ISO 9001:2026 Internal Audit Objectives: How to Update Your Programme

An internal audit programme is easier to use when each audit has a clear purpose. A schedule can show which process will be reviewed and when, but it does not by itself explain what the audit is meant to establish. For an organisation preparing for ISO 9001:2026, that distinction matters: the confirmed change to internal audit arrangements is that each audit needs a defined objective as well as its scope and criteria.

This is a focused guide to updating an audit programme without turning it into a new bureaucracy. The ISO 9001:2026 hub gives the wider context, and the ISO 9001:2026 transition readiness check can help you identify where your current audit arrangements need attention. The advice here is based on the practical structure of the ISO 9001 pack’s internal audit procedure, programme, checklist, log and report templates. The pack follows ISO 9001:2015 including Amendment 1:2024, not ISO 9001:2026, so check any future-edition requirements against the published standard and your certification body’s guidance.

What an audit objective adds

An objective states the result the audit is intended to achieve. It answers the question: what are we trying to find out? That is different from the scope, which says what process, location or activity is included, and from the criteria, which says what requirements or documented arrangements will be used for comparison.

For example, “internal audit process” is a scope description, not an objective. “Determine whether internal audits are planned, conducted, reported and followed up in a way that supports objective conclusions and timely improvement” is an objective. It gives the auditor a direction and gives the process owner a fair explanation of what the audit will examine.

A useful objective should be specific enough to guide sampling but broad enough to support an impartial conclusion. Avoid objectives that promise a result, such as “prove the process is compliant”. An audit should test evidence, not start with a verdict.

Start with the existing programme

Read your current programme before changing its format. The ISO 9001 audit programme template is organised around an audit reference, process or procedure, scope or requirement, auditor, planned dates, status and evidence reference. Those fields remain useful. Add an objective field or incorporate the objective into the scope and requirement entry, provided it is easy to find before the audit starts.

Then review the reasons for the audit frequency and order. The pack’s procedure points to process importance, previous results, changes, nonconformity history and customer requirements as factors in planning. Use those factors to decide how much attention an audit needs, not to manufacture a complicated score. A changed process may need an objective about implementation and effectiveness. A process with repeated findings may need an objective about whether corrective actions have addressed the cause and stayed effective.

Keep the programme readable. An auditor should be able to see the process, objective, scope, criteria, assigned auditor, timing and expected record without searching across several unrelated registers.

Write objectives for different audit purposes

Different audits need different objectives. A process audit might ask whether planned controls are implemented and producing the intended outputs. A document-control audit might examine whether current approved information is available where it is needed and whether obsolete information is prevented from unintended use. A supplier audit might test whether evaluation, communication and monitoring arrangements are working for the supplier relationship in scope.

A follow-up audit should say what it is checking. For example, it may determine whether agreed corrective actions were implemented, whether the evidence is sufficient and whether the action dealt with the identified cause. This is more useful than repeating the original audit title.

For an audit connected with the 2026 review, keep the objective tied to the confirmed change area being examined. An objective might test whether each audit in the programme has a defined objective, scope and criteria, and whether the resulting records support a clear conclusion. Do not use the audit programme as a reason to claim other clause-level changes that have not been confirmed.

Link the objective to scope and criteria

A well-formed audit entry has three connected parts:

1. Objective: the question the audit is intended to answer.
2. Scope: the process, site, records, people, products or time period included.
3. Criteria: the requirements used to assess evidence, such as applicable ISO requirements, procedures, customer requirements or approved work instructions.

Suppose the process is customer quotation. The objective could be to determine whether quotations are reviewed before issue and whether relevant requirements are transferred accurately into later work. The scope might cover quotations issued during a defined period and the hand-off to order review. The criteria might include the organisation’s quotation procedure, approved forms and applicable customer requirements. Together, these details tell the auditor what to sample and tell the auditee what the audit will cover.

Do not make the objective a list of every question on the checklist. The checklist should help gather evidence against the objective. The pack’s internal audit checklist provides prompts for audit details, evidence, conformity and findings; use it as a working aid, then record the conclusion in the audit report and log.

Brief auditors and auditees

Before the audit, share the objective with the people responsible for the process. This reduces surprise and helps them identify the records that can demonstrate how the process operates. It does not mean allowing the auditee to select only favourable evidence. The auditor still decides what to sample and should remain objective and independent of the work being audited.

Auditors should understand the difference between evidence and assertion. A statement that a control is followed is useful context, but the conclusion should be supported by records, observation, interview evidence or other verifiable information. The audit procedure and report templates are designed around that trail: planning, examination, findings, reporting and follow-up.

If the objective concerns effectiveness, define what effectiveness will look like before sampling. It might involve timely completion, accurate outputs, reduced repeat findings, reliable communication or achievement of an approved process result. Avoid vague tests such as “check everything is working”.

Record the conclusion clearly

An audit report should make it possible for a reader who was not present to understand whether the objective was met, partly met or not met, and why. Record the scope and criteria, the evidence sampled, relevant findings, the conclusion and any follow-up. If the audit found no nonconformity, that does not mean the evidence can be omitted. A concise evidence trail supports the conclusion.

Use the internal audit log to connect the audit reference with the report or evidence location, findings, action ownership, status and closure information. This makes later review more efficient and helps management see whether the programme is being completed and whether issues are recurring. A register is not a substitute for the underlying report; it is an index and monitoring record.

If the objective was poorly written, record that learning and improve the next programme entry. Continual improvement includes making the audit process more useful, not just closing findings.

Check the programme before approval

Run a short review before approving the revised programme:

• Does every planned audit have a stated objective?
• Can the scope be understood without relying on informal knowledge?
• Are the criteria named clearly enough for the auditor to prepare?
• Does the timing reflect process importance, change and previous results?
• Is the auditor independent of the work being audited?
• Will the report show evidence, findings and a conclusion against the objective?
• Can the audit reference be traced through the programme, checklist, report and log?
• Are follow-up actions assigned and checked for completion?

Use the ISO 9001 Pack if you need a structured starting point for the programme and related audit records. The ISO 9001:2026 opportunity register guide and ISO 9001:2026 document control review cover two related areas that may arise when you review your wider QMS evidence. You can also try the free ISO templates page before deciding which documents need adapting.

A defined objective makes an internal audit more than a calendar entry. It gives the audit a fair question, connects the question to evidence and makes the final conclusion easier to trust. Update the programme in that spirit, keep the records proportionate to your organisation, and validate detailed ISO 9001:2026 requirements against the standard itself and your certification body’s guidance.