When you sit down to plan an internal audit, one of the first decisions you make is how you will move through the organisation. Will you follow a single product or service from start to finish? Or will you cut across multiple departments to see how a particular requirement is applied everywhere? That choice defines whether you are running a vertical audit or a horizontal audit, and getting it right matters more than most auditors realise. Both approaches are legitimate, both are used in practice, and both serve different purposes. This article explains what each one involves, when to use them, and how to combine them for maximum audit effectiveness.
On this page
What Is a Vertical Audit?
A vertical audit follows a single process, product, or service through multiple layers of the organisation. Think of it as tracing a thread from one end of the operation to the other. You might start with a customer order, then follow it through quoting, procurement, production, inspection, and final delivery. At each stage, you are checking whether the system requirements are being applied consistently as the work moves forward.
The word vertical refers to the way the audit moves through the process hierarchy, from inputs at the top down to outputs at the bottom, or from a high level requirement down to the shop floor evidence that confirms it is being met.
What a Vertical Audit Looks Like in Practice
Imagine you are auditing a manufacturing business certified to ISO 9001. You select a recently completed job and trace it backwards and forwards through the system. You might check:
- Whether the customer requirement was correctly captured and reviewed before acceptance
- Whether the planning for that job referenced the correct work instructions
- Whether the materials used were from approved suppliers and verified on receipt
- Whether inspection records exist at the required hold points
- Whether any nonconformances were raised and closed before the product was released
- Whether the customer received what was agreed and whether satisfaction was measured
You are not jumping between departments to check how they handle different jobs. You are staying with one job and following it through the entire process flow. This gives you a rich picture of whether the system actually works end to end for a real piece of work.
When Vertical Audits Work Best
Vertical audits are particularly effective when you want to test the process approach in practice. ISO 9001 Clause 4.4 requires organisations to manage their operations as interacting processes, and a vertical audit is one of the best ways to verify that the interactions between processes are actually controlled and not just documented on a flowchart.
They also work well when you suspect that a problem is systemic across a process rather than isolated in one department. If customer complaints keep referencing late delivery, a vertical audit through the order fulfilment process will expose where the breakdown is occurring.
For lead auditors conducting certification audits, vertical audits are a core technique. They allow you to test multiple clauses in a single audit trail without jumping around the standard in a way that confuses the auditee and produces shallow evidence.
Exemplar Global Recognised Training ProviderRTP No. 310970
What Is a Horizontal Audit?
A horizontal audit takes a single requirement, clause, or system element and examines how it is applied across multiple departments, sites, or functions. Instead of following a product through the organisation, you are following a requirement across the organisation.
The word horizontal reflects the way the audit cuts across different parts of the business at the same level, checking for consistency in how a particular requirement is understood and implemented.
What a Horizontal Audit Looks Like in Practice
Take document control under ISO 9001 Clause 7.5 as an example. In a horizontal audit, you would visit multiple departments and check whether each one is managing its documented information correctly. You might ask:
- Are the documents in use the current approved versions?
- Are obsolete documents removed from use or clearly identified?
- Do staff know where to find the documents they need?
- Are records being retained for the required periods?
- Is access controlled appropriately for sensitive records?
You ask the same questions in the workshop, the office, the warehouse, and the project team. What you are looking for is whether the document control requirement is applied consistently across the organisation, or whether some areas are compliant and others are not.
Another common horizontal audit target is training and competence under Clause 7.2. You might check across every department whether competence requirements are defined, whether records exist, and whether the process for evaluating training effectiveness is actually being used. Inconsistency across departments is a very common finding in this area.
When Horizontal Audits Work Best
Horizontal audits are most useful when you want to test consistency of implementation across a complex organisation. They are particularly valuable for:
- Multi site organisations where you want to confirm that all sites are applying a requirement the same way
- Requirements that cut across all departments, such as risk management, awareness, communication, and documented information
- Situations where previous audits have found isolated nonconformities and you want to determine whether the problem is widespread
- Requirements that are often applied well in one area but poorly in others
If a previous audit found that the maintenance department was not following the calibration procedure, a horizontal audit on calibration across all departments will tell you whether that was an isolated failure or part of a broader pattern.
Key Differences Between the Two Approaches
The table below summarises the practical differences between vertical and horizontal auditing:
- Focus: Vertical audits follow a product, service, or process. Horizontal audits follow a requirement or clause.
- Movement: Vertical audits move through the process flow. Horizontal audits move across departments or functions.
- Best for: Vertical audits test end to end process effectiveness. Horizontal audits test consistency of implementation.
- Findings: Vertical audits often reveal breakdowns at process interfaces. Horizontal audits often reveal uneven application of requirements.
- Clause coverage: Vertical audits naturally cover multiple clauses. Horizontal audits focus on one or a small number of clauses in depth.
Neither approach is inherently superior. The choice depends on what you are trying to learn from the audit.
Combining Both Approaches in a Single Audit
Experienced auditors rarely use just one approach. In practice, most well planned audits combine vertical and horizontal elements. You might start with a vertical trace through a core process to understand how the organisation works, then switch to a horizontal check on a specific requirement that raised questions during the trace.
For example, during a vertical audit of a construction project from tender to handover, you notice that the inspection and test plan records are inconsistent between the civil team and the mechanical team. At that point, you might pivot to a horizontal check on documented information management across all project teams to determine whether the inconsistency is isolated or systemic.
This kind of adaptive auditing is exactly what ISO 19011 encourages. The audit plan sets the direction, but the auditor adjusts based on what the evidence is showing. A rigid commitment to one approach when the evidence is pointing elsewhere is a sign of an inexperienced auditor.
For more on how to structure your audit approach, the article on process based vs clause based auditing covers related territory that complements the vertical and horizontal distinction.
Applying These Approaches Across Different ISO Standards
ISO 9001 Quality Management
In ISO 9001 audits, vertical auditing is particularly powerful for testing the process approach and the control of externally provided processes under Clause 8.4. Following a purchased service from supplier selection through to performance evaluation gives you a complete picture of whether the supply chain controls are working. Horizontal auditing suits requirements like quality objectives (Clause 6.2), awareness (Clause 7.3), and monitoring and measurement (Clause 9.1).
ISO 14001 Environmental Management
For environmental audits, a vertical approach works well when tracing a significant environmental aspect from identification through to operational control and monitoring. You might follow the management of a chemical substance from procurement through storage, use, and disposal, checking controls at each stage. A horizontal audit on emergency preparedness across all sites or facilities is a strong way to test whether the requirement is applied consistently where it matters.
ISO 45001 Occupational Health and Safety
In safety audits, vertical auditing is effective for tracing a hazard from identification through risk assessment to control implementation and monitoring. You might select a specific high risk task and follow the entire control pathway. Horizontal auditing suits requirements like worker consultation (Clause 5.4), where you want to check whether genuine consultation is happening across all work areas, not just in the main office.
ISO 27001 Information Security
For information security audits, a horizontal approach on access control across multiple systems and departments is a common and effective technique. A vertical approach might trace a data asset from creation through processing, storage, and disposal, checking that the relevant controls from Annex A are applied at each stage.
Planning Your Audit to Use These Approaches Deliberately
The choice of vertical or horizontal approach should be made during audit planning, not on the day. When you are writing your audit plan, think about what questions you need to answer and which approach will give you the best evidence to answer them.
Start by identifying the high risk areas based on your audit programme risk assessment. For processes where end to end effectiveness is the concern, plan a vertical trace. For requirements where consistency across departments is the concern, plan a horizontal sweep.
Your audit checklist should reflect the approach you have chosen. A vertical checklist follows the process sequence. A horizontal checklist lists the same requirement across multiple departments. Both types are useful, but they look different and require different interview strategies.
For practical guidance on structuring your checklist to support either approach, the article on how to use an audit checklist without becoming checklist dependent is worth reading before your next audit.
Common Mistakes Auditors Make With These Approaches
Staying Too Shallow in a Vertical Audit
The most common mistake in vertical auditing is following the process at a surface level without digging into the evidence at each stage. Auditors who ask do you have a procedure for this? and accept a yes as sufficient evidence are not really auditing vertically. They are ticking boxes. A genuine vertical audit involves examining actual records, interviewing the people doing the work, and observing the process where possible.
Losing Focus in a Horizontal Audit
In horizontal auditing, the risk is scope creep. You start checking document control and end up auditing half the management system. Keep the horizontal audit focused on the specific requirement you are testing. If you find other issues along the way, note them and address them in a separate audit or raise them as observations, but do not let them derail your planned approach.
Not Documenting the Audit Trail
Whether you are auditing vertically or horizontally, your working notes need to record exactly what you examined, who you spoke to, what they said, and what documents or records you reviewed. This is especially important in vertical audits where the evidence spans multiple departments and the audit trail can become difficult to reconstruct after the fact.
The article on how to gather audit evidence that stands up to scrutiny covers the documentation discipline that supports both approaches.
Exemplar Global Recognised Training ProviderRTP No. 310970Using These Approaches in Your Internal Audit Programme
A well designed internal audit programme should use both approaches across the audit cycle. Not every audit needs to cover every clause. A risk based programme might dedicate one audit per quarter to a vertical trace through a core process, and another to a horizontal check on a system wide requirement that has shown weakness in previous cycles.
Over the course of a year, this approach gives you much richer coverage than simply working through the standard clause by clause. It also produces findings that are more meaningful to management, because they are connected to real processes and real outcomes rather than abstract compliance statements.
When you present your audit findings, being able to explain that you followed a specific product through the system or that you checked a specific requirement across all departments gives your conclusions much more credibility. Management understands process based language far better than clause based language, and that is exactly what vertical and horizontal auditing delivers.
If you are building or refining your internal audit programme, the article on how to build an internal audit programme from scratch provides a practical framework that incorporates risk based scheduling alongside these audit approaches.
How Audit Workshop Training Covers These Techniques
Understanding vertical and horizontal auditing at a conceptual level is straightforward. Applying them under real audit conditions, managing your time, adjusting when the evidence takes you somewhere unexpected, and documenting the trail clearly, takes practice and coaching.
At Audit Workshop, the internal auditor and lead auditor courses cover both approaches in practical exercises and simulated audit scenarios. Courses are available for ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards, at Foundation, Internal Auditor, and Lead Auditor levels. Training is available live online and self paced, designed for practitioners who need skills they can use immediately, not theory they will forget by Monday.
If you are working toward your first internal audit or preparing for lead auditor certification, the training at Audit Workshop will give you the practical grounding to plan and execute audits using both vertical and horizontal approaches with confidence.
