Impartiality
The person who designed or operates a process should not audit their own work.
ISO 9001 internal audit · Australia
Independent. Clause 9.2 conformant. Ready for ISO 9001:2026.
An ISO 19011-aligned audit of your quality management system, evidenced from operational records—not a checklist somebody ticked.
Aegentra has teams based in Melbourne and Sydney and delivers across Australia. We test exportable quality records at population level where practical and trace process controls end to end.
Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.
/ 2026 transition
Your next internal audit should already account for it.
ISO 9001:2026 was published on 16 September 2026. Agree the edition and transition requirements for your audit with the certification body and record them in the audit criteria.
Published16 September 2026
TransitionConfirm your applicable timetable
Current certificateDoes not expire on publication day
The new edition is published. For a functioning QMS, transition planning starts with the actual changed requirements and the certification arrangements applicable to your organisation.
The audit plan states whether it assesses the existing certified system, transition readiness or conformity to the new edition. A transition review does not itself change the edition on your certificate.
ISO 9001 publication and edition record · Checked 3 October 2026.
/ Why it matters
Clause 9.2 should test the system—not decorate it.
Weak audit programmes tend to expose the same faults: unclear criteria, checklist-only fieldwork, poor evidence references, self-review threats and corrective actions never tested for effectiveness.
Process evidence
Follow real work and records end to end instead of accepting verbal assurance.
Management action
Give findings owners, dates, cause evaluation and effectiveness checks.
Evidence-led testing
Whole populations where the data supports it.
Where quality records are exportable, we can test the population rather than a handful of selected files: overdue nonconformities, recurring suppliers, lapsed evaluations, calibration dates, complaints and objectives.
Leadership, awareness, knowledge and risk-based thinking remain evidence-and-interview tests. A finding must rest on evidence that existed independently of the audit.
/ Audit coverage
What an ISO 9001 internal audit covers
Clause 4: Context of the organisation
We test whether context, interested parties, scope and process interactions reflect the organisation operating today—including the climate-change consideration introduced by Amendment 1:2024.
Clause 5: Leadership
We test leadership commitment, customer focus, the quality policy, resourcing and whether named people understand their responsibilities and authorities.
Clause 6: Planning, risks and opportunities
We test whether risks, opportunities, measurable quality objectives and organisational changes are planned, owned and evaluated for effectiveness.
Clause 7: Support, competence and documented information
We test resources, infrastructure, calibration, knowledge, competence, awareness, communication and document control against operating evidence.
Clause 8: Operation
We trace work end to end through requirements, design where applicable, suppliers, production or service delivery, release, changes and nonconforming outputs.
Clause 9: Performance evaluation
We test monitoring, customer satisfaction, analysis, the internal-audit programme itself and every required management-review input and output.
Clause 10: Improvement
We test correction, cause evaluation, corrective action, effectiveness review and continual improvement as an operating process—not merely a register.
Qualified delivery matched to your scope
Our team combines implementation, audit, security-governance and technical expertise. Across their professional careers, team members have delivered 2,000+ hours of ISO, ISM and GRC audit work across 70+ organisations.
Team qualifications and credentials
Qualifications, professional credentials and formal training held across Aegentra’s delivery team.
Management systems and audit
- ISO/IEC 27001 Lead Implementer
- ISO/IEC 27701 Lead Implementer
- PECB ISO/IEC 27001 Lead Auditor
- ISO/IEC 42001 Lead Auditor
- CISA — Certified Information Systems Auditor
- ISM Auditor
Cybersecurity and cloud
- CISSP — Certified Information Systems Security Professional
- CISM — Certified Information Security Manager
- Certificate of Cloud Security Knowledge (CCSK)
- OSCP+ — OffSec Certified Professional Plus
Service delivery and specialist training
- ITIL Expert
- PRINCE2
- Mastering Generative AI for Cybersecurity Certificate
- Essential Eight Assessment Course certificate — TAFEcyber
Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.
Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.
/ Method
How the audit runs
The work moves from an agreed scope to evidence, interviews and findings, then closes with action owners and verification.
Scope, criteria and audit programme
We agree sites, processes, clauses, objectives, exclusions, schedule, people and records in writing before fieldwork.
Records and data extraction
We request read-only exports from ERP, project, CRM, complaints, nonconformance, calibration and supplier systems.
Process tracing and interviews
We follow work from enquiry through delivery and compare the documented process with the process people actually operate.
Findings and closing meeting
Every finding is classified, cited to a clause and tied to objective evidence before the report is issued.
Report, corrective actions and follow-up
You receive the report, findings register and clause 10.2 corrective-action structure, with optional follow-up verification.
Scope evidence testing findings follow-up
Competence boundary
Sectors—and where we bring in a specialist.
We are strongest in professional and technical services, software, technology, wholesale, distribution, workforce services, education, healthcare administration and integrated ISO 9001–ISO 27001 systems.
Clause 8 is where sector knowledge matters. Heavy manufacturing, food processing, aerospace, automotive and technically complex production require competence in the process—not only the clause.
Where specialist competence is required, we scope a sector-qualified lead auditor rather than overstate capability.
Independence
We do not audit what we built.
Clause 9.2.2 requires objectivity and impartiality. Where Aegentra implemented or materially designed a QMS, we do not present the same work as an independent internal audit. We scope an independent auditor or tell you plainly to take the audit elsewhere.
Implementation, internal audit and accredited certification remain distinct responsibilities.
/ Outputs
What you receive
- Audit plan with agreed scope, criteria, objectives and schedule
- ISO 19011-aligned internal-audit report written for your organisation
- Findings register cited to clauses and objective evidence
- Evidence index with timestamped extracts and population references
- Clause 10.2 corrective-action plan with owners and effectiveness review
- ISO 9001:2026 transition-readiness assessment against confirmed changes
- Audit results formatted for management review under clause 9.3
- Multi-year audit-programme schedule where required
- Closing meeting and findings walkthrough
- Optional verification of closed corrective actions
/ Commercials
Scope, timeline and fee
Engagements are fixed-fee and quoted after a short scoping call. Effort depends on sites, process complexity, applicable design requirements, record accessibility and audit-programme maturity.
FeeFixed after scope
TimelineConfirmed in writing
AccessRead-only evidence
/ Comparison
How this compares to the alternatives
| Option | What you get | Where it falls short |
|---|---|---|
| Your quality manager | Deep QMS familiarity and no external fee | Objectivity can fail where they built or operate the process. |
| Your implementation consultant | Convenient and already familiar | Creates a self-review threat when they audit their own work. |
| Checklist and available staff member | A low-cost audit record | A ticked template does not demonstrate process auditing or competence. |
| Large firm | Recognised name and enterprise capacity | May be priced and staffed for a larger engagement than your scope needs. |
| Aegentra | Independent evidence-led testing, fixed scope and transition review | We do not audit a QMS we built; specialist operations may need a sector-qualified auditor. |
/ Practitioner evidence
Credentials and recent engagements
Delivery is principal-led and informed by governance and audit work across Australian government and regulated environments. Aegentra is a PECB Authorised Training Partner; audit work remains separately scoped.
/ Questions answered
ISO 9001 internal audit questions
How is a process-based ISO 9001 audit different from completing a checklist?
A process-based audit follows how work achieves its intended result, including responsibilities, inputs, handovers, controls and records. For example, trace a sampled customer requirement through delivery and any complaint or nonconforming output. A checklist can organise criteria, but ticking every row does not establish effective operation. The agreed audit still needs to address the applicable QMS requirements and report the evidence and limitations.
How do outsourced processes affect our quality-management audit?
Include the controls your organisation uses over relevant external provision within the agreed QMS scope. Samples can connect supplier selection and requirements to acceptance records, performance review and action on problems. Outsourcing the activity does not by itself demonstrate that its output meets your requirements. Direct supplier visits or specialist technical assessments are separate scope decisions, not automatic parts of the internal audit.
What happens after an ISO 9001 audit finding is raised?
Management assigns the response and evaluates whether corrective action is needed to address the cause. Separate fixing a particular defective output from changing the process that allowed it. The findings record should identify the criterion, sampled evidence, owner and follow-up arrangements. Where close-out review is agreed, it examines completion and effectiveness rather than treating a revised document as sufficient evidence by itself.
What affects the price of an ISO 9001 internal audit?
Scope and effort determine the quote: processes, sites, shifts, applicable design activities, sector competence, records, interviews and reporting needs. Confirm onsite requirements and any follow-up review. Compare proposals on coverage and deliverables, not only days or headline fees. Certification-body assessment and substantial remediation are separate unless expressly identified in the agreed work.
Is an internal audit mandatory for ISO 9001?
Yes. Clause 9.2 requires internal audits at planned intervals to determine whether the QMS conforms to the organisation’s requirements and ISO 9001, and whether it is effectively implemented and maintained.
When is ISO 9001:2026 published, and when do we have to transition?
ISO published the sixth edition, ISO 9001:2026, on 16 September 2026. The audit plan identifies the criteria and edition being assessed. Confirm the transition timetable applicable to your certificate with its certification body; publication does not itself invalidate an existing certificate.
What is actually changing in ISO 9001:2026?
The revision retains the familiar management-system structure while updating emphasis and guidance. Final transition planning should be based on the published edition and confirmed certification-body arrangements.
Do we need to rush to transition?
No. Use the planning window to identify changes, test them through the internal-audit programme and build evidence before the formal transition audit.
Does the climate-change amendment apply already?
Yes. ISO 9001:2015/Amd 1:2024 is published. Organisations must determine whether climate change is relevant under clause 4.1; clause 4.2 notes that interested parties can have climate-related requirements.
Can we do our own ISO 9001 internal audit?
Yes, provided auditors are selected to preserve objectivity and impartiality and do not audit their own work.
How often do we need an ISO 9001 internal audit?
At planned intervals. Frequency should reflect process importance, organisational changes and previous audit results.
What is the difference between an internal audit and a certification audit?
An internal audit is performed by or for the organisation. A certification audit is performed by an accredited certification body, and only that body can issue the certificate. Aegentra does not issue certification.
Can you audit ISO 9001 and ISO 27001 together?
Yes, where independence and scope permit. Shared governance processes can be tested together while discipline-specific requirements remain separate.
What records do you need from us?
Read-only exports and documented information relevant to scope—commonly job records, complaints, nonconformities, calibration, suppliers, competence, management review and previous audits.
How long does an ISO 9001 internal audit take?
The timeline is confirmed after scoping and depends on sites, processes, applicable design requirements, record quality and process-owner availability.
Do you audit manufacturers?
It depends on the process. Technically complex or sector-specific production may require a suitably qualified sector auditor.
Do you deliver across Australia?
Aegentra has teams based in Melbourne and Sydney and delivers remotely across Australia, with onsite attendance by arrangement. New Zealand engagements may be available by arrangement.
Scope the audit
Find the problems before your assessor does.
A twenty-minute call is enough to establish scope, evidence needs and whether a single audit or multi-year programme fits. You receive a fixed fee in writing—or an honest recommendation to use a different specialist.