Managing several ISO standards can turn internal audit planning into a complicated calendar. Separate checklists, repeated interviews and competing deadlines make it difficult to see whether the right areas have received enough attention.
A practical approach starts with the way your organisation works, then maps the relevant requirements to those activities. Here is a planning method you can adapt.
1. Define what the programme needs to achieve
Write down the standards, editions, sites and activities within scope. Include your own procedures and any relevant customer or contractual criteria. Identify what management needs to learn from the audits: for example, whether a new supplier process is working or whether repeat complaints have been addressed.
Keep a programme-level view of planned audits and a separate plan for each audit. In your working plan, record the topic, scope, criteria, timing, auditor and expected output.
2. Group work around real processes
Consider a contractor managing quality, environmental and occupational health and safety arrangements. One supplier-management audit could examine how subcontractors are selected, briefed and monitored. The same visit might review service quality, waste-handling arrangements and safety controls.
That does not mean one satisfactory answer establishes conformity with every standard. List each relevant requirement and collect evidence appropriate to it. A supplier's quality assessment will not, by itself, demonstrate that environmental or safety controls are effective.
3. Give higher-risk areas more attention
For ISO 9001:2015, audit planning takes account of process importance, organisational changes and previous audit results. The ISO 9001 Auditing Practices Group's internal audit guidance discusses prioritising areas with greater risk or nonconformities. It is educational guidance, rather than an additional certification requirement.
For your other standards, check their applicable audit requirements separately. Use a short rationale for each frequency decision so another manager can understand the schedule.
For example, a new depot with unfamiliar subcontractors may justify an early audit. A recurring paperwork error may need a focused follow-up. An established process with stable results might need a different approach. Equal calendar spacing is convenient, but should not decide the entire programme.
4. Build a schedule that you can adjust
The following is an illustrative structure for a contractor operating several management systems. It is not a complete coverage map or a prescribed annual cycle.
| Period | Theme | Example questions |
|---|---|---|
| Quarter 1 | Leadership and planning | Who owns the objectives? How are changes and priorities communicated? |
| Quarter 2 | People and suppliers | How are competence and subcontractor arrangements checked before work starts? |
| Quarter 3 | Operational delivery | Can a sample of recent jobs demonstrate the required quality, environmental and safety checks? |
| Quarter 4 | Performance and improvement | What do results show, and have actions resolved the problems they addressed? |
Map all applicable criteria into the detailed programme and check for gaps. Add focused audits or revisit topics when the evidence warrants it. Repeating an area can be useful; repeating the same checklist automatically every quarter can waste effort.
5. Assign auditors who can assess the topic
Consider competence and impartiality alongside availability. Someone who understands service quality may need additional expertise to assess specialist environmental or safety matters. Check that your audit team can cover the assigned criteria objectively.
Record assignments for individual audits. If someone becomes unavailable, hand over the scope, completed work, evidence and remaining tasks. Preserve who performed each part of the audit rather than rewriting the history under the replacement auditor's name.
6. Follow findings beyond the report
Use a clear record for each finding: the criterion, evidence, issue and responsible owner. Keep the immediate response distinct from any investigation and longer-term corrective action.
For example, replacing a missing inspection record does not explain why the inspection record was missing. A useful follow-up asks whether the revised arrangement worked on subsequent jobs.
Bring overdue actions, repeat findings and uncovered areas into programme reviews. The next schedule should reflect what you learned from the previous audits.
7. Use software to organise the work
Veqrin supports audit programmes, scheduled audits, individual auditor assignments, findings, approvals and PDF reports. Use the available standard criteria as a starting point, then review the programme against your organisation's scope, risks and applicable requirements.
Before relying on any generated schedule, check coverage, timing and the available auditors. Software can organise work; your organisation remains responsible for the audit decisions and conclusions.
See how Veqrin organises internal audits
Explore the programme, schedule and reporting screens at your own pace through the self-guided tour.
Explore the self-guided tour →Reference: ISO 9001 Auditing Practices Group, Internal Audits guidance, linked above. Examples are illustrative. Check the requirements and editions applicable to each of your management systems.