Internal Audit Program & Report
Mandatory – ISO 9001/27001 cl.9.2. TWO artifacts:
(a) the program (schedule covering the whole MS over the cycle)
(b) the report (each audit's findings). Audit the system, not
just documents.
| Field | Value |
|---|
| Year | YYYY |
| Standard(s) | ISO XXXXX |
| Program owner | Management representative |
| Audit criteria | Standard clauses + internal policies |
Part A – Audit program (the plan)
| Audit # | Scope / process | Clauses | Auditor | Auditee | Planned date | Status |
|---|
| A-01 | Document control | 7.5 | @name | @team | Q1 | Done |
| A-02 | Risk process | 6.1, 8.2 | @name | @team | Q2 | Planned |
| A-03 | Operations | 8.x | @name | @team | Q3 | |
| A-04 | Improvement/CAPA | 9, 10 | @name | @team | Q4 | |
Part B – Audit report (per audit)
| Field | Value |
|---|
| Audit ref | A-NN-YYYY |
| Date | YYYY-MM-DD |
| Auditor | @name (independent of area audited) |
| Auditee | @name / team |
Scope & criteria
What was audited, against which clauses and internal documents.
Methodology
- Interviews: who was spoken with
- Sampling: records reviewed (list IDs)
- Observation: what was witnessed
Findings
| # | Type | Clause | Finding | Evidence |
|---|
| F-1 | Major NC | 8.2.1 | requirement not met | record ref |
| F-2 | Minor NC | 7.5.3 | document not controlled | sample ref |
| F-3 | OFI | – | opportunity for improvement | observation |
| F-4 | Positive | 9.1 | strong practice noted | – |
Conclusion
Overall conformance assessment; ISMS/QMS effectiveness statement.
Agreed actions
| Finding | Corrective action | Owner | Due |
|---|
| F-1 | Action | @name | YYYY-MM-DD |
Follow-up
| Action | Verified | Date | Effective? |
|---|
| F-1 action | yes/no | | |