AS9100 internal audit: build assurance around risk and evidence.
An internal audit programme should give management confidence in the effectiveness of the QMS. It should not become an annual diary exercise where every process receives the same time regardless of risk or performance.
Plan the audit programme around risk.
Use previous findings, customer issues, process performance, change, new work, supplier problems and management concerns to determine where audit attention is most valuable. Stable, well-controlled processes may need less depth than a process undergoing significant change or repeated failure.
Do a Stage 1 control review before interviewing people.
Understand what the process says should happen: responsibilities, inputs, outputs, criteria, records, interfaces and measures. This gives the auditor a hypothesis to test rather than a generic question list.
Stage 2 should test execution and effectiveness.
Interview the people doing the work, sample current records and follow transactions end-to-end. A good audit trail can cross several functions. For example, a customer requirement can be followed through contract review, planning, purchasing, production, inspection and release.
Write findings around evidence and risk.
A finding should make the control failure understandable. State what was expected, what objective evidence was sampled, what was observed and why the issue matters. Avoid turning every observation into a paperwork action when the real problem is implementation or effectiveness.
Close the loop.
Audit value is lost if actions remain open or effectiveness is never checked. Track ownership, target dates, evidence of completion and whether the corrective response actually prevented recurrence or improved control.
Related tools and support
Need practical Quality support?
RG Quality Management provides remote-first Quality Management, QMS, audit, supplier Quality and corrective-action support for engineering and manufacturing businesses.