A company in Dammam once told us they failed their Stage 2 certification audit for a reason that had nothing to do with their actual quality management. Their internal audit records showed the same three employees signing off on every audit for two years straight, and none of them worked outside the department they were reviewing. The auditor flagged it in the first hour. Three weeks of preparation, gone, because nobody checked whether the internal audit itself would hold up.
That is the part of ISO certification almost nobody explains properly: the internal audit is not a formality you complete because a checklist tells you to. It is the single biggest predictor of whether your certification audit goes smoothly or turns into a multi-week delay.
What an Internal Audit Actually Is, and Why It Comes Before Certification
Contents
- 1 What an Internal Audit Actually Is, and Why It Comes Before Certification
- 2 What Auditors Actually Check
- 3 The Failures We See Most Often in Saudi Businesses
- 4 A Practical Internal Audit Checklist Before Your Certification Audit
- 5 What It Costs to Get This Wrong
- 6 Frequently Asked Questions
- 6.1 How often does an internal audit need to happen?
- 6.2 Can the same person who manages the quality system also audit it?
- 6.3 What happens if my internal audit finds a major problem right before certification?
- 6.4 Does a good internal audit program actually reduce certification audit findings?
- 6.5 Do I need formal internal auditor training, or can existing staff do this?
- 7 Getting Your Internal Audit Program Right
Every ISO management system standard, whether ISO 9001, ISO 45001, ISO 14001, or ISO 27001, requires an internal audit before the external certification body ever shows up. The logic is simple. Your organization is supposed to find and fix its own problems first. The certification auditor is there to verify that your system works, not to discover it for the first time. This applies just as much at recertification and surveillance audit stages as it does the first time around.
In practice, this means your internal audit needs to cover every clause of your management system across the certification cycle, not just the parts that are easy to check. It needs to be conducted by someone with no stake in the outcome, meaning a department head cannot audit their own department. And it needs to produce real findings, not a clean report that says everything is fine, because auditors have seen enough of those to be suspicious of them.
What Auditors Actually Check
Certification auditors do not review policies in isolation. They pull threads. A typical audit will ask for objective evidence: training records, corrective action logs, risk registers, management review minutes, supplier evaluation records, and audit trails showing that findings were tracked to closure, not just written down and forgotten.
One test experienced auditors use often catches organizations off guard. They ask two or three employees in the same role to explain the same procedure. If the answers are inconsistent, that is a red flag regardless of what the documentation says, because it means the system exists on paper more than it exists in practice.
Auditors also classify what they find into three categories, and understanding the difference matters for how you prepare.
A major nonconformity is the absence or complete breakdown of a required element, something like no internal audit having happened at all, or a risk assessment that was never updated after a significant operational change. This has to be resolved before certification can be granted.
A minor nonconformity is an isolated lapse. You have a process, but it was not followed once, or documentation exists but is incomplete. A corrective action plan is usually enough to keep things moving.
An observation, sometimes called an opportunity for improvement, is something that could be strengthened but is not a compliance failure. No action is required, though ignoring it repeatedly tends to turn it into a minor finding later.
The Failures We See Most Often in Saudi Businesses
A few patterns show up again and again across the companies we work with, regardless of sector.
Internal audits get rushed right before the certification date. This is the single most common issue. A business schedules its internal audit two weeks before the certification body arrives, treats it as a paperwork exercise, and misses the real value of catching problems early enough to actually fix them.
Root cause analysis stops at the symptom. An auditor finds a missing training record and the corrective action is “we trained the employee.” That fixes one instance. It does not explain why the training tracking system missed it, which means the same gap resurfaces at the next audit.
Management review becomes a status meeting instead of a decision-making one. Auditors specifically look for evidence that leadership used the review to make decisions, not just to confirm that metrics were within range. A meeting that walks through a checklist without genuine discussion is easy for an experienced auditor to spot.
Internal auditors are not actually independent. In smaller Saudi businesses, the person managing the quality system is often the same person auditing it. This is a structural problem, not a training problem, and it needs a different fix, usually cross-training staff from another department or bringing in outside audit support for a cycle.
The audit program does not cover the full system. ISO standards expect every clause and every process to be audited across the three-year certification cycle, not just the areas that are convenient or low-risk. Auditors will ask to see the audit program and compare it against what was actually completed. This gets more complex, not less, for businesses running an Integrated Management System across multiple standards, since the audit program then needs to cover every standard in scope, not just one.
A Practical Internal Audit Checklist Before Your Certification Audit
Run through this roughly six to eight weeks before your certification audit date, not the week before.
- Confirm audit independence. No one is auditing their own work area, directly or indirectly.
- Check full-scope coverage. Every clause and process relevant to your standard has been audited within the current cycle, and you can show it.
- Pull evidence for every open finding. Corrective actions should show root cause analysis, not just a fix for the immediate symptom, along with evidence the fix actually worked.
- Review your last management review meeting minutes. Confirm every required input was discussed and that decisions, not just updates, were recorded.
- Spot-check employee understanding. Ask two or three people in the same role to explain the same procedure. Inconsistent answers mean your documentation and your practice have drifted apart.
- Verify training and competence records are current, especially for any staff who joined or changed roles since your last audit.
- Check that your risk assessment reflects your current operations, not the version from your original certification.
What It Costs to Get This Wrong
The financial cost of a poorly run internal audit is not the audit itself. It is what happens after a failed certification audit: a major nonconformity typically means a follow-up audit visit, additional certification body fees, and a delay of weeks to months depending on how quickly you can close the gap. For businesses relying on ISO 9001 status for Etimad tender submissions or Aramco and SABIC vendor renewals in the Eastern Province, that delay can mean missing a bid window entirely, which costs far more than the audit fee ever would.
| Scenario | Typical Time Cost | Typical Financial Impact |
|---|---|---|
| Well-prepared internal audit, clean certification audit | No delay | Standard audit fee only |
| Minor nonconformities found, corrective action accepted | 2 to 4 weeks | Standard audit fee plus internal remediation time |
| Major nonconformity found | 4 to 12 weeks | Follow-up audit fee, plus any missed tender or vendor deadlines |
Frequently Asked Questions
How often does an internal audit need to happen?
At minimum once within each surveillance cycle, but most organizations run internal audits annually, and higher-risk operations often audit specific high-risk processes more frequently. The key requirement is that every clause and process gets covered across the full three-year certification cycle.
Can the same person who manages the quality system also audit it?
No. Auditor independence is a hard requirement. Whoever conducts the internal audit cannot audit their own area of responsibility, since the point is an objective check, not self-assessment.
What happens if my internal audit finds a major problem right before certification?
Fix it before the certification body arrives if at all possible. A major nonconformity found internally and resolved before the external audit is a sign of a functioning system. The same issue found by the external auditor becomes a certification-blocking finding with a follow-up visit required.
Does a good internal audit program actually reduce certification audit findings?
Yes, consistently. Organizations that treat internal audits as a genuine improvement tool rather than a formality show up to certification audits with fewer surprises, because they have already found and fixed the same issues an external auditor would flag.
Do I need formal internal auditor training, or can existing staff do this?
Existing staff can conduct internal audits if they understand the standard and audit principles, but many Saudi businesses find that structured internal auditor training closes real gaps, particularly around writing findings correctly and conducting root cause analysis instead of surface-level fixes.
Getting Your Internal Audit Program Right
An internal audit that actually works is not extra overhead bolted onto your management system. It is the mechanism that catches the same problems a certification auditor would catch, at a point where fixing them costs you weeks instead of a failed audit and a missed tender deadline.
If you are approaching your first certification audit under ISO 9001 or preparing your safety management system for ISO 45001, building a genuinely independent, full-scope internal audit program six to eight weeks out is the single highest-leverage thing you can do before the external auditor arrives. If your team needs structured support to get there, from internal auditor readiness to a full pre-certification gap analysis, reach out to our team and we will walk through where your system actually stands.
