Internal Audit Program & Report

Mandatory – ISO 9001/27001 cl.9.2. TWO artifacts: (a) the program (schedule covering the whole MS over the cycle) (b) the report (each audit's findings). Audit the system, not just documents.

Field	Value
Year	YYYY
Standard(s)	ISO XXXXX
Program owner	Management representative
Audit criteria	Standard clauses + internal policies

Part A – Audit program (the plan)

Audit #	Scope / process	Clauses	Auditor	Auditee	Planned date	Status
A-01	Document control	7.5	@name	@team	Q1	Done
A-02	Risk process	6.1, 8.2	@name	@team	Q2	Planned
A-03	Operations	8.x	@name	@team	Q3
A-04	Improvement/CAPA	9, 10	@name	@team	Q4

Part B – Audit report (per audit)

Field	Value
Audit ref	A-NN-YYYY
Date	YYYY-MM-DD
Auditor	@name (independent of area audited)
Auditee	@name / team

Scope & criteria

What was audited, against which clauses and internal documents.

Methodology

• Interviews: who was spoken with
• Sampling: records reviewed (list IDs)
• Observation: what was witnessed

Findings

#	Type	Clause	Finding	Evidence
F-1	Major NC	8.2.1	requirement not met	record ref
F-2	Minor NC	7.5.3	document not controlled	sample ref
F-3	OFI	–	opportunity for improvement	observation
F-4	Positive	9.1	strong practice noted	–

Conclusion

Overall conformance assessment; ISMS/QMS effectiveness statement.

Agreed actions

Finding	Corrective action	Owner	Due
F-1	Action	@name	YYYY-MM-DD

Follow-up

Action	Verified	Date	Effective?
F-1 action	yes/no