ISO Internal Audits at a Small Site: Schedule, People, Rules

The audit schedule pinned to the quality notice board in March is usually the same one still pinned there in October. Nobody crossed anything off. That is the most common failure mode in internal audit at a small site, and it has nothing to do with how competent the auditors are.

At 40 people, you do not have a dedicated quality team. You have a quality manager who also handles supplier complaints, a production supervisor who doubles as a first aider, and a maintenance engineer who wrote the calibration procedure three years ago and has not looked at it since. Building an audit programme that actually runs means accounting for all of that before you write a single date in a spreadsheet.

Work Out the Coverage First, Then the Schedule

ISO 9001 requires that you audit the entire quality management system over a planned period, taking into account the importance of the processes and the results of previous audits. That sentence is often read as “audit everything once a year.” It does not mean that.

A despatch process that generates three customer complaints a week deserves more attention than a documented procedure for ordering office stationery. Start by listing every process in scope, then mark each one as high, medium, or low risk based on customer impact, previous nonconformances, and process stability. High-risk processes should appear on the schedule two or three times a year. Low-risk ones might only need covering once every 18 months.

For a 40-person site, a realistic annual programme is usually 10 to 14 audits. Fewer than that and you will struggle to demonstrate full system coverage at your external audit. More than that and the programme becomes a burden nobody wants to own.

Picking Your Auditors

You do not need a team of certified lead auditors. You need people who can prepare a checklist, ask a question without making the auditee feel accused, and write down what they actually saw rather than what they expected to see.

At small sites, the auditor pool is typically three to five people drawn from across the business: a quality technician, a shift supervisor, a planning coordinator, someone from the warehouse. They each do two or three audits a year, which is enough to stay competent without it becoming a second full-time job.

Train them properly. A one-day internal auditor course is enough to start. What matters more is the debrief after the first few audits. Sit down, go through what they found, discuss how they asked questions, and look at whether the nonconformances raised were specific enough to be actionable.

The Independence Rule

This is where small sites consistently get it wrong. An auditor cannot audit their own area. That rule exists because people find what they expect to find in a process they run themselves, and because the whole point of an audit is an independent check.

At 40 people this creates a practical problem. You might only have one person who truly understands the maintenance schedule, and they are also the one who owns it. The answer is to audit the procedure and the records, not the technical content. Your quality manager can verify that calibrations are being done on time and that out-of-tolerance results were acted upon, without needing to be a metrology expert.

Document your independence arrangements. Your external auditor will ask. A simple matrix showing who is allowed to audit which area, and why, takes 20 minutes to produce and removes any ambiguity.

Keeping the Programme Running

The audit schedule needs an owner with the authority to chase people when audits slip. At a 40-person site that is usually the quality manager, but the programme should be reviewed at management review meetings so that senior leadership is accountable for it too.

Build in a buffer. If you schedule 12 audits and every single one runs on time, something has probably gone wrong with how you are selecting audit scope. Real operations generate sickness, shutdowns, and last-minute customer visits. Plan for two or three audits to move and make sure the schedule has room to accommodate that without dropping coverage.

When an audit finds a nonconformance, close it properly. An audit programme that raises findings and never resolves them is worse than no programme at all. It tells your external auditor that you identify problems and ignore them.

Connecting Audits to the Rest of the System

An audit programme that runs in isolation from the rest of your management system will not improve much. The findings from internal audits should feed directly into your corrective action process, and that process should connect to wherever you track operational losses. If your auditors are finding the same waste-related nonconformances quarter after quarter, the losses tracker is a straightforward way to quantify what those recurring findings are actually costing the site.

If audits keep returning to housekeeping, organisation, and material flow, it is worth checking whether your 5S programme is genuinely embedded or just documented on paper. The 5S guide has a practical implementation framework built for sites at exactly this scale.

If you are building the programme from scratch, the diagnostic can help you identify where the management system has the biggest gaps before you finalise the schedule. For a ready-built audit template set rather than starting from a blank spreadsheet, the toolkit includes checklists aligned to ISO 9001 clause structure, designed for small teams without a full-time quality department.