Why Your First Internal Audit Is More Challenging Than It Looks
Running your first internal audit is one of those experiences that no amount of reading fully prepares you for. You have studied the standard, attended training, built a checklist, and still find yourself in the audit room wondering why things are not going the way you expected. That is completely normal. Every experienced auditor has been there.
On this page
The good news is that most first internal audit mistakes follow predictable patterns. They are not random. Once you know what they are and why they happen, you can take deliberate steps to avoid them. This article walks through the most common errors new internal auditors make, explains the real reason they occur, and gives you practical ways to handle each one before it becomes a problem.
If you are still weighing up your training options before your first audit, it is worth reading our guide on how to become an ISO internal auditor to make sure your foundation is solid before you step into the audit room.
Mistake 1: Treating the Checklist as a Script
The checklist is one of the most misused tools in a new auditor's kit. When you are nervous and unsure of yourself, it is tempting to work through it question by question, ticking boxes as you go. The problem is that this turns your audit into a questionnaire rather than a genuine examination of the system.
Checklists are useful for planning coverage and making sure you do not miss key areas. They are not designed to replace your thinking. When an auditee gives you an unexpected answer, or when you notice something on the shop floor that does not quite match what the procedure says, the checklist will not tell you what to do next. Your judgement will.
Real auditing happens in the gaps between checklist questions. An auditee says the procedure is followed, but when you ask to see the last five records, three of them are missing. That is not on any checklist. It came from following the evidence.
Practical fix: Use your checklist as a prompt, not a script. Before each section, review what you want to understand about the process, not just what questions you plan to ask. When something interesting comes up, follow it. You can always come back to the checklist.
Exemplar Global Recognised Training ProviderRTP No. 310970
Mistake 2: Accepting Verbal Assurances Without Evidence
New auditors are often too willing to accept what people tell them. An auditee says the team is trained, the equipment is calibrated, and the corrective actions have all been closed. The new auditor writes it down and moves on. The experienced auditor asks to see the training records, the calibration certificates, and the corrective action register.
This is not about distrust. It is about the fundamental principle that audit conclusions must be based on evidence, not assertion. A well-intentioned auditee can genuinely believe their process is compliant while the documented evidence tells a different story. People often describe how things are supposed to work rather than how they actually work on the day.
The ISO 19011 guidelines are clear on this point. Evidence should be verifiable. Verbal confirmation alone does not meet that bar. When you write up your findings, you need to be able to point to something concrete: a record, an observation, a document, a data set.
Practical fix: After every verbal claim, ask yourself what evidence would confirm this. Then ask for it. Keep the request conversational: “That sounds good. Would you be able to show me an example?” Most auditees will respond positively to this approach.
Mistake 3: Auditing Conformity Instead of Effectiveness
This is one of the most common and least discussed mistakes new auditors make. They focus entirely on whether the organisation has the required documents and records, and miss the bigger question: is the system actually working?
An organisation can have a beautifully formatted procedure for every process, training records for every employee, and a corrective action register that looks immaculate, and still have a quality management system that is not delivering any real benefit. Conformity and effectiveness are not the same thing.
ISO 9001 Clause 9.2 specifically asks that internal audits determine whether the management system conforms to requirements and is effectively implemented and maintained. That second part is the one new auditors tend to skip. Asking whether the procedure exists is easy. Asking whether following the procedure actually prevents the problem it was designed to prevent is harder, but far more valuable.
Practical fix: For each process you audit, ask one effectiveness question beyond the conformity check. If you are auditing the corrective action process, do not just confirm that corrective actions are being raised. Ask whether the same types of problems keep recurring. Recurring issues with closed corrective actions are a strong signal that the root cause analysis is not working.
Mistake 4: Failing to Prepare Properly
Walking into an audit without adequate preparation is one of the fastest ways to lose credibility. New auditors sometimes underestimate how much groundwork is needed before the first interview begins.
Preparation means more than printing a checklist. It means reviewing the scope of the audit and understanding which clauses and processes are in scope. It means reading the relevant procedures before you arrive so you know what the organisation says it does. It means checking previous audit reports to understand what nonconformities were raised and whether they were closed effectively. It means understanding the context of the area you are auditing well enough to ask intelligent questions.
When you arrive unprepared, auditees notice. Your questions will be generic. You will not recognise when something is unusual. You will miss connections between processes. The audit will feel superficial, because it is.
Practical fix: Build a preparation routine that you follow before every audit. At minimum: review the previous audit report, read the relevant procedures, check the corrective action register for open items in the area, and draft your opening questions. An hour of preparation will save you three hours of confusion on the day.
Mistake 5: Mishandling the Opening Meeting
The opening meeting sets the tone for everything that follows. New auditors often rush through it, treating it as an administrative formality. This is a mistake. A well-run opening meeting builds trust, clarifies expectations, and gives you information that shapes the rest of the audit.
Common errors in opening meetings include: failing to explain the audit scope clearly, not asking whether there are any areas that require special access arrangements, skipping introductions for team members, and not confirming the closing meeting time. When the opening meeting is poorly handled, auditees often feel uncertain about what is happening and become defensive.
The opening meeting is also your first opportunity to observe how the organisation's people interact with the audit process. Do managers seem engaged or dismissive? Are people forthcoming or guarded? These observations are useful context for what follows.
For a detailed walkthrough of what a good opening meeting looks like in practice, see our article on how to conduct an opening meeting for an ISO audit.
Mistake 6: Asking Closed Questions
Closed questions are questions that can be answered with yes or no. They are the natural default for nervous auditors because they feel controlled and safe. The problem is that they give you almost no useful information.
Consider the difference between these two approaches. You ask: “Do you have a procedure for this process?” The auditee says yes. You have learned almost nothing. Now consider asking: “Can you walk me through how this process works from start to finish?” The auditee describes the process. You can now compare what they describe against the written procedure, and against what you observe on the floor.
Open questions give auditees space to explain, and in that explanation, you often find the most interesting audit evidence. Gaps appear. Inconsistencies surface. People describe workarounds they have developed because the official procedure does not work in practice.
Practical fix: Before the audit, draft your key questions in open form. Start with words like: tell me, show me, walk me through, explain how, what happens when, describe the last time. If you catch yourself asking a closed question, follow it up immediately with an open one.
Mistake 7: Writing Vague or Unsupported Nonconformity Reports
A nonconformity report that says “training records were not adequate” is almost useless. It does not tell the auditee what specific requirement was not met, what evidence was examined, or what was actually found. Writing this kind of finding is one of the most common mistakes new auditors make, and it creates real problems downstream when the organisation tries to develop a corrective action.
A well-written nonconformity needs three things: the specific clause or requirement that was not met, the objective evidence that demonstrates the nonconformity, and a clear statement of what was found. Without all three, the finding is open to challenge and difficult to close effectively.
For example, a properly written nonconformity might read: “ISO 9001:2015 Clause 7.2 requires the organisation to determine the necessary competence of persons doing work that affects quality performance. During review of training records for the production team, records for three of five sampled operators (records dated March, April and June 2025) did not include evidence of competence evaluation following training completion.” That finding is specific, referenced, and evidenced.
Our article on how to write a nonconformity report that actually gets fixed goes into this in much more detail and is worth reading before your first audit.
Mistake 8: Letting the Auditee Control the Audit
This happens more often than you might expect. A confident, experienced auditee takes over the conversation, steers you away from sensitive areas, fills every silence with information you did not ask for, and before you know it, the audit has covered exactly what the auditee wanted it to cover and nothing more.
New auditors are particularly vulnerable to this because they are still building confidence. When a senior manager starts explaining at length why something is not really a problem, it can be hard to redirect politely. When an auditee says “we do not really do it that way here, let me show you our approach,” it can feel rude to insist on seeing the original process.
You are there to examine the system objectively. You set the agenda. The auditee provides information and access. When the conversation drifts, it is your responsibility to bring it back. This does not require confrontation. A simple “thank you, that is helpful context. I would still like to see the records we discussed earlier” is usually enough.
Practical fix: Keep your audit plan visible during interviews. When you feel the conversation drifting, refer back to it. Having a written plan also signals to the auditee that the audit has a structure they should expect you to follow.
Mistake 9: Ignoring Observations and Focusing Only on Documents
Some new auditors spend the entire audit in a meeting room reviewing documents and never actually go to the floor where the work happens. This is a significant missed opportunity. Physical observation is one of the most powerful audit techniques available, and it regularly reveals things that documents alone never would.
You might review a procedure for receiving goods that looks perfectly compliant on paper. But when you walk to the receiving dock, you find that incoming materials are being stored before inspection is complete, the inspection records are being filled in retrospectively, and the person doing the inspections has not been trained on the current version of the procedure. None of that would have appeared in the document review.
Practical fix: Build observation time into every audit plan. For any process with a physical component, plan to spend time at the location where the work actually happens. Ask the auditee to walk you through a recent example in real time rather than describing it in the abstract.
Exemplar Global Recognised Training ProviderRTP No. 310970Mistake 10: Rushing the Closing Meeting
After a long day of auditing, it is tempting to rush through the closing meeting to get to the end. New auditors sometimes present findings unclearly, omit the rationale behind findings, or fail to give auditees adequate opportunity to respond. This creates confusion and resentment that makes corrective action follow-up much harder.
The closing meeting is your last opportunity to make sure everyone understands what was found and why it matters. Findings that come as a surprise at the closing meeting usually indicate that the auditor did not communicate clearly during the audit itself. Good practice is to flag potential findings as they emerge during the day, so the closing meeting is a summary rather than a revelation.
Practical fix: Prepare your closing meeting summary before you enter the room. Have each finding written out clearly with the clause reference and the evidence. Present each one calmly, explain the basis for the finding, and invite the auditee to ask questions. Do not rush. The closing meeting is part of the audit, not an afterthought.
Building Confidence Through Proper Training
Many of the mistakes covered in this article come down to the same root cause: insufficient preparation before stepping into the auditor role. Knowing the standard is not the same as knowing how to audit. The practical skills of questioning, evidence gathering, note taking, finding classification, and report writing all need to be developed deliberately.
If you are preparing for your first internal audit, or looking to sharpen skills that have developed some bad habits, structured training makes a genuine difference. Audit Workshop delivers internal auditor training for ISO 9001, ISO 14001, and ISO 45001 at both Foundation and Internal Auditor levels. Courses are available live and self-paced, and are built around practical audit scenarios rather than theory alone. You can explore the available courses at auditworkshop.com.
