Skip to main content

Form library · Quality and compliance

Internal audit programme template

The annual schedule of internal audits for a management system. Record the period, the standards covered and the objectives, then add each site or department and the processes in it. For each one, give the owner, a risk rating and the reasons for it, the last audit date and result, and the planned date and lead auditor, with a check that the auditor is independent of the work. As the year goes on, update the status: the form counts audits planned, completed and overdue, and flags any process left longer than your own interval for its risk. Each audit itself uses the internal audit checklist.

For quality, health and safety and environmental managers who run an ISO-style internal audit programme and need to show how it was planned, kept to and reviewed.

Not tied to one country. The notes refer to ISO 9001 and the ISO 9001 Auditing Practices Group, which apply wherever the standard is used.

  • Sites or departments as spaces, each with its processes, owners and standard or procedure references
  • Risk rating with reasons, last audit date and result, and the gap since then against your own interval
  • Planned date, lead auditor, independence and competence checks, with a red note if the auditor is involved
  • Status, completed date and report reference, with overdue audits flagged and days overdue counted
  • Tiles for audits planned, completed, percentage complete and overdue, ten review checks and a sign-off
Try it blank ↓See it completed ↓Use it in SiteSurveyDownload the completed form (PDF)

Ready to use from the form library, and every question is yours to edit. Try it for a small trial fee, cancel any time.

Try it on your phone

Try it on this phone

Fill in the internal audit programme on your phone now

See how the internal audit programme looks on your phone

Scan the code with your phone camera. It opens the real form, no sign-up needed.

Open the live example and fill it in, just as your team would on site. No sign-up needed.

See it on this phone

Every question is editable. Add this form to your account, then change the wording, add or remove questions and options, and make it fit your own jobs.

Or start your trial with this form ready →

One email, and we won't add you to a mailing list.

What is an internal audit programme?

A programme is credible when every process in scope is on it, the high-risk ones come first and more often, each audit has an auditor who does not do or manage that work, and overdue audits are rescheduled with a reason rather than quietly dropped.

Last updated . Facts checked by the SiteSurvey team on 28 October 2026 against ISO 9001 Auditing Practices Group, guidance on internal audits (ISO and IAF), ISO 9001:2026, quality management systems: requirements (iso.org), ISO 9001:2015, withdrawn and revised by ISO 9001:2026 (iso.org) and ISO 19011:2026, guidelines for auditing management systems (iso.org).

How to build an internal audit programme

Start from the scope of your management system and the results of last year's audits.

  1. Set the programme

    Record the period, standards, objectives and your longest gap between audits for high, medium and low risk.

  2. List the processes

    Add each site or department, then each process or area with its owner and the procedure or clause references.

  3. Rate the risk

    Rate each one high, medium or low, and tick why: past nonconformities, complaints, changes, criticality.

  4. Schedule and assign

    Give each a planned date and a lead auditor who does not do or manage that work. Put high-risk processes first.

  5. Track and review

    Update the status as audits happen, reschedule overdue ones, work through the review checks and sign off.

What makes an internal audit programme credible

Each process: risk, last audit and schedule

Goods in and incoming inspection. Owner M. Doherty. High risk: nonconformities last time, customer returns. Last audited 15 April 2026, minor nonconformities: 187 days, over the 183-day interval. Planned 22 September, lead auditor T. Varga (independent). Status: planned. Overdue by 27 days.

Fictional example. Record the actual evidence and approved arrangements for your job.

A common recording mistake

Auditing the easy, low-risk processes on time while the high-risk ones slip, or letting a manager audit their own department.

What happens next

Reschedule overdue audits, swap any auditor who is not independent, and take the programme results to management review.

Try the internal audit programme form live

Answer a few questions and watch it adapt. Your answers are not saved, and any photos you add are deleted within the hour.

Live form: Internal Audit ProgrammeOpen full screen ↗
Fill it in right here

This is the real form as your team would use it: questions appear as you answer, scores work themselves out and you can add photos and signatures. No sign-up needed. Or open a completed example to see every answer, photo and score filled in.

Want to see one filled in? See a completed internal audit programme report (PDF), made by SiteSurvey from a fictional site visit.

Every question in the internal audit programme template

An annual internal audit programme: standards covered and objectives, sites or departments as spaces, each process or area with its owner, risk rating and reasons, last audit date and result, the gap since then against your own interval, planned date, lead auditor with independence and competence checks, status and report reference. Tiles count audits planned, completed, the percentage complete, overdue and high-risk entries. Ten programme review checks and a sign-off finish it. 4 sections and 92 questions. Follow-up questions and guidance appear only when an answer calls for them, so the person on site never sees the ones that do not apply.

Make it your own: every question is editable

This is a starting point, not a fixed form. Once it is in your SiteSurvey account you can reword any question, add or remove questions, sections and answer options, and add your own logo, so it fits the way your team works and the jobs you do.

Details you only enter once

Add this form to a project in SiteSurvey and it fills in what the project already knows, so nobody on site retypes it and every form on the job uses the same names. Anything filled in can still be changed.

  • Project: the project name
  • Main site address: the site address, from the space or the project
  • Organisation: the project's customer

Programme

  • ProjectShort answer

    Filled in from the project in SiteSurvey.

    Fills in from the project name
  • Main site addressShort answer
    Fills in from the site address, from the space or the project
  • OrganisationShort answer
    Fills in from the project's customer
  • Location (GPS)Short answer
  • Date of this programme update*Date
  • Updated by*Short answer
  • Programme period*Short answer

    For example 1 January to 31 December 2027.

  • Audit programme manager*Short answer
  • Programme versionShort answer
  • Standards and requirements the programme covers*Tick all that apply
    • ISO 9001:2026
    • ISO 9001:2015
    • ISO 14001
    • ISO 45001
    • ISO/IEC 27001
    • ISO 22301
    • Customer or sector requirements
    • Internal procedures only
    • Other (describe)
  • Programme objectives*Notes

    For example cover every process in the certificate scope within the year, verify last year's corrective actions.

  • Certification body, if certifiedShort answer

    Optional.

  • Next external auditDate
  • Your longest gap between audits, high risk (days)*Number

    Your own rule, for example 183.

  • Medium risk (days)*Number

    For example 365.

  • Low risk (days)*Number

    For example 730.

  • GuidanceWhat the programme must weigh. ISO 9001:2015 clause 9.2.2, as quoted by the ISO 9001 Auditing Practices Group, requires an audit programme that takes into consideration the importance of the processes concerned, changes affecting the organisation and the results of previous audits. The Group adds that processes with higher risk or nonconformities should have priority, and that ISO 9001 does not specify the frequency, duration or scope of internal audits: you set them. The gap intervals above are your own rule.
  • CheckISO 9001:2015 was withdrawn on 16 September 2026 when ISO 9001:2026 was published. ISO says certified organisations transition within the timeframe set by their certification cycle and should ask their certification body. Check clause numbers in your own copy of the edition you audit against.
    Shown only when the answers above make it relevant
  • CheckThis programme supports a management system record. It does not certify conformity with any standard.

Sites, processes and schedule

  • GuidanceAdd each site, department or function as a space, then the processes or areas in it. Put the high-risk ones early in the year.
  • Sites and departments
    Repeat for each entry. Each one asks:
    • Site, department or function*Short answer
    • Main contactShort answer
    • Processes and areas to audit
      Repeat for each entry. Each one asks:
      • Process or area*Short answer

        For example purchasing, goods in, calibration, design changes.

      • Process owner*Short answer
      • Standard and clause referencesShort answer

        From your own copy of the standard.

      • Risk rating*Choose one
        • High
        • Medium
        • Low
      • Why this ratingTick all that apply
        • Nonconformities at the last audit
        • Customer complaints or returns
        • Significant change to the process
        • New process, product or site
        • Critical to product or service quality
        • Legal or regulatory requirement
        • Poor performance indicators
        • Stable, with good results
      • Last auditedDate
      • Result last time*Choose one
        • No nonconformities
        • Minor nonconformities
        • Major nonconformity
        • Not audited before
      • Days since last auditWorked out by the form
        Shown only when the answers above make it relevant
      • Against your intervalWorked out by the form
      • Planned audit date*Date
      • Lead auditor*Short answer
      • Auditor independent of this process?*Yes or No

        Yes if the auditor does not do, manage or answer for the work being audited.

      • Auditor trained for this audit?*Yes or No
      • How objectivity will be kept*Notes
        Shown when “Auditor independent of this process?” is No
      • WarningThe auditor is involved in this process. ISO 9004:2018, quoted by the ISO 9001 Auditing Practices Group, says audits should be done by people not involved in the activity examined, to give an independent view. Swap auditors if you can.
        Shown when “Auditor independent of this process?” is No
      • Status*Choose one
        • Planned
        • Dates agreed with the auditee
        • In progress
        • Completed, report issued
        • Postponed
        • Cancelled
      • Date completed*Date
        Shown when “Status” is “Completed, report issued”
      • Audit report referenceShort answer
        Shown when “Status” is “Completed, report issued”
      • Nonconformities raisedNumber
        Shown when “Status” is “Completed, report issued”
      • New date and reason*Short answer
        Shown only when the answers above make it relevant
      • ScheduleWorked out by the form
      • Days overdueWorked out by the form
        Shown only when the answers above make it relevant
      • CheckThe planned date has passed and the audit is not complete. Reschedule it, and tell the programme manager.
        Shown only when the answers above make it relevant
    • AuditsWorked out by the form
    • CompletedWorked out by the form
    • OverdueWorked out by the form
    • High riskWorked out by the form
    • Auditor not independentWorked out by the form
    • Gaps over intervalWorked out by the form

Coverage and programme review

  • Audits plannedWorked out by the form
  • CompletedWorked out by the form
  • Complete (%)Worked out by the form
  • OverdueWorked out by the form
  • High-risk entriesWorked out by the form
  • Gap over your intervalWorked out by the form
  • Auditor not independentWorked out by the form
  • CheckAudits are overdue. Reschedule them and record why on each entry.
    Shown only when the answers above make it relevant
  • Every process in the management system scope is in the programmeChoose one

    Compare with the scope statement and the process map.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Risk ratings reviewed since the last updateChoose one

    After complaints, changes, incidents and last year's results.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Results of previous audits used to plan this oneChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • High-risk processes scheduled before medium and lowChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Each audit has scope, criteria and objectives agreed with the auditeeChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Dates for the next quarter's audits agreed with the auditeesChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Auditors trained, with competence recordsChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Reports of completed audits issued to the process ownersChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Corrective actions from earlier audits followed up and verifiedChoose one
    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Programme results reported to top managementChoose one

    For example as an input to management review.

    • Acceptable
    • Action needed
    • Not checked
    • Not applicable
  • What needs doing, or why not checkedNotes
    Shown only when the answers above make it relevant
  • Review checks needing actionWorked out by the form
  • AcceptableWorked out by the form
  • Not checkedWorked out by the form
  • Changes made to the programme at this reviewNotes

Programme review sign-off

  • Items needing actionWorked out by the form
  • ResultWorked out by the form
  • Actions
    Repeat for each action. Each one asks:
    • Action*Notes
    • PriorityChoose one
      • This month
      • Before the next audit
      • Before the external audit
      • At the next programme review
    • Who will do it*Short answer
    • Due byDate
    • Status*Choose one
      • Open
      • In progress
      • Done, checked
    • Photo when donePhotos
      Shown when “Status” is “Done, checked”
  • Actions still openWorked out by the form
  • Decision*Choose one
    • Programme approved as it stands
    • Approved with the listed changes
    • Not approved: revise and resubmit
  • Next programme reviewDate
  • Summary for top managementNotes
  • Audit programme manager nameShort answer
  • Audit programme manager signature*Signature
  • Top management representative nameShort answer
  • Top management representative signatureSignature

See it filled in

A completed internal audit programme report, made by SiteSurvey from a fictional site visit: every answer, the photos, the guidance that applied and the sign-off, ready to send as a PDF.

See completed form (PDF) ↗

Internal audit programme FAQs

How often should each process be audited?

ISO 9001 does not say. The ISO 9001 Auditing Practices Group says the organisation defines the frequency, duration and scope of internal audits, using a risk-based approach, and that processes with higher levels of risk or nonconformities should have priority. The form asks you to set your own longest gap for high, medium and low risk, and flags any process left longer.

Source: ISO 9001 Auditing Practices Group, guidance on internal audits (ISO and IAF).

Can someone audit their own department?

It is best avoided. ISO 9004:2018, quoted by the ISO 9001 Auditing Practices Group, says audits should be conducted by people who are not involved in the activity being examined, to give an independent view; the Group notes that ISO 9004 is guidance, not an auditable ISO 9001 requirement. The form asks for an independence check on each audit and, if the answer is no, how objectivity will be kept.

Source: ISO 9001 Auditing Practices Group, guidance on internal audits (ISO and IAF).

Which edition of ISO 9001 should the programme cover?

ISO 9001:2026 was published in September 2026 and ISO 9001:2015 is now withdrawn. ISO says certified organisations will transition within the timeframe set by their certification cycle and should contact their certification body. The form lets you tick either edition, and reminds you to take clause numbers from your own copy of the edition you audit against.

Sources: ISO 9001:2026, quality management systems: requirements (iso.org) and ISO 9001:2015, withdrawn and revised by ISO 9001:2026 (iso.org).

Do I have to follow ISO 19011?

No. ISO 19011 gives guidelines for auditing management systems, including managing an audit programme, and does not itself lead to certification. The ISO 9001 Auditing Practices Group notes that ISO 9001 does not require organisations to use it. The current edition is ISO 19011:2026, published in May 2026.

Sources: ISO 19011:2026, guidelines for auditing management systems (iso.org) and ISO 9001 Auditing Practices Group, guidance on internal audits (ISO and IAF).

What is the difference between this and an internal audit checklist?

This form is the schedule for the year: which processes, when, who audits them and whether each audit happened. The internal audit checklist is what the auditor fills in during each audit. Record the audit report reference against each completed entry here so the two link up.

Does the form certify our management system?

No. It is a record that supports your management system. It does not show conformity with ISO 9001 or any other standard; only your own audits, management review and, if you are certified, your certification body's audits do that.

Related

Audit management softwareInternal audit checklistNon-conformance report templateSafety audit checklistSupplier evaluation formAll forms in the library

Related templates

Templates that go with the internal audit programme form

Internal audit checklist

Internal audit of a quality, health and safety or environmental management system, a 5S area or a procedure, with findings, corrective actions and sign-off.

7 sections · 92 questions · See every question →
Non-conformance report template

Record a non-conformance, contain it, find the root cause with 5 whys, set corrective actions with owners and dates, then verify and close.

5 sections · 52 questions · See every question →
Gemba walk checklist

Structured walk of a work area: what you saw against the standard, the eight wastes, conversations with the people doing the work, observations and actions.

4 sections · 33 questions · See every question →
Supplier evaluation form

Approve or re-evaluate a supplier or subcontractor: insurance, certificates and competence checks, scored performance, audit findings and a decision with conditions.

5 sections · 42 questions · See every question →

Browse all 428 forms in the library

Use this internal audit programme form with your team

Add it from the form library in one click, change any question, and every completed form becomes a branded PDF report.

Start your trial →