Templates and records · ISO 9001 · Clause 9.2

ISO 9001 internal audit report template

The outcome of each audit in the programme: what was reviewed, against which criteria, what was found and what will be done about it, reported to the management of the audited area.

In one sentence

The internal audit report records the scope and criteria of the audit, the evidence reviewed, the findings — conformities, nonconformities and opportunities for improvement — and the resulting actions, because ISO 9001 requires the results to be reported to relevant management and evidence of them to be retained (9.2.2).

Content reviewed on 17 October 2026

Where the standard requires it: ISO 9001 · Clause 9.2 Clauses are cited using the numbering of the 2015 edition, the same one the Academy uses; certificates issued against it remain valid during the transition to the 2026 edition.
Type of information: Mandatory record Documented information to be retained (9.2.2)
Who fills it in: The internal auditor The manager of the audited area receives and signs it
When: At the end of each audit It makes sense to issue it within a few days, while the evidence is fresh
How long it is kept: Set by the organisation The standard sets no periods: it asks you to decide on retention and disposition (7.5.3.2). Covering at least the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 9001 demands and what it leaves to your judgement

The results of each audit must reach the management responsible for the area, and corrections and corrective actions must be taken without undue delay.

The standard does not prescribe the structure of the report, but without scope, criteria and evidence a finding cannot be checked. ISO 19011 recommends that findings be based on verifiable evidence and that the report clearly distinguish nonconformities from observations.

A report with no nonconformities is possible, but a certification auditor will be wary of a whole year of internal audits without a single finding.

Read it in context: Performance evaluation, in the ISO 9001 Academy

Structure

Fields the template should include

Programme audit it relates to, date and auditor
Scope: process, site and period reviewed
Audit criteria
People interviewed and records reviewed
Classified findings: nonconformity, observation, opportunity for improvement
Evidence for each finding and the requirement it relates to
Strengths identified
Conclusion on the effectiveness of the process
Resulting actions with their nonconformity number
Distribution: who it is reported to

Example

Example: audit of the purchasing process

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Audit	IA-2026-02 · 18 March 2026 · production auditor
Scope	Purchasing and supplier evaluation, Ashford site, 2025 and first quarter of 2026
Criteria	ISO 9001 clause 8.4 and purchasing procedure v3
Evidence	Interview with the purchasing manager; 15 purchase orders and 8 supplier files reviewed
Nonconformity	2 of 8 critical suppliers without annual re-evaluation (8.4.1) · NC-2026-019
Observation	The evaluation criteria do not weight punctuality, which is the main internal complaint
Strength	Every order reviewed states the specification and acceptance criteria
Conclusion	Process implemented; effectiveness could improve in supplier monitoring
Reported to	Operations director and purchasing manager, 21 March

At the audit

Mistakes auditors commonly flag

Findings without evidence: "suppliers are not properly controlled".
Nonconformities in the report that are never opened in the nonconformity log.
Observations and nonconformities mixed together without classification.
The report never reaches the area manager, or reaches them months later.
Checklists filled in with "yes" without noting what was reviewed.

In Kimobox

How this record is kept in Kimobox

1The audit checklist is filled in directly on the platform, without loose templates.
2Each finding is classified and, if it is a nonconformity, opened from the report itself with its owner and deadline.
3Findings remain linked to the audit and its actions, visible to the area manager.
4The results of every audit reach the management review already aggregated.

Frequently asked questions

What people ask us before getting started

What is the difference between a nonconformity and an observation?

A nonconformity is the non-fulfilment of a requirement and calls for action. An observation points to something that still conforms but might stop doing so, or that could be improved; it is not binding, although it is worth recording what is decided.

Does the auditee have to sign it?

The standard does not require it. It does require the results to be reported to relevant management, and the signature or acknowledgement of the area manager is the simplest way to prove it.

Can the same report be used for several standards?

Yes. In an integrated system a single audit can cover ISO 9001, 14001 and 45001 at once, provided the report states which requirement of each standard each finding relates to.

Keep your ISO 9001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 9001:2015 — Quality management systems. Requirements ISO · 2015 ed., with Amd 1:2024
ISO 19011:2018 — Guidelines for auditing management systems ISO · 2018 ed.
ISO 9001:2026 — Quality management systems. Requirements ISO · 2026 ed., published 16 September 2026