. iso.org
ISO Online Browsing Platform — terms and definitions. iso.org/obp
Global Accreditation Cooperation Incorporated (Global ACI). global-aci.org
ANSI National Accreditation Board (ANAB) — management systems accreditation. anab.ansi.org
American Society for Quality — auditing resources. asq.org
The Institute of Internal Auditors — Global Internal Audit Standards. theiia.org
Chartered Quality Institute — quality and audit guidance. quality.org
U.S. Food and Drug Administration — Quality Management System Regulation (QMSR). fda.gov
21 CFR Part 820 — Quality Management System Regulation. Electronic Code of Federal Regulations. ecfr.gov
About Management Systems International (MSI)
Management Systems International (MSI) is a veteran-owned, female-owned ISO consulting firm founded in 1998. With 28 years of experience including extensive AS9100 work in MSI's early years, MSI's track record includes 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries.
Today MSI implements ISO 9001, ISO 13485, ISO 14001, and ISO 45001, with an expanding focus on ISO 7101 healthcare quality.
msi-international.com · 760-434-9141
