Templates and records · ISO 9001 · Clause 9.2

ISO 9001 internal audit programme: template and example

Planning the internal audits for the cycle: which processes are audited, when, against which criteria and by whom, decided according to their importance and what previous audits found.

In one sentence

The internal audit programme is the plan for auditing the system — processes, frequency, methods, responsibilities and reporting — which ISO 9001 asks you to establish taking into account the importance of each process, changes and previous results, and for which clause 9.2.2 requires evidence of implementation to be retained.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 9001 · Clause 9.2 Clauses are cited using the numbering of the 2015 edition, the same one the Academy uses; certificates issued against it remain valid during the transition to the 2026 edition.
Type of information: Mandatory record Documented information to be retained (9.2.2)
Who fills it in: Quality manager They propose it, and top management or its delegate approves it
When: At the start of each period It is revised when processes change or findings justify it
How long it is kept: Set by the organisation The standard sets no periods: it asks you to decide on retention and disposition (7.5.3.2). Covering at least the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 9001 demands and what it leaves to your judgement

The standard asks for audits at planned intervals to check that the system conforms to its own requirements and those of the standard, and that it is effectively maintained. The programme must set out frequency, methods, responsibilities, planning requirements and reporting.

It does not require every process to be audited every year or with the same intensity: it requires the allocation to be justified by the importance of each process, the changes affecting it and previous findings. A process with recent complaints deserves more attention than a stable one.

Auditors must be selected so that the audit is objective and impartial; in practice, nobody audits their own work. ISO 19011 gives guidance on managing the programme.

Read it in context: Performance evaluation, in the ISO 9001 Academy

Structure

Fields the template should include

Period covered and approval date
Processes or areas to be audited and priority criterion
Frequency and planned dates
Scope and criteria of each audit (standard, procedures, customer requirements)
Assigned auditor and check of their independence from the area
Method: on site, remote, sampling of records
Status of each audit: planned, completed, postponed and reason
Link to the report of each completed audit

Example

Example: annual programme for a 60-person company

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Period	Year 2026 · approved by the managing director on 12 January
Purchasing and suppliers	March · production auditor · high priority after two supplier incidents in 2025
Production and release	April and October · contracted external auditor · process with the most complaints
Sales and order review	May · quality manager
Training and competence	June · purchasing officer
Management, risks and objectives	September · contracted external auditor
Criteria	ISO 9001, process manual v4 and the specifications of the two main customers
Status at 30 June	5 planned · 4 completed · 1 postponed to July due to the area's holidays

At the audit

Mistakes auditors commonly flag

The same schedule copied year after year, unrelated to results or changes.
The quality manager audits their own process.
Planned audits that do not take place and are not recorded as postponed or rescheduled.
The whole programme crammed into the weeks before the certification audit.
It is unclear which criteria are audited in each audit.

In Kimobox

How this record is kept in Kimobox

1The annual programme is planned in the platform itself, with each audit assigned to an auditor and a date.
2Each audit carries its checklist by standard, filled in on the platform without loose templates.
3Findings are linked to actions and nonconformities, so the next programme starts from real data.
4The certification auditor can log in with a read-only user to see the programme and how far it has been completed.

Frequently asked questions

What people ask us before getting started

Do all processes have to be audited every year?

The standard does not require it. It asks for the programme to take account of the importance of processes, changes and previous results. Many organisations cover the whole system in each three-year certification cycle and audit the most critical areas every year.

Can someone from within the company audit?

Yes, provided the audit is objective and impartial and the person has the necessary competence. What they must not do is audit their own work; for the quality area, another department or an external auditor is usually brought in.

Are the audit programme and the audit plan the same thing?

No. The programme brings together all the audits for a period; the plan describes one specific audit: agenda, interviews, documents to review. ISO 19011 distinguishes the two levels.

Keep your ISO 9001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 9001:2015 — Quality management systems. Requirements ISO · 2015 ed., with Amd 1:2024
ISO 19011:2018 — Guidelines for auditing management systems ISO · 2018 ed.
ISO 9001:2026 — Quality management systems. Requirements ISO · 2026 ed., published 16 September 2026