Internal audit and management review
Audit tests whether controls actually worked, corrective action fixes what did not, and management review decides what changes. This cluster covers the three stages that turn a documented system into a working one.
Start here
The product views live on internal audit, corrective actions and management review.
Running the audit programme
Coverage, frequency, independence and scheduling.
Sampling, walkthroughs and proportionate evidence.
How the three stages feed each other.
Collect once, reuse across standards and audits.
Findings and corrective action
Management review and reporting
Deciding how to run it
Where spreadsheets hold up, and where traceability breaks.
One register across standards, or one system per standard.
What each approach leaves behind after certification.
Scope, configuration effort and who actually operates it.
The other resource clusters
Running ISO 9001, 20000-1, 27001 and 42001 as one system.
Security certification, questionnaires and trust evidence.
AI governance, impact assessment and oversight.
Service commitments, change and incident control.
Running several client management systems from one workspace.
Answers buyers, procurement and auditors want
How often should internal audits run?+
The standards require a planned programme covering the whole management system over a defined period, with frequency based on the importance and past performance of each area. In practice most small organisations audit in themed slices through the year rather than in one annual push.
Can we audit ourselves?+
Yes, provided the auditor is objective and does not audit their own work. Small teams usually swap areas between colleagues or bring in an external auditor for the parts nobody is independent of.
What makes a management review acceptable to an auditor?+
Evidence that the required inputs were considered — audit results, nonconformities, performance, risks, feedback and improvement opportunities — and that decisions with owners came out of it. A slide pack with no decisions rarely survives scrutiny.
See how your existing risks, controls and evidence could become one integrated management system
Bring what you already have — a part-finished risk register, a folder of policies, last year's audit findings — and see it mapped across the standards you need.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.