internal audit

An internal audit is a systematic, documented review that an organization performs on its own management systems, processes, or operations to verify that they conform to defined requirements. These requirements may come from internal procedures, customer-specific requirements, or external standards such as ISO 9001 or IATF 16949. Internal audits are planned, repeatable activities and are usually performed by personnel who are independent of the area being audited.

In industrial and regulated manufacturing environments, internal audits commonly focus on quality management systems (QMS), environmental management, information security, production controls, and compliance with documented work instructions and change-control processes. Internal auditors examine evidence such as records, logs, system transactions (for example in MES or ERP), and physical conditions on the shop floor to determine whether processes are implemented as documented and are effective.

Key characteristics

• Performed by or for the organization itself: Auditors may be employees or contracted resources, but they act on behalf of the organization, not a certification body or regulator.
• Criteria-based: Audit criteria are defined in advance, such as specific clauses of a standard, internal procedures, or customer requirements.
• Evidence-driven: Findings are based on objective evidence, including records, system data, interviews, and observations.
• Documented outputs: Results are recorded as conformities, nonconformities, and observations, usually with documented corrective actions and follow-up.
• Planned and cyclical: Internal audit programs typically operate on an annual or multi-year cycle, with risk-based prioritization of processes, sites, or systems.

Operational role in manufacturing environments

Within manufacturing operations, internal audits commonly:

• Verify that production and quality processes follow documented work instructions and control plans.
• Check that MES, LIMS, ERP, and other OT/IT systems are being used as intended and that records are complete, accurate, and traceable.
• Review change-control, validation, calibration, and maintenance records to confirm adherence to internal and external requirements.
• Assess the effectiveness of CAPA activities, risk controls, and problem-resolution processes.
• Provide inputs to management review regarding system performance and areas needing improvement.

Common confusion

• Internal audit vs. external audit: An internal audit is initiated by the organization and performed by or on its behalf. An external audit is performed by a customer, certification body, or regulator to assess conformance with external requirements.
• Internal audit vs. inspection: An inspection usually checks products or specific outputs (for example, in-process or final inspection). An internal audit evaluates the management system and processes that produce those outputs.
• Internal audit vs. self-assessment: A self-assessment is often less formal and may be performed by the process owner. An internal audit typically requires some degree of auditor independence and follows a defined audit program and methodology.

Relation to standards such as IATF 16949

In standards that follow the ISO High-Level Structure, including IATF 16949, internal audits are a formal requirement for monitoring the effectiveness and conformity of the quality management system. Organizations are expected to plan, conduct, and document internal audits against relevant clauses and their own processes, and to address identified nonconformities through corrective action and follow-up.