Internal audit: general

Why this clause matters

Internal audit is the system's own early warning. The clause sets the standard: conformance and effectiveness. An audit programme that only checks documents and never watches the process is not meeting it. The public contents give 9.2.1 and 9.2.2 headings, which makes the programme more visible.

Suggested evidence to discuss with your auditor

For 9.2.1, these are the artefacts we suggest discussing with your auditor. The standard publishes no evidence list, so this is our reading, not a requirement.

• An audit schedule covering the whole system over a cycle
• Audit reports that test effectiveness, not only presence
• Evidence that findings were corrected and followed up

Where systems usually fall short

• Audits that only sample documents
• The same auditor auditing their own area

How to prepare

Choose one clause and audit it by watching the process, not by reading the file. Compare what you see with what the document says. That gap is the value of an internal audit. Audit one clause by watching the process, not by reading the file, and write down the gap between the document and the line. That gap is the value of the audit.

Dates

Cross-references

9.2.2, 9.1.2, 10.2

Source

Clause 9.2.1. Current edition: ISO 22000:2018. Draft: ISO/DIS 22000:2026. Retrieved 2026-10-19. The full DIS text for 9.2.1 is sold by ISO and not held here; the sources page lists what is.