When the one person who ran your internal audits resigns, the procedures stay but the judgment walks out the door. Your ISO 9001 Clause 9.2 obligations do not pause while you recruit. This guide walks through what to do in the first two weeks, how to protect your audit calendar, how to choose and train new internal auditors, and how to prove audit competence to your registrar at the next surveillance audit.
What Actually Walked Out the Door
When your only trained internal auditor leaves, it's tempting to think the problem is a missing name on the audit schedule. It's bigger than that. The audit procedure, checklists, and past reports are still on the shared drive. What left was the judgment: which processes carry the most risk, how to tell a real finding from a paperwork gap, how to interview an operator without making them defensive, and how to write a finding that someone will actually fix.
ISO 9001 Clause 9.2 requires you to conduct internal audits at planned intervals, based on the importance of the processes, changes affecting the organization, and the results of previous audits. It also requires auditors who are objective and impartial, and it requires you to keep documented information as evidence of the audit program and results. None of those obligations pause while you recruit.
The good news: an internal audit program is one of the most rebuildable parts of a management system. It's a skill, not a secret, and the right people inside your company can learn it faster than you might expect.
The First Two Weeks: Stabilize
If the departing auditor is still working their notice period, use it. Sit down with them and capture the audit schedule and where it stands, audits completed this cycle and any overdue, open findings and corrective actions from past audits, which processes they considered highest risk and why, where records and checklists live, and anything unusual about your registrar's past audits.
Next, check the calendar against your next external audit. Registrars typically look at whether the internal audit program is being carried out as planned and whether it covers the scope of the system. If audits are overdue, a missed schedule can become a nonconformity at the next surveillance audit.
Then, re-plan based on risk. You don't have to audit everything in the next month. Prioritize processes with recent problems, customer complaints, or significant changes, plus any areas not audited this cycle. Document why you re-planned. A deliberate, risk-based re-plan is far easier to defend than a schedule that quietly lapsed.
Choose the Right People to Train
The best internal auditors aren't always the most senior people. Look for curiosity, the ability to listen, comfort asking "show me," and credibility with the floor. Supervisors, engineers, planners, buyers, and experienced technicians often make excellent auditors.
Train more than one. A program that depends on one person will fail the same way again. Two to four trained auditors, drawn from different departments, gives you coverage and makes impartiality easy: a production supervisor can audit purchasing, and a buyer can audit production. Auditors should not audit their own work.
Be realistic about time. Auditing a process typically takes a few hours to a day including preparation and reporting. Spread across several auditors, a full annual program is manageable without pulling anyone away from their main job for long.
Train Them the Way Auditors Actually Work
A good internal auditor course, typically two to three days, covers the audit process defined in ISO 19011: planning, the process approach, gathering objective evidence, interviewing, sampling, evaluating conformity and effectiveness, and writing findings. The best courses use real case studies and practice audits rather than lectures on clause numbers.
Classroom training is necessary but not sufficient. Competence comes from doing. After the course, each new auditor should lead two or three shadowed audits with a coach. The coach reviews the audit plan beforehand, observes the interviews, and critiques the evidence and the written findings afterward. That feedback loop is where people learn to find real problems instead of checking boxes.
Teach them to audit for effectiveness, not just paperwork. "Is there a procedure?" is a weak audit question. "Show me the last three times this process caught a problem, and what happened next" is a strong one.
Write Findings People Will Fix
A finding that nobody understands doesn't get fixed. Each nonconformity should state the requirement (the clause or internal procedure), the objective evidence (what the auditor saw, with specifics like dates, part numbers, and record IDs), and the statement of nonconformity (how the evidence fails the requirement).
Avoid opinions and vague language like "training appears inadequate." Instead, write: "Three of five operators interviewed on Line 2 had no training record for work instruction WI-214 Rev C, which was released on March 3." Specific findings lead to specific corrective actions.
New auditors also need to learn when not to write a finding. Opportunities for improvement are valuable, but a program that writes dozens of trivial findings loses credibility with the people who have to close them.
Prove Competence to Your Registrar
ISO 9001 doesn't require a specific auditor certificate, but Clause 7.2 requires you to determine the competence needed and keep documented evidence of it. For internal auditors, registrars typically look for training records, a defined competence criterion (for example, course completion plus a set number of shadowed audits), completed audit reports, and evidence that auditors are independent of the areas they audit.
Keep a simple auditor qualification record for each person: training completed, audits shadowed, audits led, and coach sign-off. It takes minutes to maintain and answers the competence question before the registrar asks it.
Build a Program That Survives the Next Resignation
The real lesson of losing your only auditor is that the program was a single point of failure. Fix that permanently. Keep at least two qualified auditors for every one you need. Rotate auditors across processes so knowledge spreads. Store the audit schedule, checklists, and reports in a location everyone can find. Review the program's health at management review: audits completed, findings trends, and corrective action closure.
Most importantly, make the audit program useful. When internal audits find real problems before the registrar or the customer does, people stop seeing them as a compliance chore and start seeing them as protection.
When to Bring in Help
If your surveillance audit is weeks away, your audit schedule is badly behind, or nobody inside has any audit experience, outside help can bridge the gap. An outside auditor can run the overdue audits while your new auditors shadow, then coach them into leading the next round.
That's the approach we take: our internal audit and auditor training work is led by an active third-party auditor, and the goal is always the same. Your team runs the program independently, and you stop depending on any one person. If this sounds like your situation, see our page on losing your only trained auditor, or tell us what's going on.
Sounds like your situation?
“Our only trained auditor just left”
See exactly how we approach this situation, what you'll have at the end, and request a Situation Review with our team.
Frequently Asked Questions
Can we skip internal audits while we replace our internal auditor?
No. ISO 9001 Clause 9.2 requires internal audits at planned intervals. A missed audit schedule is itself a likely nonconformity at your next surveillance audit. Re-plan the schedule based on risk, cover the highest-risk processes first, and use trained staff from other departments or an outside auditor to keep the program running.
How long does it take to train a new internal auditor?
Classroom internal auditor training typically takes two to three days. Real competence comes from shadowed audits afterward. Most people are ready to lead audits on their own after two or three audits with a coach reviewing their evidence, interviews, and written findings.
Does an internal auditor need a certification?
ISO 9001 does not require a specific certificate. It requires that auditors are competent and objective, and that you keep evidence of that competence. Training records, completed audit reports, and coach evaluations are the evidence registrars look for.
Can a department audit its own work?
Auditors should not audit their own work. ISO 9001 requires objectivity and impartiality. A common approach is cross-auditing, where a production supervisor audits purchasing and a buyer audits production.
