QULDEXResources · Glossary
What is an internal audit? Purpose, process and examples
What is the purpose of an internal audit?
An internal audit answers two questions for management: are we doing what the standard and our own rules require, and is it working? The answer is given as findings, each backed by evidence.
Internal does not mean informal. The audit follows a programme and a plan, uses defined criteria, and produces a report that is kept as a record.
What are the stages of an internal audit?
Decide what is audited across the year, then plan each audit's scope, criteria and team.
Gather evidence by interview, observation, document review and sampling.
Report findings, agree corrective actions and check later that they worked.
What does an internal audit cover?
An internal audit of access management over three days.
| Item | What it looks like |
|---|---|
| Scope | Head office and cloud production; HR and IT operations |
| Criteria | ISO/IEC 27001:2022 and the access control policy |
| Sample | 25 joiners, 25 leavers, one quarterly access review |
| Result | Two minor nonconformities and one observation, with corrective actions agreed |
This is an illustration written for this page, not a customer record.
Which frameworks require internal audits?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 9.2 | Internal audits at planned intervals, an audit programme, objective and impartial auditors, and results reported to management. |
| ISO 9001 | Clause 9.2 | The same requirement for the quality management system. |
| ISO 42001 | Clause 9.2 | The same requirement for the AI management system. |
| SOC 2 | CC4.1 | Ongoing or separate evaluations confirm that the components of internal control are present and functioning. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What weakens an internal audit?
Auditing your own work
The person who runs the process also audits it.
Instead: use an auditor independent of the area.
Checklist only
Questions are ticked without looking at records.
Instead: sample real records and follow them through.
No follow-up
Findings are reported and then forgotten.
Instead: track each corrective action to verified closure.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Internal Audit: common questions
What is the difference between an internal and an external audit?
An internal audit is carried out by or for the organisation, for its own management. An external audit is carried out by an independent body, such as a certification body, a customer or a regulator.
How often should internal audits be done?
At planned intervals set by your audit programme. Most management system standards expect the whole system to be covered within the certification cycle, with higher-risk areas audited more often.
Can internal audit be outsourced?
Yes. A contracted auditor acting on your behalf still performs an internal audit, provided they are independent of the work audited.
Sources
- ISO 19011:2018, Guidelines for auditing management systems
- ISO/IEC 27001:2022, Information security management systems: Requirements
- The Institute of Internal Auditors, Global Internal Audit Standards (2024)
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Run the whole internal audit in one workspace
Controls, evidence, findings and corrective actions in one audit workspace.