Essential Questions to Enhance Your Internal Audit Process | My ISO Consultants

Effective internal audits depend on questions that reveal how a process actually works, not simply whether a procedure exists. Good audit questions encourage people to explain their work, show objective evidence, describe how they know a process is effective, and identify risks or problems that may not be obvious from documents alone.

The following questions give internal auditors a practical starting point for evaluating process understanding, controls, results, nonconformities, change, risk, and improvement opportunities. They can be adapted to ISO 9001, AS9100, ISO 13485, ISO 14001, ISO 45001, and other management system audits as appropriate.

2026 Internal Auditing Update

ISO 19011:2026, published in May 2026, is the current international guidance for auditing management systems. It addresses audit principles, audit program management, conducting audits, and auditor competence, with increased attention to risk, technology, digitization, and virtual auditing environments. The questions below are not prescribed ISO 19011 questions or a required checklist. They are practical prompts that help auditors gather useful evidence and understand how a management system operates in practice.

1. Can You Explain Your Process to Me? What Exactly Do You Do?

This is one of the most useful ways to begin an audit discussion because it lets the auditee describe the process in their own words. The answer can help the auditor understand the sequence of activities, responsibilities, inputs, outputs, handoffs, and controls before testing whether the process is being followed effectively.

Follow the explanation with evidence-based questions such as “Can you show me?” or “What happens next?” The objective is not to test whether the employee memorized a procedure. It is to understand how the work is actually performed and whether practice aligns with applicable requirements.

2. How Do You Know What You Are Supposed to Do Each Day?

This question helps reveal how work is assigned, prioritized, communicated, and controlled. Depending on the process, the answer may lead to schedules, work orders, production travelers, customer requirements, procedures, software systems, management direction, or other forms of documented and operational control.

An auditor should listen for whether responsibilities are clear and whether employees are working from current, approved information. If two people performing the same process describe completely different methods, that may be worth investigating further.

3. How Do You Know the Results of Your Work Are Correct or Accurate?

This question shifts the conversation from performing an activity to controlling its result. It can uncover inspections, verification steps, acceptance criteria, monitoring, testing, approvals, performance indicators, peer reviews, automated controls, or other methods used to determine whether the output is acceptable.

The auditor can then sample records or results to confirm that the stated controls are actually being used and that they provide meaningful evidence of process effectiveness.

4. What Do You Do When Something Goes Wrong?

Problems and nonconformities often reveal more about a management system than routine work. Ask what happens when a product, service, record, process result, or other output does not meet requirements.

The answer can show whether the organization knows how to contain or control the problem, communicate it to the appropriate people, evaluate its significance, document it when required, and take corrective action when appropriate. Follow-up sampling can help determine whether the stated response matches actual practice.

5. What Has Changed in This Process Since the Last Audit?

Processes rarely remain completely static. Staffing, equipment, software, suppliers, customer requirements, regulations, production volume, facilities, and organizational priorities can all change how a process operates.

Asking about change helps the auditor focus attention where new risks may have been introduced. It can also reveal whether changes were planned, communicated, implemented, and evaluated effectively rather than simply absorbed informally into day-to-day operations.

6. What Could Prevent This Process From Achieving Its Intended Result?

This question introduces risk-based thinking without turning the audit into a theoretical exercise. Employees who work in a process every day often know where delays, errors, resource limitations, supplier problems, equipment failures, information gaps, or other vulnerabilities can occur.

The auditor can compare those practical risks with the controls the organization has established and determine whether important risks are being recognized and managed appropriately.

7. If You Could Improve One Thing About This Process, What Would It Be?

This question encourages open dialogue and can surface improvement opportunities that would never appear on a traditional checklist. Employees may identify unnecessary steps, recurring bottlenecks, outdated tools, communication problems, training needs, or other issues that management has not yet recognized.

Not every suggestion represents a nonconformity or requires corrective action. However, the response can give the auditor valuable context and help the organization distinguish compliance issues from opportunities to improve efficiency or effectiveness.

How to Use These Internal Audit Questions

These questions are intended as conversation starters, not a fixed checklist. Start with the open-ended question, listen to the response, and then ask the auditee to show objective evidence that supports the answer. Follow-up questions should be based on what you learn rather than on a predetermined script.

Organizations that want an independent evaluation of their audit program or management system can use professional internal auditing services to identify meaningful gaps, strengthen audit coverage, and obtain an objective assessment of how processes are functioning.

• 

  My ISO Consultants