How often do internal audits need to happen?

The standard says at planned intervals, not a fixed frequency. In practice most organisations run a programme that covers the whole system once a year, with more frequent audits of higher risk processes.

Can our own staff do internal audits instead?

Yes, and many clients prefer that. The constraint is independence: nobody may audit their own work. We can train your team and cover the areas they cannot audit independently.

Will you tell our certification body about findings?

No. Internal audit findings are yours. Your certification body will want to see that you found things and dealt with them, which is a good sign rather than a bad one.

Is an internal audit the same as a gap analysis?

No. A gap analysis assesses a system against the standard before it is built or when it needs rebuilding. An internal audit checks an operating system against its own documented arrangements and against the standard.

What if the audit finds a lot of problems?

Better us than the certification body. Findings from an internal audit cost you corrective action. Findings at a certification audit can cost you the certificate.

Audit and Assurance

Internal Auditing

Independent assurance that your system is working

In short

Internal auditing is the clause 9.2 requirement to check your own management system at planned intervals. Equas delivers your internal audit programme for you: planning the schedule, conducting the audits, reporting findings and verifying that corrective actions work. Delivered by experienced IRCA qualified lead auditors.

What Internal Auditing involves

Every one of these standards requires internal audits, and certification bodies check the evidence closely. It is one of the most common areas for findings, usually for one of three reasons: audits were not done, they were done but not recorded properly, or they were done by somebody auditing their own work.

That last one catches small organisations in particular. If the person who wrote the procedure is also the person auditing it, the audit is not independent and an auditor will say so.

Outsourcing the programme removes all three problems. We plan a schedule that covers every process and every clause across the audit cycle, conduct the audits against your documented system, report findings in a form your certification body will recognise, and check that the corrective actions you take have actually worked.

There is a second benefit that clients tend to value more once they have experienced it. A good internal audit is not a compliance ritual, it is the cheapest opportunity you get to find problems before an external auditor does, or before a customer does. Our auditors work in a lot of organisations and will tell you when something is technically compliant but operationally daft.

Internal auditing can be bought as a standalone service, as part of outsourced system maintenance, or as a one-off pre-certification audit before your first certification visit.

Who it is for

Working towards certification

You must complete an internal audit of the whole system before you can be certified. Doing it properly is the single best predictor of a clean Stage 2.

Already certified

The annual programme has to keep running. Outsourcing it guarantees independence, guarantees it happens, and gives you an outside view of your own system.

What is included

Delivered by experienced IRCA qualified lead auditors

The same people who prepare organisations for certification audits.

Audit programme planning

A risk-based schedule covering every process and clause across the cycle, not a rotation for its own sake.

On-site and remote audits

Scheduled around your operation, including multi-site programmes.

Written audit reports

Findings graded and evidenced in the form your certification body expects to see.

Corrective action verification

We return to check that actions were completed and actually fixed the cause.

Improvement observations

Not just non-conformities. Where something works but works badly, we say so.

Pre-certification audits

The full internal audit required before a first certification visit.

How it works

1
Programme design
We build an audit schedule based on process risk, past findings and the requirements of your standards.
2
Audit planning
Each audit is planned and notified in advance, with the scope and criteria agreed.
3
Conducting the audit
Interviews, observation and examination of records against your documented system.
4
Reporting
A written report with graded findings, evidence and clear statements of what needs to change.
5
Follow-up
Corrective actions are reviewed and verified at the next visit or sooner if the finding is significant.