Insights · 5 min read
A programme shaped by its inputs leaves a trail
There is a requirement about internal audit programmes that we can show you in full, because it is the one we are audited against.
Published by CAS — Conformity Assessment Services · 4 September 2026
There is a requirement about internal audit programmes that we can show you in full, because it is the one we are audited against.
ISO/IEC 17021-1 §10.2.6.2, on the certification body's own internal audits:
An audit programme shall be planned, taking into consideration the importance of the processes and areas to be audited, as well as the results of previous audits.
Read what that sentence does. It does not say plan a programme. It says plan a programme taking into consideration two named things — and one of them is what happened last time.
Naming an input is a constraint, not a licence
A requirement that says "plan an audit programme" is satisfied by any programme. A requirement that names what the planning shall take into consideration is satisfied only by a programme in which those considerations are visible.
That is the difference between a rule about an activity and a rule about a decision. §10.2.6.2 is the second kind.
And it has a consequence that is easy to miss. If one of the named inputs is the results of previous audits, then the programme is downstream of its own history. A programme that came out identical two years running has either found that its history changed nothing, or has not consulted it.
Both are possible. Only one of them is a conclusion.
The same construction, written a second time
§9.1.3.2 governs the audit programme a certification body builds for a client. It sets out the three-year cycle, and then:
The determination of the audit programme and any subsequent adjustments shall consider the size of the client, the scope and complexity of its management system, products and processes as well as demonstrated level of management system effectiveness and the results of any previous audits.
The same shape appears twice, in two different clauses, about two different programmes. Named inputs. Previous results among them.
And this one adds a word the first does not: adjustments. The clause does not describe a programme determined once. It describes a determination and the changes that follow it, and it binds both to the same considerations.
A requirement written that way anticipates that the programme will move. That is the point of naming inputs that can change.
What this has to do with ISO 9001 clause 9.2
Internal audit sits at clause 9.2 of ISO 9001, and the requirement there is built the same way: an audit programme, and considerations the planning is required to take into account.
That sentence describes the structure of clause 9.2 in our own words. We are not quoting it, and we have not reproduced its wording anywhere on this page. The two clauses above are quoted because they are the ones this argument rests on.
The reason the parallel is worth drawing is that the argument does not depend on it. The construction — name the inputs, and the output has to be able to move — is visible in text anyone can open, twice, without going near ISO 9001 at all.
Objectivity is a separate requirement from competence
§10.2.6.4 sets out what the certification body shall ensure about its own internal audits. Among them, at b):
auditors do not audit their own work
It sits beside a requirement at a) that internal audits are conducted by competent personnel knowledgeable in certification, auditing and the requirements of the standard.
Two conditions, and they pull against each other in any organisation small enough to have one expert per process. The person who knows a process well enough to audit it competently is often the person who runs it. The clause does not resolve that tension; it declines to trade either condition away.
ISO/IEC 17021-1 defines impartiality at §3.2 as the presence of objectivity, with a note that objectivity means conflicts of interest do not exist, or are resolved so as not to adversely influence subsequent activities. Not the absence of a relationship — the presence of something.
What the clause does not settle
§10.2.6.3 requires a certification body's own internal audits to be performed at least once every 12 months, and permits that frequency to be reduced where the body can demonstrate its management system continues to be effectively implemented and has proven stability.
Note the subject of that sentence carefully: it is the certification body's internal audits, not a certified client's. It is quoted here because it shows the shape of a frequency requirement written properly — an interval, and a stated condition under which it moves. Even the number is downstream of evidence.
Where an internal audit programme is read by someone else
Under §9.3.1.2.2 g), one objective of a Stage 1 audit is to evaluate whether internal audits and management reviews are being planned and performed, and whether the level of implementation substantiates readiness for Stage 2.
So an internal audit programme is not only an internal document. It is evidence, read by a certification body, about how a management system decides where to look.
Which brings the two halves together. A programme that names its inputs and moves in response to them is telling a reader something. A programme that is last year's with the dates advanced is also telling a reader something, and the clause is what makes the difference legible.
This is generic information about the requirement, not advice on any particular management system.
A question for the comments: in your sector, does an internal audit programme get planned around which processes carry the most weight, or around the calendar?
CAS — An EGAC accredited MS certification body No. 012418.
Read the full note: cas.com.eg/insights/iso-9001-clause-9-2