Clause 9.2: Internal audit
The organization has to run internal audits at planned intervals to find out whether the records system conforms to its own requirements and to the standard, and whether it is effective.
What clause 9.2 asks
The organization has to run internal audits at planned intervals to find out whether the records system conforms to its own requirements and to the standard, and whether it is effective. It has to plan and maintain an audit programme that considers the importance of the processes and the results of earlier audits, define the criteria and scope of each audit, choose auditors who are objective and impartial, report the results to the relevant management and keep documented information of the programme and the results.
Internal audit checks conformity and effectiveness, not only the existence of documents. The programme considers process importance and earlier results, and the auditors have to be objective.
Reading it in practice
An internal audit that checks documents against a checklist will miss the process failures that matter. Audit against the clause and the process criteria, sample the records, and follow one record from capture to disposal. The auditor should not be the owner of the process being audited, and the report should reach the manager who can act on it.
The third edition is at stage 50.00 and its clause text is not public. No public draft wording. The 2019 text splits the audit requirement into the duty to audit and the audit programme, in line with the harmonized structure.
Status: not shown in the public record. The 2019 requirement above is the one a certificate is issued against. No draft requirement is asserted.
Evidence for clause 9.2
Expect the programme, the criteria and scope of each audit, the reports and the management response, plus evidence that the auditor was independent of the process.
- Internal audit Audit programme covering the scope, criteria, dates and process importance
- Internal audit Audit reports with findings, evidence and the management response
- Internal audit Auditor competence and independence record for each audit
Where clause 9.2 commonly fails
- Audits that only check that documents exist
- The records manager auditing their own process
What to do about clause 9.2 before the revision
Write the programme for the next 12 months. Pick one process and audit it against a clause, not a checklist. Record the finding and the response. Do not let the owner audit their own process.
Read across from clause 9.2
Open the full index. The revision record shows the public stage record and the proven 2011 to 2019 changes.
Source for clause 9.2: ISO 30301:2019, ISO 30301:2019, Clause 9.2, retrieved 22 October 2026. The requirement, evidence and gaps are written from our clause record; the draft status rests on the ISO/PRF 30301 page 89772. Every source.