An ISO audit should not begin with a checklist at the point of inspection. By then, the organisation should already have defined the audit scope, criteria, competent auditors and evidence required. Knowing how to conduct ISO audits properly gives directors and management system leaders reliable assurance that documented arrangements are working in live operations, not simply looking acceptable on paper.
For UK construction, manufacturing, utilities, property and nuclear supply-chain organisations, internal audits are a control measure. They test whether ISO 9001, ISO 14001, ISO 45001 or ISO 19443 arrangements are embedded in procurement, project delivery, maintenance, contractor management and workforce competence. Done well, they identify weaknesses before they become certification findings, client concerns, environmental incidents or health and safety failures.
Start with an audit programme, not isolated audits
ISO management system standards require planned internal audits at appropriate intervals. This does not mean every process needs the same audit frequency. Your programme should be based on risk, the importance of each process, operational change, previous audit results and any complaints, incidents or nonconformities.
A contractor delivering high-risk civils works, for example, may need more frequent audits of RAMS, subcontractor controls, plant inspection and competence records than of low-risk administrative processes. An organisation managing environmental permits may prioritise waste-duty-of-care records, pollution prevention controls and emergency response following a significant site change. In an ISO 19443 environment, the audit programme must also reflect nuclear safety culture, counterfeit, fraudulent and suspect items controls, and the graded approach to quality management.
Set out the annual or rolling programme with each audit’s purpose, scope, criteria, planned date, process owner and auditor. Leave capacity for unplanned audits where incident investigations, client feedback, major changes or repeat nonconformities justify additional assurance.
Define the scope and audit criteria
Every audit needs a clear boundary. A vague scope such as “ISO 45001 audit” creates unfocused interviews and weak findings. A useful scope might be: “Planning and delivery of excavation works at the North West framework project, including competence, permit controls, HSG47 arrangements, RAMS communication, inspections and incident reporting.”
The audit criteria are the requirements against which evidence will be tested. These usually include the applicable ISO standard, the organisation’s management system procedures, legal requirements, client specifications and project-specific controls. For an environmental audit, criteria might also include planning conditions, environmental permits, drainage management plans or pollution incident procedures.
Keep audit scope realistic. A one-day audit cannot credibly test every clause and every operational control across a complex business. It is better to audit a defined process in depth and follow evidence through to site implementation than to produce a broad report with little assurance value.
Build an audit plan and working papers
Prepare an audit plan before arriving on site or opening the first record. Confirm the audit objectives, timetable, locations, auditees, documents to review and opening and closing meetings. Send the plan to relevant managers in enough time for records and key personnel to be available.
Working papers should guide the audit without turning it into a tick-box exercise. Use clause references and process questions, then leave room to record objective evidence. For example, rather than asking only whether competence is controlled, test how the business verifies CSCS, EUSR, vocational qualifications, site inductions, role-specific training and refresher requirements before deployment.
Review previous audit reports, corrective action logs, management review actions, incidents and customer complaints in advance. These records help an auditor target recurring failures and verify whether earlier actions have actually removed the cause.
How to conduct ISO audits on site and in the workplace
Open the audit by confirming its purpose, scope, method and timings. Explain that the audit is an assessment of the system and its implementation, not an exercise in assigning blame to individuals. This matters where personnel may otherwise be reluctant to explain workarounds, resource constraints or gaps between procedures and actual site practice.
Collect objective evidence through interviews, document review, observation and sampling. Evidence must be verifiable. Statements such as “we always complete inspections” are not enough. Ask to see completed inspection records, identify who carried them out, check whether defects were closed out, and compare the records with the physical condition of plant, access routes or work areas.
Traceability is especially valuable. Start with a requirement and follow it through the process. For instance, trace a DSEAR assessment through to hazardous-substance storage, signage, maintenance arrangements, workforce briefing and emergency planning. For quality controls, trace a purchase order through supplier approval, goods-in checks, inspection and test records, and final handover documentation.
Use sampling intelligently. No audit can inspect every record or work activity, but samples must be sufficient to support the conclusion reached. Increase the sample where controls are high risk, records are inconsistent or previous findings exist. Record sample references, dates, locations and the people interviewed. A finding without traceable evidence is difficult to defend and difficult for the auditee to correct.
Maintain independence and professional judgement. Internal auditors should not audit their own work where this could compromise impartiality. In smaller organisations, this may require cross-functional auditors or external support. Competence is not limited to auditor training: the auditor also needs enough technical understanding to assess the process being audited. A fire-door inspection control, confined-space permit system or nuclear quality process cannot be evaluated meaningfully through generic questions alone.
Classify findings accurately
Audit findings should be factual, clear and proportionate. Avoid subjective language such as “poorly managed” or “unsatisfactory”. State the requirement, the evidence observed and the nature of the gap.
A nonconformity exists where a requirement has not been met. Organisations commonly distinguish between major and minor nonconformities, although the definition should be established within the management system and align with certification-body expectations where relevant. A major nonconformity may indicate a systemic failure, a significant breakdown of control or an absence of a required process. A minor nonconformity is an isolated failure that does not demonstrate system-wide breakdown.
Observations and opportunities for improvement have value, but they should not be used to avoid recording a clear nonconformity. Equally, do not inflate every imperfection into a major issue. The aim is credible assurance and effective improvement, not an intimidating report.
Before the closing meeting, validate key facts with the auditee. This does not mean negotiating away evidence. It gives process owners an opportunity to clarify records, correct misunderstandings and understand the requirement being applied.
Report findings so action is possible
The audit report should be issued promptly while the evidence and context remain current. It should identify the audit scope, criteria, dates, auditor, people consulted, evidence sampled, findings, positive practices and any limitations affecting the audit.
For each nonconformity, describe what was required, what was found and why this represents a failure to meet the requirement. A useful finding is specific enough for a manager to assign ownership without having to reinterpret it. For example: “The procedure requires weekly excavation inspections to be recorded. Two of five sampled weeks had no inspection record, and the site manager could not demonstrate an alternative documented control.”
Reports should not simply list defects. They should give senior management a meaningful view of system performance, recurring themes and risk exposure. If similar findings arise across projects, the issue may be inadequate central arrangements, unclear procedures, insufficient supervision or ineffective training rather than an isolated site failure.
Verify corrective action, not just closure
Closing an action when a form has been amended or a briefing has been delivered is not the same as verifying effectiveness. The responsible manager should first contain the issue where needed, identify the root cause, implement corrective action and provide evidence of completion.
Auditors or designated competent persons should then verify whether the action works in practice. If incomplete permit records resulted from an unclear workflow, for example, test subsequent permits and speak to users after the revised process has been implemented. If the same failure persists, reopen the action or escalate it through management review.
Root-cause analysis must go beyond attributing failures to “human error”. Ask why the error was possible: was the procedure unclear, was supervision unavailable, did programme pressure encourage shortcuts, or was competence not adequately assessed? This is where internal audit creates operational value rather than generating paperwork.
Use audit results in management review
Audit outcomes should inform management review alongside objectives, incidents, complaints, legal compliance, supplier performance, resources and improvement opportunities. Trends may demonstrate where investment is required, whether in supervisor training, document control, software, specialist inspections or retained competent-person support.
The most effective audit culture treats evidence as an early-warning system. When auditors are competent, findings are evidence-led and corrective action is tested for effectiveness, ISO audits become part of everyday assurance. That gives management a firmer basis for protecting people, meeting client requirements and maintaining confidence in the controls that keep projects and operations compliant.