Internal audit / United Kingdom
ISO 9001 internal audit
A Clause 9.2 audit of your quality management system that follows real orders through your processes: customer requirements, design and production controls, nonconforming output, supplier performance and corrective action. Independent, evidence-based, fixed fee after scoping.
Last reviewed . Fees in pounds sterling plus VAT.
Can your process records explain the customer outcome?
Scope and fee
Priced by process,
not by page count.
The fee follows the number of processes and sites in scope and the depth of product or service sampling. It is fixed in writing after scoping and quoted in pounds sterling plus VAT.
What shapes an ISO 9001 audit fee
- Number of processes in the QMS scope and how many are customer-facing or product-realising
- Sites, shifts and whether production or service delivery must be observed in person
- Design and development in scope, outsourced processes and the supplier population to sample
- Depth of traceability testing: from enquiry and order through to delivery, complaint and corrective action
The requirement in context
ISO 9001 is audited through its processes.
ISO 9001:2015 is built on the process approach: the organisation defines the processes that turn customer requirements into conforming products and services, measures them, and improves them. An internal audit that reads the quality manual and ticks the clauses misses what the standard is for. A useful one takes a real order and follows it.
Clause 9.2 requires the internal audit to establish whether the QMS conforms to the organisation’s own requirements and to ISO 9001, and whether it is effectively implemented and maintained. In a quality system, effectiveness shows up in product and service conformity, on-time delivery, complaint handling, nonconforming-output decisions and supplier performance. Those are the records we sample.
UK certification to ISO 9001 is issued by UKAS-accredited certification bodies, who expect the internal audit programme to cover every clause and every process in scope across the three-year cycle, with the clauses most exposed to customer risk audited at least annually. Customers in regulated supply chains, from construction and engineering to NHS and local-authority tenders, often ask to see the internal audit report itself.
Inside the work
Follow one order
from enquiry to corrective action.
Original fictional working example for a UK engineering firm making machined components to customer drawings. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Process stage | Audit question (criterion) | Evidence sampled | What the sample showed |
|---|---|---|---|
| Customer requirements (8.2) | Were the drawing revision, tolerances and delivery date reviewed and confirmed before acceptance? | Five sales orders against the contract-review record and the customer’s purchase order. | Four reviewed and signed; one accepted against a superseded drawing revision, caught at inspection. |
| Production control (8.5.1) | Did the job traveller specify the operations, inspection points and acceptance criteria? | The five job travellers and the first-off inspection records. | All five specified operations; first-off inspection record missing for one job. |
| Monitoring and measuring resources (7.1.5) | Were the instruments used for final inspection within calibration? | Calibration register against the instruments named on the inspection records. | All in calibration; one micrometer’s label did not match the register date. |
| Nonconforming output (8.7) | Was the superseded-revision part controlled, decided on and recorded? | Nonconformance report, concession request and customer response. | Quarantined, concession refused, part scrapped and re-made; decision recorded with authority. |
| Corrective action (10.2) | Was the cause of the revision error analysed and acted on? | Corrective-action record and the amended contract-review checklist. | Cause identified (revision check not on the checklist); checklist amended; effectiveness check scheduled. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Traceability.
Decisions.
A report your customers can read.
The output is a report that shows how your processes performed against your own criteria on sampled work, written for management review and for the certification body, and often shared with key customers.
- Agreed audit criteria: ISO 9001:2015 clauses, your process definitions, customer and regulatory requirements in scope
- Process-based audit trails on sampled orders, projects or service cases, from requirement to delivery
- Tests of design and development control, supplier evaluation, calibration, nonconforming output and complaints
- Findings graded and tied to the clause and the process, with the product or service impact stated
- A report structured by process, with an action record for management review
How the audit runs
Map. Trace. Decide.
Three movements, each producing a record you keep. Elapsed time depends on the number of processes and sites and is agreed in the proposal.
Map the processes
Confirm the QMS scope, the process map, the interactions and the measures. Agree which orders, projects or service cases will be traced and which supplier and calibration populations will be sampled.
Trace the work
Follow each sampled case through contract review, planning, production or delivery, inspection, release and any nonconformance. Interview the people doing the work at each stage, not only the quality manager.
Decide and report
Compare each stage with its criterion, grade what the evidence supports, confirm the facts with process owners, and report by process with the customer impact and the corrective action owner named.
A practical starting point
Start from a complaint, a late delivery or a concession.
The best place to begin an ISO 9001 internal audit is where the system was under strain. A customer complaint, a late order or a concession request exercises contract review, planning, control of nonconforming output and corrective action in one trail, and shows whether the process approach is real.
A fabrication company receives a complaint that a batch of brackets was delivered with the wrong surface finish. The audit traces the order back: the finish was specified on the customer drawing, omitted from the job traveller, not caught at final inspection because the inspection sheet was generic, and the complaint was closed by re-finishing without a cause analysis. One trail produces findings under 8.2, 8.5.1, 8.6 and 10.2, and a corrective action that fixes the traveller template rather than the one batch.
Aegentra is Australian-headquartered. UK ISO 9001 audits are delivered remotely with on-site observation of production or service delivery agreed where the sample needs it; fees are quoted in pounds sterling plus VAT.
Before you commission the work
Your questions.
Clear answers.
What does an ISO 9001 internal audit cover?
All of ISO 9001:2015 Clauses 4 to 10 across the certification cycle, audited through the organisation’s own processes: context and interested parties, leadership and quality policy, risk-based planning and objectives, resources and competence, operational planning, customer requirements, design and development, external providers, production and service provision, release and nonconforming output, performance evaluation, internal audit and management review, and improvement. Each audit covers the processes agreed in the programme.
Do you audit the quality manual or the processes?
The processes. ISO 9001:2015 does not require a quality manual, and reading one tells an auditor little about whether orders are reviewed, work is controlled, product is released correctly and complaints lead to corrective action. We trace sampled orders, projects or service cases from requirement to delivery and test the records at each stage.
Can an ISO 9001 internal audit be combined with an ISO 27001 or ISO 45001 audit?
An integrated programme can share planning, interviews and the common management-system clauses, and we often schedule them together. The criteria, the operational evidence and the conclusions remain distinct: a conforming quality process says nothing about information security or worker safety. Each standard’s coverage is reported separately.
How much does an ISO 9001 internal audit cost in the UK?
The fee is fixed in writing after scoping and quoted in pounds sterling plus VAT. It depends on the number of processes and sites, whether design and development are in scope, the supplier population and the depth of traceability sampling. Send us your QMS scope and process map for a like-for-like quote.
Do you need to visit our site?
Usually for part of the audit. Document review, interviews and record sampling run remotely, but production control, inspection, calibration and storage are best observed in person. The proposal states which on-site days are included and why.
What happens with nonconforming product found during the audit?
We record it as audit evidence against Clause 8.7 and raise it with the process owner immediately so your own nonconformance procedure can act on it. The audit tests whether your process controls and decides on nonconforming output; it does not take over that decision.
Will you check our suppliers?
We audit your control of external providers under Clause 8.4: the evaluation criteria, the approved-supplier records, incoming inspection or verification, and how supplier performance feeds back into decisions. We sample suppliers from your register; we do not audit the suppliers themselves unless that is separately agreed.
How should we prepare?
Have the QMS scope, process map, quality policy and objectives, the risk and opportunity record, the approved-supplier list, the calibration register, recent orders or projects with their records, the nonconformance and complaint logs, previous audit reports and management-review minutes ready, and give us read access to the systems that hold them. Do not send confidential customer data through the enquiry form.
Let’s trace the process that matters most.
Tell us what you make or deliver, how many processes and sites are in scope and when your certification body is due.
Talk about your project