ISO 9001:2026 Internal Audit Guide

The internal audit that carries you through a transition assessment is not your normal annual audit with a new cover sheet. It has a different question to answer: not "does the system work" but "is the system correctly expressed against the new edition, and can we show it". In the transition year most businesses need two audits — one against the edition their certificate currently names, and one against the edition they are moving to — and the second one is short, targeted and worth doing well ahead of the certification body's visit. This guide covers what to audit, in what order, and what your auditor will look for.

Why the transition year needs two audits

Your certificate names an edition. Until the transition assessment is complete, that is the edition your certification body audits you against at surveillance, and your internal audit programme has to keep covering it. Meanwhile the transition assessment is against the new edition. Those are two different scopes.

The practical consequence is a programme that looks like this:

Audit	Against	Purpose	Typical effort
Normal programme audits	The edition on your certificate	Maintain the existing certificate; feed management review	Your usual allocation
Transition readiness audit	The new edition	Confirm the mapping is complete and evidenced	Half a day to a day

The second one is not a full system audit. You are not re-auditing whether purchasing works. You are auditing whether the changes have landed.

What "the changes" actually means

Three categories, and they need different audit approaches.

1. Requirements that moved. Same requirement, different clause number. Nothing about your process changes; what changes is every internal reference that cites a clause. Audit this by document review, not by interview — pull each document that cites a clause number and check the reference.

2. Requirements that were reworded. The obligation is substantively similar but the wording is sharper, which usually means the evidence needs to be sharper too. Audit this by asking for the evidence and judging it against the new wording rather than the old habit.

3. Requirements that are new or expanded. These need evidence that may not exist yet. Audit these first, because they are the only category that can generate real work.

The free ISO 9001:2026 clause comparison tool maps which of your existing clauses fall into which category, and the clause-by-clause comparison covers the detail. Do that mapping before you plan the audit — auditing without the map means auditing everything.

Planning the transition readiness audit

Scope it to the delta

Write the audit scope as the changes, not as the system. A scope of "conformity of the QMS to the new edition" invites a three-day audit; a scope of "documented information and evidence for clauses affected by the revision" is half a day.

Pick the auditor carefully

Whoever does this needs to have actually read the new edition. In a small business that is usually the person who did the clause mapping — which creates an independence problem, because they are now auditing their own work.

Two ways round it: have someone else audit the mapping (independence preserved, less expertise), or bring in an external internal auditor for this one audit (expertise and independence, at a cost). The independence requirement is not optional — auditing your own work is one of the more reliable ways to attract a finding. Our ISO 9001 internal audit checklist covers the wider independence question.

Sequence: documents, then evidence, then people

1. Document review. Every document citing a clause number, checked against the new numbering. Fastest part, and it is where most of the errors are.
2. Evidence sampling. For each new or expanded requirement, ask for the record. If there is no record, that is your finding and you have time to fix it.
3. Interviews. Only where a requirement genuinely changed what someone does. Most transitions change documentation, not behaviour — interviewing widely wastes everyone's time.

Record it properly

The transition readiness audit is evidence in its own right. Your certification body auditor will want to see that the transition was planned and checked, not improvised. A dated audit report with findings and corrective actions is the artefact that demonstrates it.

Raise findings as formal records rather than as notes — the non conformance report template covers containment, root cause and closure evidence.

What the certification body will check at the transition assessment

UKAS's ISO 9001:2026 technical bulletin sets out the accreditation side of this transition, and one line in it is worth carrying into your own planning: "Until UKAS has made an accreditation decision to transition, certification issued against ISO 9001:2026 must not be represented as accredited certification."

The sequence matters: your body's accreditation has to land before your transition assessment produces an accredited certificate. UKAS transition decisions commence 1 January 2027 and are all to be completed by 30 September 2027, and your own deadline — the date by which all certificates must reference the 2026 edition — is 30 September 2029. That leaves plenty of room, provided you do not leave the internal audit until the last surveillance visit before it.

On the day, expect the assessor to want:

• The clause mapping, as a document
• Updated documented information with correct references
• Evidence against the new or expanded requirements
• Your internal audit report against the new edition
• A management review that discussed the transition
• Records showing anyone whose work changed was briefed

That list is short and every item on it is producible in advance. The businesses that struggle at transition assessments are the ones that did the documentation and skipped the evidence.

Fitting it into the annual programme

Your audit programme is a planned thing, and adding a transition audit to it mid-year is itself auditable — your audit programme is expected to take account of changes affecting the organisation, and an edition change is exactly that.

Practically: amend the programme document, note the reason, and schedule the transition readiness audit at least one full surveillance cycle before your transition assessment so there is time to close findings. The ISO 9001 audit schedule template covers how to structure the programme, and the free XLSX audit schedule template gives you a document to amend.

Management review is where the two threads join. The transition should appear as an agenda item with the readiness audit results attached — see the management review guide for the required inputs.

Practical takeaway checklist

1. Complete the clause mapping before planning the audit
2. Sort the changes into moved, reworded, and new-or-expanded
3. Scope the audit to the delta, not the whole system
4. Audit the new-or-expanded requirements first — only they can generate real work
5. Preserve auditor independence, even if it costs an external day
6. Review documents first, sample evidence second, interview last and narrowly
7. Raise findings as formal nonconformity records, not notes
8. Amend the audit programme document and note why
9. Schedule the readiness audit with time to close findings before the transition assessment
10. Put the transition and the readiness audit results on the management review agenda

If you have not started the wider transition yet, the ISO 9001:2026 transition plan covers the first 90 days, and the free audit readiness checker flags what is still outstanding before a certification body visit.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. Transition dates are quoted from UKAS's ISO 9001:2026 technical bulletin and Global ACI-TECH-3-TR 2029-09-30 (M), both published 16 September 2026. The text of ISO 9001:2026 itself is a purchased standard and is not reproduced here. Verify audit and transition requirements with your UKAS-accredited certification body.