Picture a quality director who oversees three plants in one manufacturing group. One plant molds housings for infusion pumps under ISO 13485. A second stamps brackets for an automotive Tier 1 supplier under IATF 16949. The third machines flight-critical fittings under AS9100. Each plant runs its own internal audit schedule, built years ago from a clause checklist, and each schedule works through the same processes in the same order every year.

Then a customer corrective action request arrives from the automotive side. The root cause traces to a process change that no auditor examined, because a spreadsheet rated that process “low risk” and nobody revisited the rating. The same change also touched a shared supplier that feeds the medical and aerospace plants. Three programs, three calendars, and not one audit connected the dots.

This scenario is illustrative, but anyone who has managed audits across more than one framework will recognize the pattern. Internal audit is the one QMS activity that every major standard demands. It is also the one most often run as a calendar ritual instead of a risk instrument. A program designed to satisfy an external auditor’s checklist tends to find what the checklist already predicted.

This article explains how to build a single, risk-based internal audit program that serves ISO 13485, AS9100, IATF 16949, ISO 22000, and GMP expectations together. It covers what each framework requires, how to score risk, how to keep auditors competent and independent, and how findings should flow into CAPA and management review. The goal is one program that regulators, certification bodies, and your own leadership can trust.

What Every Framework Expects From an Internal Audit Program

The Common Core

The frameworks differ in vocabulary but agree on the structure of an audit program. ISO 9001:2015, clause 9.2, sets the pattern that AS9100D, IATF 16949, and ISO 22000:2018 inherit through their shared management system structure. The organization must plan, establish, implement, and maintain an audit program that defines frequency, methods, responsibilities, planning requirements, and reporting. The program must weigh the importance of the processes concerned, changes affecting the organization, and the results of previous audits.

Each audit then needs defined criteria and a defined scope. Auditors must be selected so the audit stays objective and impartial. Results go to the relevant management, and the organization takes corrective action without undue delay. It also retains documented information as evidence of both the program and its results.

ISO 13485:2016 uses a different clause structure, but clause 8.2.4 asks for the same things. The program considers the status and importance of the processes and areas being audited, along with the results of previous audits. Auditors do not audit their own work. Management responsible for the audited area takes action without undue delay, and follow-up includes verifying that the action actually worked.

These requirements share one design principle. Audit effort should follow risk, and the records should prove that it did.

ISO 19011 as the Shared Playbook

ISO 19011:2018, the guideline for auditing management systems, supplies a method that every framework can borrow. Its principles include integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and, since the 2018 revision, a risk-based approach. It also covers how to manage an audit program, how to conduct individual audits, and how to evaluate auditor competence.

ISO 19011 is guidance rather than a requirement, so no certificate depends on it. Certification bodies and customer auditors know it well, though. A program built on its logic translates cleanly from one audit context to the next.

Regulatory Deep-Dives: What Changes by Vertical

A shared program does not mean identical audits. Each vertical adds expectations that shape which processes you audit, how deeply, and how often. The sections below name the differences that matter most when you design the schedule.

Medical Devices: ISO 13485 and the QMSR

The FDA’s Quality Management System Regulation took effect on February 2, 2026. It incorporates ISO 13485:2016 by reference and replaces the legacy Quality System Regulation. Under the old rule, quality audits had their own section in 21 CFR Part 820, and FDA policy kept internal audit reports out of routine inspections. The QMSR drops that carve-out, so an investigator can now ask to read your audit reports and management review records.

Quality leaders should therefore write audit reports on the assumption that a regulator will read them. A finding that states the requirement, the objective evidence, and the gap in plain language holds up under that scrutiny. A vague finding does not.

Aerospace: AS9100D

AS9100D builds on the ISO 9001:2015 structure, so clause 9.2 carries the same program requirements. The aerospace additions sit elsewhere in the standard: operational risk management, configuration management, product safety, and prevention of counterfeit parts, which appear in clauses 8.1.1 through 8.1.4. Those topics belong at the high-frequency end of your schedule. A lapse in any of them can affect flight safety, and primes and certification bodies pay close attention.

Supply chain flow-down deserves the same weight. An aerospace internal audit program that examines only the plant floor misses the place where counterfeit and nonconforming parts usually enter.

Automotive: IATF 16949

IATF 16949 is the most prescriptive of the five. It expects the audit program to rest on risk, internal and external performance trends, and the criticality of each process. It asks for audits of all quality management system processes within each three-year period, plus manufacturing process audits that reach every process and every shift. It also requires product audits that verify conformity of finished product to specified requirements, and it sets competence criteria for internal auditors in clause 7.2.3.

Because IATF 16949 already demands this level of structure, many groups use its audit model as the backbone for the whole program. That approach works, provided the other frameworks’ specific clauses map into the same schedule.

Food and Beverage: ISO 22000 and FSMA

ISO 22000:2018 clause 9.2 follows the familiar pattern. The program must account for the importance of the processes concerned, changes to the system, and prior audit results. HACCP principles add verification as a formal step, and the FDA’s Preventive Controls for Human Food rule, 21 CFR Part 117, requires verification of implementation and effectiveness, including review of records. The rule also requires reanalysis of the food safety plan at least once every three years.

Food safety audits therefore need to test whether monitoring records match what operators actually do at the line. A clean logbook proves nothing if the critical limit was never checked in practice.

Pharmaceuticals and Biotechnology: GMP

The U.S. current good manufacturing practice regulations for finished pharmaceuticals, 21 CFR Parts 210 and 211, assign broad responsibility to the quality control unit. They do not contain a dedicated self-inspection clause comparable to ISO 9001’s clause 9.2. Expectations come from other sources. ICH Q7 calls for regular internal audits of active pharmaceutical ingredient manufacturers against an approved schedule. The EU GMP Guide devotes Chapter 9 to self-inspection. ICH Q9 lists the frequency and scope of internal and external audits as an application of quality risk management.

Inspectors in this sector judge whether the program is real. They read the schedule, the reports, and the follow-up, and they compare them with what they see on the floor.

Why Calendar-Driven Audit Programs Fail

A calendar program asks which clauses the team has covered this year. A risk-based program asks where the system could fail without anyone noticing. The two questions produce different schedules, and the second one catches problems earlier.

Most audit programs that disappoint share a handful of failure modes:

• Clause coverage mistaken for risk coverage. Auditing every clause once a year feels thorough, yet it gives a stable, low-risk process the same attention as a recently changed, high-consequence one.
• Static risk ratings. A rating assigned at program launch and never updated drifts away from reality as products, suppliers, and equipment change.
• Auditing the procedure instead of the work. Auditors who read the SOP and confirm the SOP exists never test whether operators follow it.
• Quality auditing quality. When the quality department audits itself, independence breaks down, and nobody challenges the processes the auditors themselves own.
• Findings without a path. A finding that never reaches a CAPA, a trend report, or a management review simply documents a problem that stays open.
• One program per certificate. Separate programs for each standard duplicate effort, burden shared processes with repeat audits, and hide patterns that cross sites and standards.
• Silent scope gaps. Night shifts, contract workers, remote sites, and outsourced processes often fall outside the schedule without anyone deciding they should.

Each of these failure modes traces back to the same cause. The program was designed around the standard’s text instead of the organization’s actual exposure.

Building the Risk Model

Choose Your Inputs

A workable risk model draws on evidence the organization already collects. Five input categories cover most of what an auditor needs to know:

• Process criticality. How directly does the process affect patient safety, food safety, flight safety, regulatory compliance, or contractual customer requirements?
• Performance trends. What do complaints, scrap, nonconformances, customer corrective action requests, and supplier performance data show?
• Change. Has the process seen new equipment, new software, new suppliers, staffing turnover, a facility move, or a regulatory shift since the last audit?
• Audit history. Did the last audit produce repeat findings, overdue CAPAs, or corrective actions that failed their effectiveness checks?
• External exposure. Have regulators, certification bodies, or customers raised concerns about this process recently?

Score and Tier the Processes

Keep the scoring simple enough that the team will actually update it. One workable approach rates each process from one to five on criticality, trend, change, and audit history, then combines the scores into three tiers. High-tier processes get audited at least twice a year or on a rolling quarterly basis. Medium-tier processes get an annual audit. Low-tier processes get audited at least once per certification cycle, never beyond the ceiling any framework sets. IATF 16949’s three-year limit on QMS process coverage is one example.

Those tier frequencies are a starting point, not a standard. Your risk model should justify its own numbers and document why. An auditor reading the program wants to see the reasoning, not a copy of someone else’s template.

Add Triggered Audits

A fixed schedule cannot anticipate every event. Define in advance which events trigger an unscheduled audit: a significant customer complaint, a repeat finding, a major process or supplier change, a failed regulatory inspection observation, or a product recall. The trigger list turns the audit program from a plan into a response mechanism.

Map Requirements Across Standards

The most practical step in building a combined program is a process-by-requirement matrix. List each process in a row. Then list the applicable clause from every standard in the columns. A single audit of a process can then test all of them at once.

Supplier control shows how this works. ISO 9001, AS9100D, and IATF 16949 address externally provided processes, products, and services in clause 8.4. ISO 13485 covers purchasing in clause 7.4, and ISO 22000 addresses externally provided processes in clause 7.1.6. One well-planned supplier-control audit can gather evidence against all five. The same logic applies to corrective action, which appears in ISO 9001 and ISO 22000 at clause 10.2 and in ISO 13485 at clause 8.5.2. The audit of the audit program itself maps to clause 9.2 in the ISO 9001 family and clause 8.2.4 in ISO 13485.

Done well, the matrix cuts the number of audits without reducing coverage. Done poorly, it hides gaps behind a single checkmark. Auditors need to know which clauses each audit covers, and the report must show evidence for every one.

Auditor Competence and Independence

Independence

ISO 9001 requires objectivity and impartiality in auditor selection. ISO 13485 states directly that auditors may not audit their own work. Small quality teams struggle with this, because the people who know the processes best are often the people who run them.

Several practical arrangements solve the problem. Trained auditors from other departments can audit processes they do not own. Sister sites can swap auditors. An external consultant can audit the quality department itself. Whatever the arrangement, the program should document who audited what and show that no auditor reviewed their own area.

Competence

IATF 16949 sets explicit competence criteria for internal auditors, and ISO 19011 devotes a full clause to evaluating auditor competence. The same expectations are good practice in every vertical. An auditor should know the applicable standard, understand the process under audit, and use sound audit technique: sampling, interviewing, tracing, and evidence evaluation. In regulated settings, auditors also need to know the product-specific requirements, such as GMP expectations for batch records or HACCP critical limits.

Evaluate each auditor after each audit and record the result. Link audit assignments to training records so the program never assigns someone whose qualification has lapsed. Integrated platforms make this link easier, because the learning record and the audit assignment live in one system. As the eLeaP guide to internal quality audits explains, audit workflows work best when they connect quality events, training records, and compliance data.

From Findings to CAPA to Management Review

Classify and Escalate

An audit produces value only when its findings change something. Start by classifying each finding by severity. Define what counts as a major nonconformity, a minor nonconformity, and an observation, and define the response each one requires. A major finding should open a CAPA. A minor finding may need a correction and a documented root cause. An observation may feed the risk model without triggering a formal record.

Verify Effectiveness

ISO 13485 requires follow-up that verifies the action taken. The same discipline belongs in every vertical. A corrective action that closes on paper but fails in practice returns as a repeat finding, and repeat findings carry weight with every external auditor. Set an effectiveness check date when you open the CAPA, and base it on data, not on the owner’s confirmation.

Feed Management Review

Management review is where the audit program earns its place at the leadership table. ISO 9001 clause 9.3.2 lists audit results among the required management review inputs, and ISO 13485 clause 5.6.2 lists audits among its inputs as well. In pharmaceutical manufacturing, ICH Q10 frames management review of the pharmaceutical quality system as the place where audit outcomes meet leadership decisions.

Present trends, not just totals. Show findings by process, repeat findings, overdue actions, and the status of triggered audits. Ask leadership to make resource decisions based on that evidence.

Close the Loop

The audit program should also feed itself. This year’s findings should adjust next year’s risk scores. A process that produced three findings moves up a tier. A process with three clean audits and stable performance data may move down. Without that feedback, the risk model becomes the same static rating that undermined the calendar program.

Running One Program in One System

Spreadsheets can hold a risk model for a single site, but they struggle with multi-framework programs. Schedules diverge, findings live in separate files, and nobody can see a repeat finding across sites without a manual search. Software built for audit management addresses those gaps by centralizing schedules, checklists, findings, and corrective action links. The audit software overview on the eLeaP quality site outlines the core capabilities to look for.

For manufacturers, the relevant functions include programme planning with risk-weighted scheduling, audit plans and checklists, severity-classified findings, and corrective action linkage for every finding that requires follow-up. eLeaP’s ISO 9001 software page describes how its audit management module supports the full clause 9.2 cycle, with each finding feeding a CAPA record. When a finding exposes a training gap, the platform can generate the retraining assignment and hold the related record open until completion is confirmed.

Connection matters most at the management review stage. In a digital QMS, review inputs come directly from live quality data instead of manually assembled slides. Leadership then sees the same trend lines the quality team sees.

Software does not fix a weak risk model. It does make a sound one far easier to run, update, and defend.

Measuring Whether the Program Works

A program that never measures itself cannot improve. Track a small set of indicators and review them in management review:

• Schedule adherence. What percentage of planned audits finished on time, and what percentage of high-tier processes received their planned frequency?
• Finding trends by process. Are findings concentrated in a few processes? A falling count may signal real improvement or weaker auditing, so read it alongside the other measures.
• Repeat finding rate. How many findings reappear after a corrective action is closed?
• CAPA timeliness and effectiveness. How long does each finding take to close, and how many closed actions pass their effectiveness check?
• External findings the internal program missed. Did a certification body, customer, or regulator find a nonconformity that your own audits should have caught?

The last measure is the most revealing. Every external finding that internal audits missed points to a blind spot in the risk model, and each one is a chance to correct it before the next visit.

The Underlying Test

Every framework in this article asks, in its own words, whether the organization finds its own problems before someone else does. The underlying test is simple. When an external auditor, an FDA investigator, or a customer discovers a problem in your system, ask two questions. Should your internal audits have found it first? Did your risk model point auditors toward it?

If the answer to the first question is yes and the answer to the second is no, the program is following a calendar instead of the risk. A single program, mapped across every standard you hold, scored on evidence, staffed by independent and competent auditors, and connected to CAPA and management review, passes that test. Build it once, keep it current, and let each framework’s requirements become a lens on the same underlying system.