Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Internal Audit

    Also known as: First-party audit, Management system audit

    Definition

    A planned, documented review, by people from the organisation or acting for it, of whether its management system and controls are in place and working, judged against stated criteria with the results reported to those who must act.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/internal-audit

    Scope: An internal audit is not a certification audit or an inspection, and passing one is not proof that risks are controlled. The wording here is from HSE, ILO, CCOHS and EPA texts; ISO 19011 and the ISO management system standards were not read.

    Example for your evaluation: Follow one finding from the audit report to its corrective action, the separate check that the action worked, and the programme summary sent to management review.

    Sources checked: . Examples are editorial illustrations.

    What HSE, ILO, CCOHS and EPA say about internal audits of a management system

    On this page an internal audit means a planned, documented review, by people from the organisation or acting for it, of whether its management system and controls are in place and working, judged against stated criteria and reported to the people who must act. ILO-OSH 2001, voluntary guidance, asks for periodic audits to determine whether a management system and its elements are in place, adequate and effective in protecting workers and preventing incidents. It defines an audit as a systematic, independent and documented process for obtaining evidence and evaluating it objectively against defined criteria, and adds that this does not necessarily mean an audit by outsiders. EPA's 1986 Environmental Auditing Policy Statement describes environmental auditing as a systematic, documented, periodic and objective review by a regulated entity of its operations and practices related to meeting environmental requirements. This is general information, not legal or certification advice.

    The programme comes first. ILO says an audit policy and programme should designate auditor competency, scope, frequency, methodology and reporting, and lists elements an audit can cover, among them policy, competence and training, management of change, procurement, management review, and preventive and corrective action. EPA asks for explicit objectives, scope, resources and frequency, and for written procedures covering planning, evaluating findings, communicating results and follow-up. CCOHS describes an audit as a checklist with weighted questions answered from records, observations, interviews and questionnaires, and says annual audits appear more common but critical elements may merit more frequent review.

    The people matter as much as the checklist. ILO says audits should be carried out by competent persons, internal or external, who are independent of the activity audited, and that workers should be consulted, as appropriate, on the choice of auditor and on each stage. EPA asks for an audit function independent of the audited activities, whose objectivity is not impaired by personal relationships, conflicts of interest, interference with free inquiry or fear of retribution. CCOHS asks that the audit team be trained in audit procedures. HSE says the board should have unrestricted access to internal and external auditors while keeping their independence and objectivity under review.

    ILO says results should reach those responsible for corrective action. EPA asks for prompt, candid, clear written reports on findings, corrective actions and schedules, a written commitment from top management to follow up findings so problems do not recur, and quality assurance of the audits themselves. CCOHS asks for a follow-up procedure with target dates and checks that the work was completed. ILO says a management review should consider audit activities, and HSE asks the board to decide actions on weaknesses and a system to monitor them. None of the sources read sets a scale for grading findings, so any grades come from the organisation's own procedure.

    Sources opened :

    What an internal audit record holds in software

    • A programme record with objectives, scope, the audits planned for the period and the date the programme was last reviewed.
    • For each audit, its scope, criteria, date, lead auditor, team and the audited area.
    • Each auditor's competence record and a note of any link to the audited area, with the reason for the assignment.
    • The checklist used, the evidence examined and who was interviewed.
    • Findings tied to a criterion and the evidence behind them, with the grade the organisation assigns.
    • Corrective actions with owner, due date, completion and a separate check that the action worked.
    • The report, its distribution list and the date it was issued.
    • A programme summary for management review, and a history of who changed an entry and when.

    Internal audit, inspection, certification audit and management review

    CCOHS says workplace inspections help to identify existing hazards so that corrective action can be taken, and lists internal and external audits among the reports inspectors should know before an inspection. EPA says audits do not replace regulatory agency inspections and do not substitute for compliance activities such as monitoring and record keeping. CCOHS describes external audits as scheduled audits by accredited auditors hired by the employer. What a certification body requires is set by that body and the standard it certifies against, which this page did not read. A management review is where top management examines audit results with other inputs and decides on action, as ILO describes it.

    A hypothetical example: a yearly audit programme for a small packaging firm

    Everything here is invented and describes no real company. A packaging firm with 80 staff plans 12 internal audits for the year, one per process, and has 5 trained auditors, so assignments are 3, 3, 2, 2 and 2. The draft schedule gives the stores audit to the stores supervisor, who is a trained auditor. The planner moves it to an auditor from another department, so 0 of the 12 audits are carried out by someone who runs the audited area.

    By 30 September 9 audits were due and 8 were held, which is 8 of 9, or 89%, of those due and 8 of 12, or 67%, of the year. The ninth was postponed and is rescheduled. The 8 audits produced 14 findings: 2 major, 7 minor and 5 observations, since 2 + 7 + 5 = 14. Only the 9 major and minor findings need an action. Of those 9 actions, 6 are closed and verified, which is 6 of 9, or 67%, 2 are closed and awaiting the check, and 1 was due on 15 September and is 15 days overdue on 30 September. One major finding repeats one raised on the same process a year earlier, so the summary sent to management review marks it as recurring.

    Common misunderstandings about internal audits

    • An internal audit is not a certificate. ILO says an audit need not be external, and no source read presents an internal audit result as certification.
    • A passed audit is not proof that risks are controlled. EPA says audits evaluate and do not replace the compliance activities, and CCOHS describes an audit as drawing on records, observations, interviews and questionnaires.
    • Auditing your own work is not independent. ILO asks for auditors independent of the audited activity, and EPA names conflicts of interest and fear of retribution.
    • The audit is not over when the report is issued. CCOHS asks for target dates and checks that the work was completed.
    • A checklist is not a programme. ILO and EPA both ask for scope, frequency, competence and reporting to be set out in advance.
    • An audit is not only a legal check. ILO asks whether the system meets the organisation's own policy and objectives, as well as enabling compliance with national law.

    How internal audit relates to other glossary terms

    An internal audit sits between the system and the decisions made about it. These terms sit around it.

    • Audit management: the planning, conduct and follow-up of audits of all kinds.
    • ISO 19011: guidance on auditing management systems, whose content this page did not read.
    • Management review: where audit results are weighed with other inputs and decisions are recorded.
    • Non-conformance: the record that a finding against a requirement can become.
    • CAPA: the cycle that handles the cause of a finding and checks the fix.

    Records and evidence that usually exist for internal audit

    • An audit programme and schedule, with scope, criteria and frequency.
    • Auditor competence records and the assignment of each audit, with any conflict noted.
    • Completed checklists, evidence notes and the signed audit report.
    • A findings register with grades, corrective actions, due dates and the verification of each.
    • A programme summary and the minutes of the management review that received it.

    What a software tool needs to capture for internal audit

    • A programme calendar showing planned, held, postponed and overdue audits against the period.
    • Editable checklists, with the criterion each question refers to.
    • Auditor assignment with competence records and a warning when an auditor is linked to the audited area.
    • Findings with a grade, evidence and criterion, converted into actions with an owner and due date.
    • A separate verification step by someone other than the action owner, with its date.
    • History across audits, so a recurring finding on the same process is visible.
    • A programme summary for management review and an export of reports and findings.

    Catalog profiles documenting audit programmes and findings

    The list follows the audit-programme rule used by the audit platform guide. It does not show that a product holds auditor independence rules, weighted checklists or a separate verification step, which should be tested with one of your own audits.

    Same rule for every product: tagged “Audit Management”, “Audits & Inspections” or “Internal Audit”, with a sourced audit-programme capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 46 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Who may carry out an internal audit?

    ILO says audits should be carried out by competent persons, internal or external, who are independent of the activity audited, and defines a competent person by training, knowledge, experience and skill. EPA asks that objectivity not be impaired by personal relationships, conflicts of interest or fear of retribution.

    How often should internal audits be held?

    No source read sets one interval. ILO places frequency in the audit programme, and EPA lists it among the elements a programme sets out in advance. CCOHS says annual audits appear more common but reviewing critical elements more often may be advisable. HSE asks for a board review at least once a year, which is a review and not an audit.

    What is the difference between an internal audit and an inspection?

    CCOHS says workplace inspections help to identify existing hazards so that corrective action can be taken, and that internal audits help verify that the overall inspection programme is effective. EPA says audits evaluate management and compliance activities and do not replace regulatory agency inspections.

    More quality terms