Internal Auditing and Management Review

Introduction and Context

Internal auditing and management review are the principal mechanisms through which an ISO quality management system (QMS) evaluates its own effectiveness and converts evidence into improvement. Certification audits provide external confidence, but they cannot replace the organization’s own ability to detect risk, test controls, learn from failures, and make informed decisions.

ISO 9001 requires organizations to conduct internal audits at planned intervals and to review the QMS for continuing suitability, adequacy, effectiveness, and alignment with strategic direction. ISO 19011 provides guidance for auditing management systems, including audit principles, audit-programme management, audit conduct, and auditor competence.

At postgraduate level, auditing should not be understood as a compliance inspection alone. A mature audit examines whether intended arrangements are implemented, whether they achieve planned results, and whether the organization is learning from evidence. Management review should similarly be treated as a strategic governance process rather than a presentation of quality statistics.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Design a risk-based internal audit programme consistent with ISO 19011 principles.
2. Determine audit objectives, scope, criteria, methods, resources, and timing.
3. Evaluate auditor competence, independence, impartiality, and ethical conduct.
4. Apply appropriate sampling, interviewing, observation, and evidence-evaluation techniques.
5. Classify audit findings and develop effective corrective-action follow-up.
6. Design management reviews that connect QMS performance with strategic decisions.
7. Critically evaluate the limitations, risks, and technological implications of auditing.

1. Internal Auditing as an Assurance and Learning System

An internal audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. The definition contains four important ideas.

Systematic means that auditing follows a planned method rather than personal curiosity. Independent means that auditors should be free from responsibility for the activity being audited, or that safeguards must reduce conflicts of interest. Documented means that the basis for conclusions can be demonstrated. Objective evidence consists of records, statements of fact, observations, measurements, or other information relevant to the audit criteria and verifiable.

Audit criteria may include ISO 9001 requirements, organizational policies, process criteria, customer requirements, legal obligations, contractual conditions, and internally defined performance standards. Audit evidence is compared with those criteria to reach an audit conclusion.

An audit is therefore not the same as:

• a routine inspection of every transaction;
• a personal evaluation of an employee;
• a search for blame;
• a certification audit performed by an external body; or
• a consultancy exercise in which the auditor designs the solution.

The value of auditing lies in disciplined inquiry. An audit can reveal conformity, nonconformity, emerging risk, ineffective controls, opportunities for improvement, and weaknesses in the organization’s assumptions.

2. ISO 19011 Principles and Professional Judgement

ISO 19011 identifies principles that make auditing an effective and reliable activity. These principles are not merely ethical statements; they shape audit design and the credibility of conclusions.

A further practical principle is the risk-based approach. Audit effort should not be distributed equally merely because equal distribution appears administratively fair. A process with high customer impact, significant regulatory exposure, repeated failures, major change, or weak performance may deserve more frequent or deeper auditing than a stable low-risk process.

Professional judgement is unavoidable because audits are conducted under uncertainty. Auditors rarely examine every record or observe every activity. They must decide whether the evidence is sufficient, relevant, reliable, and representative. This is why an audit conclusion is an evidence-supported judgement, not a mathematical proof that no failure exists.

3. Designing a Risk-Based Audit Programme

An audit programme is a set of one or more audits planned for a specific time frame and directed toward a specific purpose. Programme management is broader than preparing an individual audit schedule.

3.1 Establishing the programme

The audit-programme manager should determine:

• programme objectives;
• risks and opportunities associated with the programme;
• audit scope and criteria;
• processes, locations, functions, and interfaces to be covered;
• frequency, duration, and timing;
• audit methods, including on-site, remote, hybrid, document-based, or process-observation methods;
• auditor competence and team composition;
• resources and information requirements;
• reporting arrangements; and
• follow-up and programme evaluation.

Programme objectives should be specific. Examples include verifying implementation of revised design controls, evaluating supplier-control effectiveness, assessing readiness for a new regulatory requirement, or investigating repeated customer complaints.

3.2 Prioritizing audit effort

A practical prioritization model can combine several factors. For example, an organization may rate each process from 1 to 5 for customer impact, regulatory exposure, change, historical failure, and process complexity. A weighted priority score can be expressed as:

where P is the priority score; C is customer impact; R is regulatory or legal exposure; H is historical performance risk; Δ represents recent change; X is complexity or interface risk; and w₁ through w₅ are organizational weights. Each rating must use a defined scale, and the weights should be documented. The formula is a decision aid, not an objective measure of risk. It is applicable only when rating definitions are consistent and decision-makers understand its limitations.

For example, if the five factors are rated 4, 5, 3, 4, and 2, with equal weights of 0.2:

The result indicates relatively high priority on a five-point scale, but it does not prove that the process is nonconforming.

A programme should also consider audit fatigue. Repeated audits with no change in scope or method can generate administrative activity without new insight. Conversely, reducing audits simply because previous audits found no problems may be unsafe if the process has changed or the previous audit was weak.

3.3 Audit objectives, scope, and criteria

The objective states what the audit is intended to achieve. The scope defines boundaries, such as departments, products, sites, processes, time periods, and information systems. The criteria identify the requirements against which evidence will be evaluated.

A weak objective is “audit production.” A stronger objective is “evaluate whether production planning and release controls ensure that customer and statutory requirements are identified, verified, and recorded for Product Family A during the last two quarters.”

Clear scope and criteria prevent two common failures: scope drift and unsupported conclusions. If the audit criteria do not include cybersecurity controls, an auditor should not issue a finding against a cybersecurity requirement merely because the issue appears interesting, unless the issue affects an included criterion or creates a clearly relevant QMS risk.

4. Auditor Competence, Independence, and Ethics

Auditor competence includes knowledge, skills, personal behaviour, and experience. Competence should be evaluated against the audit context rather than assumed from attendance at a training course.

Important competence areas include:

• audit principles and methods;
• ISO 9001 and other applicable criteria;
• process-based thinking and risk management;
• sector, technology, and regulatory knowledge;
• interviewing and communication;
• evidence evaluation and report writing;
• data interpretation;
• cultural awareness; and
• use of remote-audit technologies.

Competence may be developed through education, training, supervised audits, professional experience, technical work, witnessed assessments, and periodic performance evaluation. A training certificate demonstrates participation; it does not automatically demonstrate competent judgement.

Independence requires more than organizational separation. An auditor may be in a different department yet still have a personal or managerial interest in the result. An auditor who designed a procedure may be able to explain it, but should generally not audit its effectiveness without safeguards. Small organizations may use cross-functional auditing, reciprocal audits, external specialists, or independent review of conclusions.

Auditors should disclose conflicts of interest, protect confidential information, avoid coercive questioning, distinguish fact from inference, and give auditees a fair opportunity to explain evidence. The auditor’s role is to evaluate the system, not to manufacture nonconformities or conceal uncomfortable findings.

5. Preparing and Conducting the Audit

5.1 Preparation

Preparation normally includes reviewing relevant documented information, prior findings, performance data, complaints, process maps, changes, risks, and corrective actions. The auditor should identify likely evidence sources and prepare flexible lines of inquiry rather than a rigid interrogation script.

A process-based audit follows inputs, activities, controls, outputs, resources, measures, and interfaces. Typical questions include:

1. What is the intended output of this process?
2. What inputs and requirements are used?
3. What could cause the process to fail?
4. What controls prevent or detect failure?
5. How is competence established?
6. What records demonstrate implementation?
7. How are results measured and acted upon?
8. What happens when the process does not achieve its intended result?

5.2 Opening and communication

An opening meeting confirms objectives, scope, criteria, methods, timing, confidentiality, communication channels, safety requirements, and how disagreements will be handled. The tone should be professional and non-threatening. Psychological safety improves the likelihood that personnel will disclose process weaknesses and near misses.

5.3 Interviewing

Effective interviews use open questions before closed questions. “How do you know the design output has been verified?” is more informative than “You verify design outputs, correct?” The auditor should ask the interviewee to demonstrate the activity or identify a record, then corroborate the statement through observation or independent evidence.

Auditors should avoid leading questions, multiple questions in one sentence, technical jargon unfamiliar to the interviewee, and premature conclusions. Silence can be useful: allowing time for reflection often produces more accurate answers.

Interview evidence is relevant but may be insufficient alone. A statement that a calibration process is performed should be tested against calibration records, equipment status, procedure requirements, and actual practice.

5.4 Evidence collection and evaluation

Evidence may include:

• documents and records;
• direct observation;
• interviews;
• system data and dashboards;
• samples of transactions;
• physical conditions;
• customer or supplier information; and
• demonstrations of software or equipment.

Evidence should be evaluated for relevance, reliability, sufficiency, and consistency. Evidence is stronger when independent sources corroborate one another. Contradictions should be investigated rather than averaged away.

A useful distinction is between conformity of arrangements and effectiveness of results. A procedure may exist and be followed, yet the process may still fail to achieve intended outcomes. Conversely, a good result achieved through uncontrolled or inconsistent methods may indicate hidden risk rather than effective control.

6. Sampling and the Limits of Audit Conclusions

Auditors usually examine a sample rather than the entire population. Sampling is efficient but creates uncertainty. The sample should be selected in relation to the audit objective, population characteristics, risk, and expected variation.

Common approaches include:

• judgemental sampling, selecting items because of risk, novelty, complexity, or known weakness;
• random sampling, giving each item a known or approximately equal chance of selection;
• systematic sampling, selecting every kth item after a defined starting point;
• stratified sampling, dividing the population into relevant groups and sampling each group; and
• attribute sampling, testing whether a specified condition is present or absent.

A small sample can be appropriate for exploratory inquiry, but it cannot support broad claims without qualification. If an auditor examines five records and finds no error, the defensible conclusion is that no error was found in those records—not that the process is error-free.

For a simple random sample without replacement, the sampling fraction can be described as:

where n is sample size and N is population size. The fraction helps describe coverage but does not by itself determine statistical adequacy. Required sample size depends on confidence, tolerable deviation, expected deviation, population size, and the consequences of error. In many internal audits, risk-based judgement is more practical than formal statistical sampling, but the rationale should be recorded.

Sampling bias may arise when auditors select only convenient records, recent records, successful cases, or records supplied by management. To reduce bias, define the population, document selection logic, include different time periods or shifts where relevant, and investigate unusual patterns.

7. Findings, Conclusions, and Reports

A finding is the result of evaluating collected evidence against audit criteria. Findings may indicate conformity, nonconformity, or an opportunity for improvement, depending on the organization’s reporting scheme.

A well-supported nonconformity normally contains four elements:

1. Requirement: the applicable criterion.
2. Evidence: the objective evidence observed.
3. Gap: the difference between requirement and evidence.
4. Extent or significance: where and how the gap affects the system, when this can be established.

Example:

• Requirement: completed final-inspection records shall identify the approved acceptance criteria.
• Evidence: in a sample of 12 records from March, four lacked the acceptance-criteria reference.
• Gap: the required identification was not consistently recorded.
• Significance: the weakness affects traceability of release decisions for the sampled production line.

The auditor should not assert an unsupported root cause, blame an individual, or prescribe a corrective action unless the audit arrangement explicitly includes that advisory role. “Operator negligence” is often an inadequate conclusion because it may conceal unclear instructions, workload, training, software design, or supervision problems.

A report should state objectives, scope, criteria, dates, participants, methods, limitations, findings, conclusions, and unresolved issues. Conclusions should be proportionate to evidence. A high-quality report is concise but sufficiently precise that an independent reader can understand how the conclusion was reached.

8. Corrective Action and Follow-Up

Correction addresses an identified nonconformity; corrective action addresses its cause or causes to prevent recurrence. Containment may be necessary to control immediate risk while analysis is under way.

Effective follow-up verifies three matters:

1. Was the action implemented?
2. Did it address the cause rather than only the symptom?
3. Is the action effective over an appropriate period?

Common root-cause methods include the five-whys technique, cause-and-effect analysis, fault-tree analysis, barrier analysis, and structured problem-solving. No method is universally superior. The method should match the complexity and potential consequences of the problem.

A corrective action that changes a form without examining why the process failed is likely to be superficial. Verification should use evidence such as subsequent records, trend data, repeat observations, complaint rates, process capability, or independent testing. Closure should not be granted merely because an action plan was submitted.

9. Management Review as Strategic Governance

Management review is a top-management process for evaluating the continuing suitability, adequacy, effectiveness, and strategic alignment of the QMS. It should be integrated with organizational governance, business planning, risk review, and resource allocation.

A management review may be a single meeting or a distributed set of activities, provided the required topics are addressed and conclusions are documented. Typical inputs include:

• status of actions from previous reviews;
• changes in internal and external issues;
• QMS performance and effectiveness;
• customer satisfaction and relevant interested-party feedback;
• achievement of quality objectives;
• process performance and conformity of products and services;
• nonconformities and corrective actions;
• monitoring and measurement results;
• audit results;
• supplier and other external-provider performance;
• adequacy of resources; and
• effectiveness of actions addressing risks and opportunities.

A mature review does not merely display indicators. It asks whether the evidence changes managerial understanding or requires a decision. For example, a stable on-time-delivery percentage may conceal deterioration in a high-value product family. Aggregated indicators should therefore be disaggregated where risk warrants it.

9.1 Evidence-to-decision logic

Management review can be structured as a chain:

Evidence → interpretation → risk or opportunity → decision → owner and resources → due date → verification.

For example, rising warranty claims may lead to the interpretation that a design-transfer control is weak. The decision may be to revise transfer criteria, fund additional validation, assign an engineering owner, and review results after three production cycles.

Decisions and outputs may concern:

• improvement opportunities;
• changes to the QMS;
• changes to objectives or measures;
• resource needs;
• competence development;
• supplier controls;
• process redesign; and
• strategic priorities.

Minutes should record decisions, responsibilities, deadlines, assumptions, required resources, and follow-up evidence. A list of presentations is not an adequate management-review record.

10. Integrated Case: Illustrative Medical-Device Component Manufacturer

This is a fictional illustrative case.

Background

MedSure Components manufactures machined housings used in diagnostic devices. Customer complaints concerning dimensional variation increased over two quarters. The organization had completed internal audits of production every year, but the audits concentrated on whether work instructions were available and signed.

Problem

The management team initially proposed increasing inspection frequency. However, audit and performance data showed that variation was associated with three recent changes: a new supplier of raw material, revised computer-numerical-control software, and reassignment of inspection personnel. The existing audit programme had not prioritized change or process interfaces.

Analysis

The quality manager redesigned the programme using customer impact, regulatory exposure, change, historical performance, and interface complexity as prioritization factors. The audit scope covered purchasing controls, software release, machining, measurement-system control, inspection competence, and complaint feedback.

Auditors sampled records from different shifts and months, observed setup activities, interviewed operators and inspectors, and traced three complaint cases backward through production and supplier records. They found:

• supplier material certificates were reviewed, but acceptance criteria were not consistently linked to purchase specifications;
• software changes were tested, but approval evidence was incomplete;
• inspection personnel had received training, but competence evaluation did not cover the revised measurement method; and
• management reports combined all dimensional complaints into one indicator, hiding concentration in one product family.

Approach and solution

The audit team reported three nonconformities and one improvement opportunity. Corrective action included revised software-release controls, competence evaluation using witnessed measurement tasks, supplier specification linkage, and a disaggregated complaint dashboard. Management review then approved temporary engineering resources, a focused supplier audit, and a three-month effectiveness review.

Outcome

After three production cycles, repeat dimensional complaints declined and the organization demonstrated improved traceability between material requirements, software revisions, inspection results, and customer feedback. The most important improvement was not the additional inspection. It was the connection of audit evidence to management decisions across process interfaces.

Learning points

1. Annual frequency does not guarantee a risk-based programme.
2. Audits should examine changes and interfaces, not only departmental procedures.
3. Aggregated indicators can conceal significant risk.
4. Corrective action requires effectiveness evidence.
5. Management review is valuable when it allocates resources and changes controls.

11. Technology, Remote Auditing, and Artificial Intelligence

Digital systems can strengthen auditing through searchable records, process mining, automated exception detection, electronic sampling, dashboards, and remote observation. Remote audits may improve access to geographically distributed sites and reduce travel, but they can weaken informal observation, limit access to physical conditions, and introduce connectivity or cybersecurity risks.

Artificial intelligence may assist with anomaly detection, document comparison, trend analysis, and identifying transactions for human review. However, AI-generated outputs are not automatically audit evidence. Auditors must understand data provenance, model limitations, false positives, false negatives, access controls, and possible bias. Confidential QMS information should not be entered into unauthorized systems.

Human auditors remain accountable for scope, evidence evaluation, conclusions, confidentiality, and ethical judgement. Technology should augment—not replace—professional scepticism and direct verification.

12. Challenges, Limitations, and Best Practices

Internal auditing faces several recurring challenges:

• independence is difficult in small organizations;
• audit programmes may become calendar-driven rather than risk-driven;
• auditors may confuse procedure existence with effectiveness;
• sampling may be convenient rather than representative;
• findings may be written vaguely or attributed prematurely to individuals;
• corrective actions may be closed without effectiveness verification;
• management reviews may become passive reporting meetings; and
• performance indicators may encourage local optimization or concealment.

Best practice is to maintain a competence matrix, periodically evaluate the audit programme, rotate auditors without sacrificing technical knowledge, use multiple evidence sources, document sampling rationale, calibrate finding decisions among auditors, link audits to change and risk, and assess the effectiveness of management-review decisions.

Audit governance should also protect whistleblowers and prevent retaliation. Quality information is often sensitive because it may expose commercial, safety, regulatory, or reputational risk. Confidentiality must be balanced with the duty to escalate serious risks through authorized channels.

Chapter Summary

Internal auditing is a systematic, independent, documented evaluation of conformity and effectiveness based on objective evidence. ISO 19011 principles provide the professional foundation: integrity, fair presentation, due care, confidentiality, independence, evidence-based auditing, and risk-based planning.

A risk-based audit programme aligns audit effort with customer impact, regulatory exposure, change, historical performance, complexity, and strategic importance. Effective audits require competent and impartial auditors, clearly defined objectives, scope and criteria, process-based preparation, skilled interviewing, appropriate sampling, corroborated evidence, and proportionate conclusions.

Findings should distinguish requirements, evidence, gaps, and significance. Corrective-action follow-up must verify implementation, causal adequacy, and effectiveness. Management review transforms audit and performance evidence into decisions about resources, risks, objectives, process changes, and improvement. Its quality is judged by the decisions and verified outcomes it produces, not by the length of its meeting or the number of slides presented.

Technology can improve coverage and analysis, but it introduces data, cybersecurity, bias, and explainability concerns. Professional judgement, ethical conduct, and human accountability remain essential.

Key Terms

Internal audit: A systematic, independent, documented process for evaluating fulfilment of audit criteria.

Audit programme: A planned set of audits conducted within a defined period for a defined purpose.

Audit objective: The intended purpose or result of an audit.

Audit scope: The boundaries and extent of an audit.

Audit criteria: Requirements used as the reference against which evidence is evaluated.

Objective evidence: Verifiable information relevant to audit criteria.

Audit finding: The result of evaluating evidence against criteria.

Nonconformity: Failure to fulfil a requirement.

Audit conclusion: The overall outcome of an audit after considering objectives and findings.

Risk-based auditing: Directing audit attention according to risks and opportunities affecting intended results.

Auditor competence: Demonstrated knowledge, skills, experience, and behaviour required for effective auditing.

Independence: Freedom from bias, conflicts of interest, or responsibility for the activity being audited.

Sampling: Selecting part of a population to obtain evidence about the whole or a defined aspect of it.

Correction: Action to eliminate a detected nonconformity.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Management review: Top-management evaluation of QMS suitability, adequacy, effectiveness, and strategic alignment.

Effectiveness: The extent to which planned activities are realized and planned results achieved.

Process interface: The point at which one process exchanges inputs, outputs, information, or responsibilities with another.

Professional scepticism: A questioning and critical evaluation of evidence without assuming either conformity or failure.

Review Questions

Short Answer Questions

1. What is the difference between audit scope and audit criteria?
2. Why is auditor independence important?
3. Identify four sources of objective evidence.
4. What are the four elements of a well-supported nonconformity?
5. Why should management-review minutes record decisions and owners?

Long Answer Questions

1. Explain how an organization can design a risk-based internal audit programme using ISO 19011 principles.
2. Discuss the relationship between auditor competence, independence, and ethical conduct.
3. Explain how sampling and corroboration influence the reliability of audit conclusions.
4. Compare correction, containment, and corrective action, using an example.
5. Discuss how management review can convert QMS performance data into strategic decisions.

Analytical / Application Questions

1. A process has few historical nonconformities but has recently undergone major software, staffing, and supplier changes. Should its audit priority increase? Develop and justify an audit response.
2. An auditor finds no errors in five records and concludes that the process is fully effective. Critique the conclusion and propose a more defensible evidence strategy.
3. A management review receives excellent aggregate customer-satisfaction results while one high-risk product family shows worsening complaints. Explain what additional analysis and decisions should follow.

Multiple Choice Questions with Answers

Question 1

Which feature most directly distinguishes a risk-based audit programme from a calendar-driven programme?

A. Every department is audited for exactly the same duration.

B. Audit effort is prioritized according to risks, changes, and performance evidence.

C. Audits are conducted only after external certification audits.

D. Only processes with existing nonconformities are audited.

Correct Answer: B. Audit effort is prioritized according to risks, changes, and performance evidence.

Question 2

Which combination best represents the essential structure of a well-supported nonconformity?

A. Opinion, recommendation, budget, and deadline

B. Requirement, evidence, gap, and significance or extent

C. Interview, checklist, score, and auditor preference

D. Complaint, blame, punishment, and closure

Correct Answer: B. Requirement, evidence, gap, and significance or extent

Question 3

An auditor examines five records and finds no errors. What is the most defensible conclusion?

A. The entire process is error-free.

B. The organization has no process risk.

C. No error was found in the records examined, subject to the audit scope and sampling limitation.

D. The process does not require further auditing.

Correct Answer: C. No error was found in the records examined, subject to the audit scope and sampling limitation.

Question 4

Which action is most clearly corrective action rather than correction?

A. Reworking one defective unit

B. Removing one inaccurate record

C. Identifying and eliminating the systemic cause of repeated record errors

D. Quarantining an affected batch

Correct Answer: C. Identifying and eliminating the systemic cause of repeated record errors

Question 5

What is the primary purpose of management review?

A. To replace all internal audits

B. To evaluate QMS performance and make decisions about suitability, adequacy, effectiveness, and improvement

C. To approve every employee’s daily work schedule

D. To produce marketing material for customers

Correct Answer: B. To evaluate QMS performance and make decisions about suitability, adequacy, effectiveness, and improvement

Question 6

Which interview question is most likely to generate useful process evidence?

A. You always follow the procedure, correct?

B. Is everything satisfactory?

C. How do you know this output has met the specified acceptance criteria?

D. Would you agree that your department has no risks?

Correct Answer: C. How do you know this output has met the specified acceptance criteria?

Question 7

In the prioritization formula P = w₁C + w₂R + w₃H + w₄Δ + w₅X, what do the w terms represent?

A. Audit findings

B. Population sizes

C. Organizational weights assigned to risk factors

D. Measurement units

Correct Answer: C. Organizational weights assigned to risk factors

Question 8

Which practice best protects auditor independence in a small organization?

A. Allowing every manager to audit their own process

B. Using cross-functional or external auditors and declaring conflicts of interest

C. Avoiding audits of senior-management processes

D. Selecting auditors solely by seniority

Correct Answer: B. Using cross-functional or external auditors and declaring conflicts of interest

Question 9

What should follow the implementation of a corrective action?

A. Immediate closure without further evidence

B. Verification that the action addressed the cause and is effective over time

C. Deletion of the original finding

D. A reduction in the audit scope

Correct Answer: B. Verification that the action addressed the cause and is effective over time

Question 10

Which statement about artificial intelligence in auditing is most accurate?

A. AI output is automatically objective evidence.

B. AI eliminates the need for auditor judgement.

C. AI can assist analysis, but humans remain accountable for evidence evaluation and conclusions.

D. AI should replace interviews because interviews are subjective.

Correct Answer: C. AI can assist analysis, but humans remain accountable for evidence evaluation and conclusions.