Templates and records · SGE 21 · Clause 6.1.11
SGE 21 annual internal audit report template
The annual review of the system against the requirements of the standard, with the deviations found, the actions to correct them and the conclusions for the committee.
In one sentence
The SGE 21 annual internal audit report sets out the conclusions of the system audit, the deviations found and the actions to correct them, and is made available to the committee, because section 6.1.11 requires an audit every year, the process to be defined in a document and those two records to be maintained.
- Where the standard requires it
- SGE 21 · Clause 6.1.11 Sections are cited using the numbering of the October 2024 version of SGE 21, the one Foretica publishes on its website. The Academy groups its nine management areas into six blocks.
- Type of information
- Mandatory record Records that must be maintained (6.1.11 b)
- Who fills it in
- Internal auditor independent of the area Or a third party; ISO 19011 serves as guidance for planning and conducting it
- When
- Once a year Before the management review and the external audit
- How long it is kept
- Set by the organisation The standard sets no periods. Covering at least the three-year certification cycle, with the initial audit and two surveillance audits, lets you show progress at every visit.
What the standard requires
What SGE 21 demands and what it leaves to your judgement
The standard requires annual internal audits of the system to check that it is properly applied, how it is evolving and whether it conforms to the standard. The process must be described in a document setting out responsibilities, criteria, methods and scope that guarantee objectivity and impartiality.
At least two records must be maintained: the deviations with the actions to correct them, and a report with the conclusions available to the committee. Audit reports are also a mandatory input to the management review (6.1.12).
Unlike ISO 9001, which leaves frequency to the audit programme, here the annual cycle is fixed and no areas may be excluded.
Structure
Fields the template should include
- Date, auditor and guarantee of impartiality
- Scope: management areas and sites
- Criteria: SGE 21 sections and the organisation’s own documents
- Evidence reviewed and interviews
- Deviations found and requirement affected
- Actions to correct them, owner and deadline
- Conclusions on how the system is applied and evolving
- Submission to the committee
Example
Example: 2026 internal audit (fictitious company)
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Date and auditor | 15 and 16 September 2026 · contracted external auditor |
| Scope | All nine management areas · head office and 4 of 31 sites |
| Deviation 1 | Work-life balance plan not updated since 2022 (6.2.4) · update before December · people |
| Deviation 2 | No public breakdown of taxes by country (6.9.2) · publish on the website · finance |
| Strengths | Ethics channel meeting its deadlines and complete supplier approval |
| Conclusion | Effective system with two minor deviations |
| Submission | Report presented to the committee on 30 September 2026 |
At the audit
Mistakes auditors commonly flag
- More than a year has passed between audits.
- There is no document describing the audit process.
- Areas such as investors or public authorities are left out.
- The report never reaches the committee.
- Deviations have no action and no owner.
In Kimobox
How this record is kept in Kimobox
- 1Each audit has its own checklist per standard, completed on the platform.
- 2Deviations are linked to nonconformities with a root cause and an action with an owner.
- 3The report is kept as a controlled document and shared with the committee.
- 4The certification auditor can log in with a read-only user.
Frequently asked questions
What people ask us before getting started
Can someone from the company itself carry it out?
Yes, if the process guarantees objectivity and impartiality: nobody should audit their own work. Many companies hire an external auditor for the areas the system manager runs.
Must all nine areas be audited every year?
The standard requires the system to be audited every year and allows no exclusion of requirements; the usual practice is to cover all nine areas, going deeper into those that had deviations.
Keep your SGE 21 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 9001 internal audit report template
What an ISO 9001 internal audit report must contain: scope, criteria, evidence, classified findings and…
Organizational governance and ethics
The first block of SGE 21 requires the governing body to oversee sustainability through a governance model…
SGE 21 code of conduct template
What the code of conduct required by SGE 21 (6.1.2) must include: approval by the governing body, a channel…
SGE 21 ethics and sustainability committee minutes template
How to document the meetings of the committee required by SGE 21 (6.1.3): membership, six-monthly frequency…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- SGE 21. Sistema de Gestión Ética, Sostenible y Responsable (Ethical, Sustainable and Responsible Management System) Forética · October 2024 version
- ISO 19011:2018 — Guidelines for auditing management systems ISO · 2018 ed.