An ISO 9001 internal auditor is an employee or contractor who checks, on the organization's behalf, whether its quality management system meets ISO 9001 and its own procedures. The standard requires internal auditors to be competent and impartial. It does not require a certificate. Most people qualify through a two-day course followed by supervised audits.
What an internal auditor does
The job has four parts.
Before the audit, the auditor reads the procedures for the process, looks at earlier findings and prepares questions. During it, they interview people, watch the work and sample records. Afterward, they write up what they saw as conformities, nonconformities and opportunities for improvement, each with its evidence. Later, they check that corrective actions were carried out and worked.
For most internal auditors this is a part-time duty next to their main job. A quality engineer, a production planner or a finance analyst might spend four to eight days a year on audits. Larger organizations sometimes have full-time auditors, usually inside the quality department.
What ISO 9001 requires
Clause 9.2 says the organization must select auditors and conduct audits so that the audit process is objective and impartial. In practice that means you do not audit your own work.
Clause 7.2 says people doing work that affects the quality system must be competent on the basis of education, training or experience, and that the organization must keep evidence of it. Internal auditors fall under that clause like everyone else.
The standard stops there. It names no course, no number of hours and no certificate. It is up to each organization to decide what makes its auditors competent and to be able to show it.
ISO 19011, the guideline standard for auditing management systems, fills in the detail. It is guidance, so nothing in it is mandatory for ISO 9001 certification. Certification auditors know it well, and an auditor competence process that follows it is easy to defend.
What competence means in practice
ISO 19011 describes auditor competence as personal behavior plus knowledge and skills. In plain terms, a competent internal auditor has four things.
They know the standard well enough to recognize what each clause asks for, without needing to recite it.
They know audit method: how to plan, ask open questions, sample, take notes, grade a finding and write it up.
They understand the business. Someone auditing purchasing should know what a purchase order looks like in your company and what tends to go wrong with one.
They behave like an auditor. ISO 19011 lists principles that include integrity, fair presentation, due professional care, confidentiality, independence and an approach based on evidence. In daily terms: they are curious and polite, they report what they found, and they do not gossip about it.
The last point decides more than the others. A technically strong auditor whom colleagues do not trust will be shown only what people want them to see.
How to become an internal auditor
The usual path has five steps.
- Take an ISO 9001 internal auditor course. Two days is typical. Courses run from one to three days, in a classroom or online.
- Observe an audit led by an experienced auditor.
- Lead an audit with that auditor watching.
- Have your first reports reviewed before they go out.
- Audit alone, with a refresher when the standard changes.
Your employer signs you off, and the record of these steps is the evidence of competence. No outside body has to approve an internal auditor.
There is no formal prerequisite for the course. It helps to have worked inside a quality system for a year or so, because the examples then mean something.
With ISO 9001:2026 published on September 16, 2026, auditors trained on the 2015 edition need an update on what changed. Certified organizations have until September 30, 2029 to move to the new edition, and internal audits against it should start well before the transition audit.
Internal auditor or lead auditor course
Training providers offer two main courses, and people often book the wrong one.
| Internal auditor course | Lead auditor course | |
|---|---|---|
| Length | Usually 2 days | Usually 5 days (about 40 hours) |
| Aimed at | Employees who audit their own organization | People who will lead audit teams, audit suppliers or work for certification bodies |
| Content | The standard, audit method, practice interviews and findings | The same in more depth, plus managing an audit team, the certification process and a written exam |
| Recognition | Certificate from the training provider | Often registered with a personnel certification body such as CQI/IRCA or Exemplar Global |
| Needed for internal audits | Enough | More than required |
A lead auditor certificate does no harm for internal work, and it is useful if you plan to audit suppliers or move into auditing as a career. For someone who will audit two processes a year inside their own company, the internal auditor course is enough. See is lead auditor certification worth it for the longer comparison.
How many internal auditors a company needs
The number depends on the size of the program and on independence.
Count the audit days in your annual program and add about a third for preparation and reporting. Divide by the days each auditor can spare. A program of 12 audit days needs about 16 days of effort, which is four auditors giving four days each. These figures are an illustration.
Then check independence. Every process needs at least one trained auditor who does not work in it. The quality department's own processes are the usual gap, which is why companies train people from production, engineering or finance.
Train one or two more people than the arithmetic says. Auditors change jobs, and a program that depends on one person stops when they leave.
In-house, shared or outside auditors
Small companies have three ways to staff internal audits.
Training your own people costs a course fee and their time, and it spreads knowledge of the quality system through the company. It works when you have at least two or three people who can audit each other's areas.
Sharing auditors with another company, such as a sister site, a supplier or a customer, gives independence at almost no cost. Agree confidentiality in writing first.
Hiring an outside auditor costs more per day and brings experience from many companies. It suits very small companies, the audit of the quality department's own processes, and the year before a first certification audit. Outside internal auditors usually charge a day rate, and a small single-site program takes them two to four days a year.
Many companies combine the three. Whichever you choose, the organization stays responsible for the program and for acting on the findings.
What makes an internal auditor good
Managers who run audit programs tend to name the same qualities.
Good auditors prepare. They arrive knowing the procedure and the last audit's findings, so the hour with the process owner is spent on evidence.
They ask for records. "Show me the last three" finds more than "do you always".
They write findings that can be closed: one requirement, the evidence, the gap. They leave the solution to the process owner.
They say what works well. A report that records sound practice next to the problems is read and believed.
And they follow up. An auditor who returns to check that a corrective action held is the reason the same finding does not come back the next year.
Frequently Asked Questions
Do ISO 9001 internal auditors need to be certified?
No. ISO 9001 requires competence and impartiality and does not name a certificate. A course certificate plus a record of supervised audits is the usual evidence.
How long does internal auditor training take?
Most ISO 9001 internal auditor courses take two days. Becoming able to audit alone takes two or three audits after that.
Can the quality manager be an internal auditor?
Yes, for processes outside their own responsibility. Someone else has to audit document control, corrective action, the internal audit process and anything else the quality manager owns.
Can one person audit the whole system?
Only if that person is independent of all of it, which usually means an outside auditor. An employee always has at least one process they cannot audit.
Does an internal auditor certificate expire?
Course certificates from training providers normally do not. Your employer should still review auditor competence from time to time, and retrain when the standard is revised.
What is the difference between an internal auditor and a certification auditor?
An internal auditor works for the organization and reports to its management. A certification auditor works for a certification body and decides whether to recommend a certificate. The method is similar and the independence rules for certification auditors are much stricter.
Related insights
- ISO 9001 Internal Audit: Program, Plan and Checklist
- Is lead auditor certification worth it?
- Freelance ISO 9001 lead auditor jobs
- ISO 9001:2026 transition checklist
Get a head start
The ElevateQCS Internal Audit Pack for ISO 9001:2026 is a set of ready-to-edit internal audit documents aligned with ISO 9001:2026. Explore the ISO 9001:2026 kit and packs
Need an independent internal auditor? Find a vetted expert.
General guidance aligned with ISO 9001 and ISO 19011. Refer to the standards for their exact requirements.
Sources
These references provide standards, regulatory text, or background context. They do not independently validate every recommendation in this article. Linking does not imply endorsement. Standards may require purchase; refer to the publisher for the current text.
