ISO 9001:2026 internal auditor, two days
Two days that end with delegates writing nonconformities their own certification body cannot argue away.
- Duration
- 2 days, 14 contact hours
- Level
- Internal audit
- Built on
- ISO 19011 guidelines, audited against ISO 9001:2026
- Prerequisites
- Clause knowledge, from the awareness day or a year in the system
- Assessment
- Two assessed practicals plus written nonconformity drafting
- Certificate
- ITF certificate of completion, naming the assessment passed
A two-day internal auditor course for ISO 9001:2026 built on the ISO 19011 auditing guidelines. Delegates plan an audit, write a checklist, run an audit interview, gather evidence and write nonconformities that survive review.
- 01 Enquiry
- 02 Needs analysis
- 03 Programme design
- 04 Scheduling
- 05 Delivery
- 06 Assessment
- 07 Certification
- 08 Records
ISO 9001:2026 internal auditor, two days sits at step 5 of the delivery cycle. You receive course materials and an attendance record.
Where internal audit programmes quietly die
Most internal audit programmes produce nothing. They run on time, they fill the schedule, and they find nothing the organisation did not already know.
There are three usual causes and this course attacks all three. The programme is a rota rather than a risk-based plan, so the same low-consequence processes get audited every year. The checklist is a list of clauses rather than a list of questions, so the audit tests whether a document exists instead of whether a control works. And the findings are opinions, so they get downgraded, argued away or closed with a training record.
The third one is the one delegates feel. A finding that reads the procedure is not being followed properly is an opinion. A finding that reads clause 8.5.1 requires production under controlled conditions; work instruction WI-12 requires a first-off check at each setup; on 14 May the setup log for line 3 carried no first-off entry for two of four setups is a fact, and nobody argues with it.
Day two is largely that conversion. Delegates draft nonconformities from evidence extracts, get them marked, and draft them again. It is the least glamorous thing in the catalog and it is why the course is two days.
Two days, session by session
Day one builds the audit. Day two runs it, writes it up and closes it out. The practical work does not compress into one day, which is why this is two.
| Session | What is covered | Time |
|---|---|---|
| Day 1 · What an internal audit is for | Why most internal audit programmes produce nothing, and what a programme that finds real problems looks like instead. | 0:30 |
| Day 1 · ISO 19011 and the programme | Auditing principles, the audit programme, auditor competence, and building a programme from risk and past performance rather than a calendar. | 1:00 |
| Day 1 · Clause refresher, 9001:2026 | The standard from the auditor's side: what is auditable in each clause and what evidence each one produces. | 1:00 |
| Day 1 · Planning and checklist build | Scope, criteria, sampling and the audit plan, then delegates build a process-based checklist. Practical. | 1:30 |
| Day 1 · Audit technique | The opening meeting, questioning, following a trail, corroboration, note-taking, and handling an auditee who does not want you there. | 1:30 |
| Day 1 · Evidence | What counts, what does not, sample sizes, and the honesty of a sample you chose yourself. | 1:30 |
| Day 2 · Audit role play | Paired practical against a supplied scenario pack, rotating auditor and auditee. | 1:30 |
| Day 2 · Findings workshop | Grading a finding, and the three-part nonconformity statement: requirement, evidence, deviation. | 1:00 |
| Day 2 · Second practical | On your site, delegates audit each other's real functions. Live online runs use a second scenario pack. | 1:00 |
| Day 2 · Report and closing meeting | Writing the audit report, presenting findings without a fight, and agreeing what happens next. | 1:00 |
| Day 2 · Corrective action | Reviewing a root cause analysis, judging whether an action is adequate, verifying effectiveness and closing out. | 1:00 |
| Day 2 · Assessment | Written assessment including three nonconformity statements drafted from evidence extracts. | 1:00 |
| Day 2 · Auditor behaviour | Impartiality, and auditing colleagues you have to work with on Monday without wrecking the relationship. | 0:30 |
The toolkit that leaves with you
Reusable checklists for clauses 4 to 10
Process-based, written as questions about evidence rather than as clause headings. The starting point for your own programme.
The nonconformity writing guide
The three-part statement with worked examples, including weak findings and the rewritten version beside them.
An audit programme template
Risk-weighted, showing coverage across the scope and who audits what so nobody audits their own work.
The auditor workbook
Everything covered across both days, annotated, including the marked assessment work.
A ITF certificate of completion
Naming the assessment passed, not just attendance. This is the competence evidence your programme needs under clause 7.2.
Six things an auditor leaves able to do
Each outcome ties back to the session that builds it.
- 01
Build an audit programme from risk
Weighted by consequence and past performance rather than spread evenly across a calendar year.
- 02
Write a process-based checklist
Starting at the clause and ending at a question about a record, a measurement or a physical condition.
- 03
Run an opening meeting, an interview and a closing meeting
Including following a trail from a document to the floor and back, and corroborating what you were told.
- 04
Classify a finding correctly
Nonconformity, observation or opportunity for improvement, and defend the classification when it is challenged.
- 05
Write a nonconformity that cannot be argued away
Requirement, objective evidence, deviation. Assessed three times before the certificate is issued.
- 06
Judge a corrective action before accepting it
Whether the stated root cause is credible and whether the action removes it or only inspects for it.
Five auditors and a downgraded year
A plastics packaging plant in Dammam 2nd Industrial City has five internal auditors and a certification body that downgraded most of last year's internal findings to observations.
The quality manager sent us three anonymised findings from that audit and the plant's audit programme a week ahead. Day one's checklist exercise used the plant's own extrusion and printing processes.
The findings workshop on day two started from the three downgraded findings, and each delegate rewrote them into requirement, evidence and deviation. The second practical had the auditors audit each other's departments, with nobody auditing their own. The programme template was rebuilt around the plant's highest-consequence processes rather than a monthly rota.
The plant ended up holding the rewritten findings beside the originals, a risk-weighted audit programme, reusable checklists for its own processes, and a certificate per auditor naming the assessment passed.
Who we put in this room
People already on the audit schedule
Anyone listed as an internal auditor in your programme, whether they were trained for it or simply available when the schedule was written.
- Convert a clause list into a question set that finds real problems
- Sample defensibly instead of auditing whatever is on the desk
- Write findings your certification body does not downgrade
The person who owns the programme
Management representatives and quality coordinators who schedule the audits, chase the findings and present the results at management review.
- Build a risk-based programme instead of a rota
- Set up cross-department auditing in a company where everyone knows everything
- Turn an audit cycle into a real input to management review
Managers who audit other departments
Production, engineering, procurement and warehouse managers drafted into the audit programme to keep it impartial.
- Audit outside your own expertise without being led by the auditee
- Know when to stop pulling a thread and when to keep pulling
- Separate a genuine nonconformity from a difference of opinion
Asked by auditors, and by their managers
Does this make me a lead auditor?
No. It qualifies you to carry out internal audits within your own organisation. ITF does not offer lead auditor training.
Can our internal auditors audit their own department?
No. ISO 9001 requires objectivity and impartiality in the audit process. The course covers how to split a programme so that impartiality survives in a small company where everyone knows everything, including the case where one person is the only competent auditor for a process.
How many internal auditors do we need?
Enough to cover the scope without anyone auditing their own work. For a single-site company under 100 people, three to five trained auditors is usually workable. Beyond that it is driven by how many processes you have and how often each needs auditing.
Our auditors write findings the CB then downgrades. Will this fix it?
That is the main thing day two fixes. Most rejected findings fail for the same reason: they state an opinion instead of the requirement, the evidence and the deviation. Delegates draft three from evidence extracts under assessment before they leave.
Is the certificate recognised?
It is an ITF certificate of completion, and it records that the participant attended and met the assessment criteria on the day. It is not an accredited qualification. It is the kind of evidence a management system asks for under ISO 9001 clause 7.2 and its equivalents. If your buyer or regulator names a certificate issued under an accreditation scheme, tell us at enquiry and we will say plainly whether ours fits.
Can you run it in Arabic?
Yes. Arabic, English, or Arabic delivery with English material, which is the usual request for a mixed room. Confirm the language when you book, because it decides which trainer and which handouts are scheduled.
Do you come to our site?
Yes, and it is the default. On your site the exercises run on your own documents and processes, and the participants lose no travel time. We need a room, a screen, and the participants released from the floor for the whole session.
How many people can attend?
Awareness courses work up to about 20. Courses with assessed practical work cap at about 12 to 15, so every person does the exercise rather than watching it. These caps are our teaching judgement, not an external rule.
Who delivers it?
Practising auditors. The people teaching these courses spend their working weeks inside factories, warehouses, kitchens and offices carrying out audits, and the examples in the room come from that work. The standard every trainer meets is set out on the trainers page.
What if someone misses a day, or does not pass?
There is no certificate for partial attendance or a failed assessment. The participant can join the missed day or retake the assessment on a later run, and we tell you which person and why. We would rather report a gap than issue a record that says something untrue.
The rest of the sequence
ISO 9001:2026 awareness
The prerequisite day for anyone who has not worked in the system for a year.
Read moreImplementationRoot cause analysis
The analysis skill an auditor needs to judge whether a corrective action is real.
Read moreImplementationNonconformity and corrective action
The register and the response cycle that carries what your audits find.
Read moreConsultInternal audit, run for you
When you want the audit carried out by someone outside the building rather than taught. ITF Consult.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Put two days into the audit programme
An internal audit programme that finds nothing usually has a document control problem and a corrective action problem sitting underneath it. Tell us what your last CB audit found and we will say which of the three to fix first.