# Internal Audit Program & Report

> Mandatory – ISO 9001/27001 cl.9.2. TWO artifacts:
> (a) the **program** (schedule covering the whole MS over the cycle)
> (b) the **report** (each audit's findings). Audit the system, not
> just documents.

| Field | Value |
|-------|-------|
| Year | YYYY |
| Standard(s) | ISO XXXXX |
| Program owner | Management representative |
| Audit criteria | Standard clauses + internal policies |

## Part A – Audit program (the plan)

| Audit # | Scope / process | Clauses | Auditor | Auditee | Planned date | Status |
|---------|-----------------|---------|---------|---------|--------------|--------|
| A-01 | Document control | 7.5 | @name | @team | Q1 | Done |
| A-02 | Risk process | 6.1, 8.2 | @name | @team | Q2 | Planned |
| A-03 | Operations | 8.x | @name | @team | Q3 | |
| A-04 | Improvement/CAPA | 9, 10 | @name | @team | Q4 | |

## Part B – Audit report (per audit)

| Field | Value |
|-------|-------|
| Audit ref | A-NN-YYYY |
| Date | YYYY-MM-DD |
| Auditor | @name (independent of area audited) |
| Auditee | @name / team |

### Scope & criteria

What was audited, against which clauses and internal documents.

### Methodology

- Interviews: who was spoken with
- Sampling: records reviewed (list IDs)
- Observation: what was witnessed

### Findings

| # | Type | Clause | Finding | Evidence |
|---|------|--------|---------|----------|
| F-1 | Major NC | 8.2.1 | requirement not met | record ref |
| F-2 | Minor NC | 7.5.3 | document not controlled | sample ref |
| F-3 | OFI | – | opportunity for improvement | observation |
| F-4 | Positive | 9.1 | strong practice noted | – |

### Conclusion

Overall conformance assessment; ISMS/QMS effectiveness statement.

### Agreed actions

| Finding | Corrective action | Owner | Due |
|---------|-------------------|-------|-----|
| F-1 | Action | @name | YYYY-MM-DD |

### Follow-up

| Action | Verified | Date | Effective? |
|--------|----------|------|------------|
| F-1 action | yes/no | | |