Selecting and Developing Your Internal Audit Team with Clause 7

Why Your Internal Audit Team Is More Than a Compliance Checkbox

Most organisations approach their internal audit team the same way they approach fire extinguisher inspections. Someone has to do it, the standard requires it, so they assign a few names and move on. The result is an audit programme that ticks boxes but adds no real value.

Clause 7 of any ISO management system standard covers support requirements including competence, awareness, communication, and documented information. When it comes to building an internal audit team, Clause 7 is where the real work happens. It tells you what your auditors need to know, how they need to behave, and what evidence your organisation must keep to demonstrate that the people doing your audits are actually qualified to do them.

This article walks through what Clause 7 actually requires from your internal audit team, how to select the right people, how to develop them over time, and what a certification auditor will be looking for when they review your audit programme. Whether you are a Quality Manager building a team from scratch or a senior auditor looking to formalise what already exists, this is a practical guide grounded in real audit experience.

What Clause 7 Actually Requires for Internal Auditors

Clause 7.2 of ISO 9001, ISO 14001, ISO 45001, ISO 27001, and ISO 42001 all require the organisation to determine the competence needed for people doing work that affects the performance of the management system, take action to acquire that competence, and evaluate the effectiveness of those actions. Internal auditors fall squarely into this requirement.

The standard does not tell you what competence looks like for an internal auditor. That is a deliberate design choice. ISO leaves it to the organisation to define. But that flexibility cuts both ways. It means you cannot hide behind vague statements like relevant experience or attended a training session. You need to define what competence means for your auditors, demonstrate that they have it, and keep records to prove it.

The Three Things Clause 7.2 Asks You to Do

• Determine the necessary competence. What does an internal auditor in your organisation need to know and be able to do? This includes knowledge of the standard, understanding of your processes, and the skills to plan, conduct, and report an audit.
• Ensure that competence is achieved. Training, mentoring, supervised audits, and professional development all count. The method matters less than the outcome.
• Retain documented evidence. Training records, audit logs, qualifications, and competency assessments all serve as evidence. If you cannot show it, it did not happen.

Clause 7.3 adds an awareness requirement. Your auditors need to understand the organisation's policy, the objectives relevant to their work, and how their contribution matters. An internal auditor who does not understand what the organisation is trying to achieve with its management system is going to audit in a vacuum.

Selecting the Right People for Your Internal Audit Team

The first decision is who to put on the team. This is where many organisations make avoidable mistakes. They either assign the most available person, which usually means the least busy person who has no particular interest in auditing, or they assign the most senior person, who may be too close to the processes to audit them objectively.

Characteristics to Look For

Good internal auditors share certain characteristics that go beyond technical knowledge. When selecting team members, look for people who:

• Ask questions naturally rather than accepting explanations at face value
• Can listen without jumping to conclusions
• Are comfortable having difficult conversations without becoming confrontational
• Pay attention to detail without losing sight of the bigger picture
• Can write clearly and concisely
• Are respected by their colleagues, which helps when interviewing process owners

Technical knowledge of the standard matters, but it can be taught. The behavioural traits above are harder to develop and are better used as selection criteria. A process engineer who naturally questions assumptions and communicates well will often make a better internal auditor than someone who has memorised every clause but cannot hold a productive conversation on the shop floor.

The Independence Requirement

ISO 9001 Clause 9.2.2(b) is explicit: internal auditors shall not audit their own work. This is the objectivity requirement, and it has direct implications for how you structure your team. In a small organisation with five people, this can be genuinely challenging. In a larger organisation, the risk is the opposite: people are assigned to audit areas where they have close personal relationships, which creates a different kind of bias.

The practical solution is to plan your audit assignments before you finalise your team structure. Map your processes, identify who owns each process, and then work backwards to determine who can audit what without a conflict of interest. You may find that you need more team members than you initially thought, or that you need to use a rotational model where auditors move between areas over time. For more on how independence works in practice, this guide on auditor independence covers the common scenarios.

Cross Functional Representation

One of the most effective internal audit team structures is cross functional. Rather than having a single quality team member conduct all audits, you train representatives from different departments and rotate them through audit assignments in areas they do not own. This approach has several advantages.

• Auditors bring genuine process knowledge from their own area, which helps them ask better questions in related areas
• Auditees tend to be more open with peers than with dedicated compliance staff
• The organisation builds broader awareness of the management system across departments
• The audit programme becomes less dependent on one or two individuals

The trade off is coordination. Managing a cross functional team requires clear scheduling, consistent training, and a lead auditor or audit programme manager who keeps everything on track.

Defining Competence for Your Internal Auditors

This is the step most organisations skip. They send someone to a training course, file the certificate, and consider the job done. Clause 7.2 asks for more than that. It asks you to define what competence looks like for your auditors and to evaluate whether they have achieved it.

Building a Competence Framework

A simple competence framework for internal auditors might cover the following areas:

• Standard knowledge. The auditor understands the requirements of the relevant ISO standard and can identify what conformance looks like in practice.
• Process understanding. The auditor understands how the organisation's processes work and how they interact.
• Audit methodology. The auditor can plan an audit, develop useful questions, gather evidence, identify findings, and write a clear report.
• Interviewing skills. The auditor can conduct productive interviews with people at all levels of the organisation.
• Nonconformity writing. The auditor can write nonconformities that are specific, evidence based, and referenced to the correct clause.

For each area, you can define what basic competence looks like versus advanced competence. This gives you a basis for evaluating where each team member sits and what development they need. The internal auditor competence guide on the Audit Workshop blog goes deeper into what ISO actually expects and how to demonstrate it.

How to Evaluate Competence Effectively

A training certificate proves someone attended a course. It does not prove they can audit. Competence evaluation needs to go beyond certificates. Practical methods include:

• Supervised audits. New auditors conduct their first few audits under the observation of a more experienced auditor who can provide feedback on technique.
• Audit log review. Review the auditor's records over time. Are their findings specific and well evidenced? Are they finding the same types of issues repeatedly, which might suggest a bias? Are they missing obvious areas?
• Auditee feedback. Brief, informal feedback from people who have been audited can reveal whether the auditor is perceived as fair, thorough, and professional.
• Self assessment. Ask auditors to reflect on their own performance after each audit. This builds self awareness and supports continuous improvement.

Document the evaluation method and the outcomes. When a certification auditor reviews your Clause 7 records, they will want to see not just that training happened but that you assessed whether it worked.

Training Pathways for Internal Auditors

Once you have selected your team and defined what competence looks like, you need a training pathway that gets people there. The right pathway depends on where each person is starting from.

Foundation Level Training

For team members who are new to ISO management systems altogether, a Foundation course provides the conceptual grounding they need before they can audit effectively. Foundation training covers what the standard requires, why it exists, and how management systems work in practice. It is not auditor training, but it is a necessary precursor for people who have no prior exposure to the standard.

Internal Auditor Training

Internal Auditor training is the core qualification for anyone conducting internal audits. A good internal auditor course covers the audit process from planning through to reporting, interviewing techniques, evidence gathering, nonconformity writing, and how to apply the requirements of the standard in a real audit context. This is the minimum qualification you should require for anyone conducting audits on your behalf.

When selecting a course, look for one that is recognised by a reputable scheme such as Exemplar Global. Recognition means the course has been assessed against defined quality criteria, which gives you confidence that the training is substantive rather than superficial. Audit Workshop's internal auditor courses across ISO 9001, ISO 14001, ISO 45001, ISO 27001, and ISO 42001 are all Exemplar Global recognised and designed to build practical auditing skills, not just theoretical knowledge.

On the Job Development

Formal training gets people started. On the job development is what builds competence over time. Structure this deliberately:

• Pair new auditors with experienced ones for their first two or three audits
• Debrief after each audit to discuss what went well and what could improve
• Gradually increase the complexity of the areas assigned as confidence grows
• Rotate auditors through different process areas to broaden their experience

Keep records of each audit conducted. An audit log that captures the date, scope, standard audited, and role of the auditor is the documented evidence Clause 7.2 requires. It also supports auditor certification applications if team members decide to pursue formal credentials later. For guidance on what an audit log should contain, this article on keeping an audit log for certification is a useful reference.

Awareness and Communication Under Clause 7

Clause 7.3 requires that people doing work under the organisation's control are aware of the management system policy, the relevant objectives, their contribution to the effectiveness of the system, and the implications of not conforming to requirements. For internal auditors, this awareness requirement has a specific dimension.

An auditor who does not understand the organisation's quality policy, environmental objectives, or OH&S commitments cannot audit against them meaningfully. Before each audit cycle, brief your audit team on any changes to the management system, updated objectives, new risks or opportunities that have been identified, and any significant changes to processes or the operating context. This keeps the audit programme connected to the actual state of the management system rather than running as a parallel compliance exercise.

Clause 7.4 covers communication. Your audit programme should have a clear communication structure: who receives audit plans, who gets the audit report, how findings are communicated to process owners, and how the results feed into management review. Without a defined communication process, audit findings can get lost between the report being written and the action being taken. For a detailed look at how communication requirements work in practice, the ISO 9001 Clause 7.4 communication guide covers the key points.

Documented Information: What Records You Need to Keep

Clause 7.5 requires the organisation to maintain documented information to the extent necessary to support the operation of its processes and to retain documented information as evidence of results. For your internal audit team, this translates into a specific set of records.

Records to Maintain

• Competence records. Training certificates, qualifications, and records of supervised audits for each team member.
• Competency assessments. Evidence that you evaluated whether training was effective, not just that it occurred.
• Audit logs. A record of audits conducted by each auditor, including date, scope, and role.
• Audit plans and checklists. Evidence that audits were planned appropriately.
• Audit reports. The outputs of each audit, including findings, nonconformities, and observations.
• Corrective action records. Evidence that nonconformities raised by internal auditors were addressed.

Keep these records in a format that is accessible and retrievable. A certification auditor will ask to see them, and the inability to locate records quickly creates a poor impression even if the records exist somewhere.

Common Gaps That Certification Auditors Find

After conducting hundreds of external audits, certain patterns emerge in how organisations manage their internal audit teams. The most common gaps are:

• No defined competence criteria. The organisation has trained its auditors but cannot articulate what competence looks like or how it was evaluated.
• Training certificates as the only evidence. A certificate proves attendance, not capability. Without evaluation records, the competence claim is weak.
• Auditors auditing their own areas. This is a straightforward nonconformity against the objectivity requirement and is surprisingly common.
• No audit log. Team members have conducted audits but there is no consolidated record of their experience.
• Awareness not demonstrated. Auditors cannot articulate the organisation's objectives or explain how their audits contribute to achieving them.
• Stale team members. The same two people have been auditing the same areas for three years with no refresher training and no rotation.

Each of these gaps has a straightforward fix. The challenge is that they tend to accumulate quietly over time, particularly in organisations where the audit programme is managed alongside many other responsibilities by a Quality Manager who is already stretched. Building a structured team development process, even a simple one, prevents these issues from compounding.

Keeping the Team Developing Over Time

Competence is not a one time achievement. ISO 19011:2026, the guidelines for auditing management systems, is clear that auditor competence needs to be maintained and developed continuously. For your internal audit team, this means building ongoing development into the programme rather than treating it as something that happens once at the start.

Practical approaches to ongoing development include:

• Annual refresher sessions that cover changes to the standard, lessons learned from the previous audit cycle, and any new process areas that auditors will be covering
• Sharing audit reports across the team so auditors can learn from each other's findings and writing styles
• Encouraging team members to attend external auditor training at Lead Auditor level when they are ready to progress
• Reviewing the audit programme outputs at management review and identifying whether the team's findings are adding genuine value

If your internal audits consistently find nothing of significance, that is not a sign that everything is perfect. It is more likely a sign that the team needs development, the scope needs to expand, or the questioning approach needs to sharpen.