Guides · Operation
Internal audit and management review
These two clauses, 9.2 and 9.3, are where an ISO 9001 system proves it runs itself. Internal audit checks the system against the standard and against your own rules; management review puts leadership on the hook for acting on what the audit finds. They are also where small businesses most often stall before certification, because both require the system to already have a history.
The short version
Internal audit (9.2) is your system checking itself, conducted by someone impartial, covering the whole system over a planned programme. Management review (9.3) is top management looking at the evidence and deciding what to change. Skip either and you cannot certify: an auditor needs to see at least one of each, completed, with results retained.
The loop · at a glance
Clause 9.2
Internal audit: the system checks itself
An internal audit asks a plain question of your own system: does it conform to the standard, does it conform to your own documented requirements, and is it effectively implemented and maintained? You establish an audit programme (the frequency, methods, responsibilities, planning, and reporting) that covers the whole management system over time, weighted toward the processes that matter most and the areas that have had problems.
The non-negotiable is impartiality. Auditors must be objective and cannot audit their own work: the person who runs a process cannot be the one who signs off that it conforms. In a small business this is a practical puzzle, not a wall. Someone audits a process they don't operate, roles are swapped, or a trained external auditor is brought in for the day. Auditors need genuine competence in auditing technique and the relevant processes, but they do not need to be a certification body. And you retain the audit results as a record, because the audit that leaves no trace did not happen, as far as certification is concerned.
Clause 9.3
Management review: leadership on the hook
Top management reviews the whole system at planned intervals, against a defined set of inputs, and the review has to produce decisions.
Inputs Clause 9.3
Clause 9.3 names them: status of actions from prior reviews; changes in internal and external issues; customer feedback and satisfaction; how the quality objectives are performing; process performance and product conformity; nonconformities and corrective actions; monitoring and audit results; external-provider performance; adequacy of resources; and the effectiveness of actions taken on risks and opportunities. Leadership cannot review the system on vibes, because the agenda is prescribed.
Outputs Clause 9.3
Decisions and actions: opportunities for improvement, any needed changes to the management system, and resource needs. A review that concludes "everything is fine, no actions" once may be honest; a review that concludes it every single time tells an auditor the review isn't really happening. And the results are retained as a record, so the minutes are the evidence.
Frequency is set as "planned intervals," not a fixed number, but the review must be often enough to steer the system, and there must be at least one complete cycle behind you before certification.
The link
Why these two gate certification
Together, 9.2 and 9.3 form the feedback loop that makes a quality system a system rather than a binder. The audit finds what is drifting; the review decides what to do about it; clause 10 closes the corrective action; and the next audit checks that the fix held. Take any link out and the loop is open, which is exactly what a certification auditor is trained to notice.
This is why they gate certification in practice as well as on paper. You cannot demonstrate the loop without having run it at least once: a completed internal audit across the system, a management review that acted on the results, and corrective actions that closed. That evidence is time-bound. It cannot be produced the week before Stage 2, which is the real reason the certification timeline insists the system operate for months first.
Neither clause is hard once the cadence exists; the difficulty is building the habit from a standing start. An engineered program carries the audit programme, the review agenda, and the corrective-action workflow as working documents from day one, so the loop is turning while you learn to run it, instead of being invented in a panic before the audit.
Straight answers
Asked and answered
Can we audit our own work?
No. 9.2 requires impartiality. Someone audits a process they don't run, or you bring in a trained outside auditor. They need auditing competence, not certification-body status.
How often are these required?
"At planned intervals": the whole system audited across the programme, management review often enough to steer it. In practice, audits across a year, review at least annually, and always at least one of each before certification.
What goes in a management review?
The inputs 9.3 lists: audit results, customer feedback, objective performance, corrective actions, resources, and more. And it must output decisions on improvement and change. Retain the results.
Can we outsource the internal audit?
Yes. Many small businesses use a competent external auditor for internal audits, which keeps impartiality clean. It's still your internal audit; the certification body's audit is a separate thing.
Sources
- ISO 9001:2015, Quality management systems — Requirements (clauses 9.2 internal audit and 9.3 management review)
- ISO 19011:2018 (guidelines for auditing management systems: auditor competence and impartiality)
- ASQ: quality auditing
Next up
JumpStart ISO ships the audit programme, the management-review agenda, and the corrective-action workflow as working documents, so the feedback loop runs from day one instead of being invented before the audit.
Request early access