How often do ISO 9001 Internal Audits need to be conducted?

ISO 9001:2015 requirements do not set a specific interval for internal audits, and there are several factors to consider when planning your internal audit schedule.  Well established processes may only need to be audited annually, while new or complex processes may need to be audited quarterly, or even monthly.

 Establishing an internal audit program with audits occurring at planned intervals will help your organization be on board with the internal audit process.  It should be viewed as a positive experience for the organization, confirming that established processes are still working well, while also providing an opportunity to improve a new or problematic process. It should be a positive experience for employees, and it is important for them to fully participate.  It should not be viewed as a surprise check with negative repercussions, or employees may hide or falsify information, which may lead to an ineffective audit and potential nonconformities.

Factors Determining the Internal Audit Schedule

For each process that needs to be audited, ask the following questions:

How long has the process been in place?

A well-established process that has been in place for years does not need to be audited more than once per year.  A new process, or one that has recently changed, should be audited more frequently until management feels confident in the process, and there have been audits with zero nonconformities.

Have there been frequent nonconformities during prior audits? 

A process that has been historically problematic should be audited more frequently, perhaps monthly or quarterly, until any issues have been worked out.  As the process is revised, frequent audits provide an opportunity to test those changes and make sure the process has improved.

How complex is the process? 

The more complex or high-risk a process is, the more frequent the audits should be.  Complex processes are naturally going to have more places for error and nonconformities than simple processes.  A high-risk process that has had few nonconformities in the past should be audited more frequently than a simple process with lower risk. 

Are resources available? 

Internal audits require time from employees. If your organization has chosen to perform internal audits in-house, the auditors must have training, and they must set aside time to plan, perform, and follow-up on the audits.  Employees in the department being audited will also need to set aside time for audits and follow-up.  When setting your audit schedule, you may want to stagger the audits so that not every department is being audited at the same time.

ISO 9001:2015 does not make specific requirements for how often internal audits must be conducted. Your organization must consider each of these factors and determine a schedule that maintains compliance with the standard but does not exhaust resources or personnel.

If you need help with internal audits, you may want to find a qualified consultant near you that can perform the audits for you.