Internal Audit Plan Template Iso 9001

Standard Operating Procedure: Internal Audit Plan Template ISO 9001

Document ID: SOP-OPS-ISO9001-042
Effective Date: October 24, 2023
Target Audience: Quality Management, Internal Auditors, Process Owners, Executive Leadership

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory methodology, documentation structures, and execution lifecycle for planning, executing, and reporting internal quality audits. The framework is strictly bound to the requirements of ISO 9001:2015 (Quality Management Systems – Requirements).

2.2 Operational Scope

The scope encompasses all operational tiers, manufacturing divisions, service delivery units, and administrative functions included within the enterprise Quality Management System (QMS). Adherence to this SOP ensures impartial evaluation of process performance, statutory and regulatory compliance, and identification of systemic risks or opportunities for continuous improvement.

---

3. Prerequisites & Tool Requirements

Prior to initiating the audit lifecycle, execution personnel and system administrators must secure the following resources:

• Software Access: Enterprise QMS platform (e.g., EtQ, MasterControl, or equivalent), read/write access to the centralized document repository, and secure data analytics tooling (PowerBI/Tableau QMS dashboards).
• Certifications: Lead Auditor certification (ISO 9001:2015 Certified Internal Auditor or IRCA equivalent) for Lead Auditors; foundational internal auditor training for supporting team members.
• Documentation Artifacts: Previous year’s internal/external audit reports, current Quality Manual, Level 2/3 Process Procedures, and the organization's Risk Register.
• Equipment: Encrypted audit workstation, mobile device for facility walkthroughs (if authorized), and digital voice recorder (subject to auditee consent).

---

4. Roles & Responsibilities (RACI Matrix Table)

Legend: R = Responsible, A = Accountable, C = Consulted, I = Informed

---

5. Step-by-Step Operational Procedure

Phase 1: Audit Initiation & Annual Scheduling

• Review the enterprise risk register and previous audit nonconformities to determine high-risk operational areas.
• Establish the annual internal audit schedule, ensuring all ISO 9001 clauses (Clause 4 through 10) are covered within a defined 12-month cycle.
• Assign an independent Lead Auditor who has no direct operational responsibility or financial interest in the processes being evaluated.

Phase 2: Audit Plan Development & Notification

• Draft the specific Audit Plan specifying scope, objectives, criteria (ISO 9001:2015 standard), and resource allocations.
• Coordinate with Process Owners to confirm site access, resource availability, and the operational timetable.
• Issue the formal Audit Notification and finalized Plan to the Process Owner and relevant stakeholders at least fourteen (14) business days prior to execution.

Phase 3: Document Review & Checklist Generation

• Collect and analyze applicable SOPs, work instructions, quality objectives, and key performance indicators (KPIs) associated with the targeted process.
• Develop a customized, clause-by-clause audit checklist within the QMS platform to ensure objective evidence collection.
• Verify that sampling methodologies (e.g., statistical sampling of batch records, customer complaints, or training logs) are defined prior to field execution.

Phase 4: Field Execution & Evidence Collection

• Conduct the formal Opening Meeting with the Process Owner and audit team to review scope, methodology, and logistical constraints.
• Execute interviews, observe live operations, and sample physical/digital records to evaluate procedural adherence and system efficacy.
• Document objective evidence for both conformances and potential discrepancies (findings) in real-time within the audit workpapers.
• Conduct a daily debrief with the Process Owner to communicate preliminary observations and mitigate misunderstandings.

Phase 5: Reporting & Corrective Action Tracking

• Synthesize collected evidence during the Closing Meeting, presenting factual findings and preliminary conclusions to leadership and auditees.
• Author the formal Internal Audit Report within five (5) business days of audit closure, detailing Major Nonconformities, Minor Nonconformities, and Opportunities for Improvement (OFI).
• Require the Process Owner to submit a Root Cause Analysis (RCA) and Corrective Action Preventive Action (CAPA) plan within fourteen (14) calendar days of report issuance.
• Verify the implementation and effectiveness of approved CAPAs within the mandated timeframe (not to exceed 90 days from finding issuance).

---

6. Quality Assurance & Verification Criteria

To maintain institutional compliance and structural integrity, audits must meet the following performance benchmarks:

• Impartiality Threshold: Zero instances of self-audit. If an auditor is found to have held a direct reporting line or operational duty within the audited process within the past 12 months, the audit is nullified and rescheduled.
• Sampling Rigor: For routine operational processes, a minimum sample size of $n = 5$ distinct operational cycles/records must be reviewed. For high-risk or automated processes, sampling must scale to ensure statistical significance ($n = 10$ to $30$, or 100% automated logging verification).
• Nonconformity Classification Criteria:
  • Major Nonconformity: Total systemic breakdown of an ISO 9001 requirement, absence of a mandated documented procedure, or a condition that directly results in nonconforming product/service reaching the customer.
  • Minor Nonconformity: Isolated procedural lapse, clerical documentation error, or failure to execute a single administrative step that does not compromise overall QMS efficacy.
  • Opportunity for Improvement (OFI): Operational suggestion that does not violate a specific ISO 9001 clause or internal procedure, but optimizes cycle time, risk posture, or efficiency.

---

7. Practical Troubleshooting Scenarios

Scenario A: Process Owner Refuses Access or Disputes Audit Findings

• Symptom: The Process Owner denies access to specific operational areas citing proprietary security concerns or openly contests a documented Major Nonconformity during the Closing Meeting.
• Immediate Corrective Action Protocol:
  1. The Lead Auditor must pause the contested session, document the exact refusal or dispute parameters in the working papers, and reference ISO 9001 Clause 9.2 requirements for mandatory internal auditing.
  2. Escalate immediately in writing to the Audit Program Manager and the Vice President of Quality.
  3. Convene an emergency alignment meeting with the Executive Sponsor of the QMS to enforce procedural compliance or establish NDA-governed audit parameters within 24 hours.

Scenario B: Discovery of Critical Systemic Failure Mid-Audit

• Symptom: During routine sampling, the auditor uncovers widespread falsification of quality inspection records or an unmitigated safety/regulatory breach affecting distributed product lines.
• Immediate Corrective Action Protocol:
  1. Immediately suspend the specific audit module to prevent operational disruption, but isolate the affected physical/digital evidence.
  2. Issue an immediate verbal and written "Stop-Work / Critical Alert" notice to the Executive Management team within two (2) hours.
  3. Pivot the audit scope to conduct a horizontal trace across all interdependent departments to determine the systemic boundary of the failure prior to issuing final reports.