← Insights

Audits

Internal audits that run themselves

July 2026 · 6 min read

Every certified company has an audit programme. Usually it is a wall chart or a spreadsheet made in January: twelve processes down the side, twelve months across the top, a tidy diagonal of planned audits. And by March it is fiction. Two audits slipped, nobody moved the marker, the findings from February live in someone's notebook, and when the certification body arrives in November the quality manager spends a fortnight reconstructing what actually happened.

The problem is not discipline. The problem is that a wall chart records intentions and nothing else. A working audit programme has to track three moving things at once - the plan, the execution and the findings - and keep them connected. If the connections depend on a human remembering to update a status cell, the programme decays at the speed of the busiest month.

What ISO 9001 actually asks for

Clause 9.2 is short and often misread. It asks for audits at planned intervals, a programme that considers the importance of the processes concerned and the results of previous audits, objective and impartial auditors, reported results, timely correction, and retained documented evidence of the programme and the results.

Two phrases in there do most of the work. "Importance of the processes" means the programme must be risk-based: your special-process welding line and your goods-in inspection do not deserve the same audit frequency as the stationery cupboard. And "results of previous audits" means the programme is a loop, not a calendar - a process that produced a major nonconformity last time should see an auditor again sooner, not in twelve months when the wall chart says so.

Neither requirement is hard. Both are impossible to demonstrate from a chart that only shows planned months.

The three-part system, and the joints that matter

A programme that runs itself has three parts, and the intelligence lives in the joints between them:

• The programme - one row per audit: process, the clauses it covers, a risk priority, the auditor, planned date, actual date. Status should compute from the dates: no actual date and the planned month has passed means Overdue, and it should turn red without anyone's help. The day you rely on a human to type "overdue" into a cell is the day the programme starts lying.
• The checklist - what the auditor takes into the room. Process-based questions, not clause-by-clause interrogation: "show me how you know this gauge is in calibration" finds more than "do you have a documented procedure for 7.1.5?". Results in four grades - conforming, opportunity for improvement, minor NC, major NC - so the output feeds the log without translation.
• The findings log - every NC and OFI with an owner, a due date and a status that computes from the dates, exactly like the programme. Findings are where audit programmes go to die: raised with good intentions, assigned to nobody in particular, closed by the passage of time. A findings log with automatic overdue flags is the difference between an audit programme and an audit theatre.

The joint that matters most: each audit's findings should be counted back to it automatically, by audit reference. When the programme row for the June welding audit says "3 findings, 1 open", and that number came from the log rather than from memory, the loop is closed.

Risk-based scheduling in practice

You do not need a scoring model. Three bands work: High - special processes, customer-facing processes, anything with a major finding in the last cycle, anything new or recently changed. Medium - the core value stream running steadily. Low - support processes with a clean history. High-risk processes get two or more visits a year; low-risk ones can stretch to eighteen months if your certification body agrees. Write the rationale down - "audit frequency reflects process risk and previous results" is a sentence an auditor will ask you to prove.

Then let the previous results move the bands. A clean audit demotes a process one band; a major NC promotes it and triggers a follow-up visit within ninety days. That single rule, applied honestly, is what "results of previous audits" means - and it is the part external auditors most often find missing.

What the dashboard is for

A live view over the programme answers the management-review questions before they are asked: audits planned versus complete, the completion rate, findings by type, and the audit load by month so you can see the October pile-up in July and move something. When those numbers compute from the programme and the log, the management-review pack writes itself - and the November reconstruction fortnight disappears.

If your wider QMS documentation needs the same treatment, start with ISO 9001 without drowning in documents. And for the daily shop-floor layer that catches drift between internal audits, see layered process audits.