The internal audit is where a client decides whether you actually know the standard

A lot of consulting work starts the same way. The client has a certification audit coming, they want someone to run the internal audit first, and they want it done properly rather than as a paper exercise.

That job is where your credibility with that client gets set. They do not judge the report by its length. They judge it by whether your findings survive the certification body a month later, and whether the ones you raised were things they could actually act on. Raise a finding the external auditor then waves away and you look expensive. Miss one the auditor picks up and you look worse.

The things that separate a useful internal audit from a tour of the office are mostly unglamorous. Planning around where the process risk actually sits instead of walking the clauses in order. Asking for the evidence in the opening meeting rather than at the end when everyone is tired. Writing a nonconformity that states the requirement, the evidence and the gap in three lines so nobody spends a week arguing about what it means. Following corrective actions through to effectiveness rather than to a closed date in a spreadsheet.

We put the whole process into a step by step guide, from planning and the opening meeting through to writing findings and closing out corrective actions. It is written for the person in the room doing the audit rather than for a management team reading a summary.

https://auditworkshop.com/blog/iso-9001-internal-audit-a-step-by-step-guide