Quality Management
Internal Auditor Training: What ISO 19011:2026 Requires and Why a Certificate Is Not Enough
The question arrives in almost identical form every time: “How many people should I send on an internal auditor course, and do they need a certificate?” Behind it there is usually an upcoming certification audit and a suspicion that internal audits so far have not been particularly useful.
The short answer surprises most people: nowhere does ISO 9001 require your internal auditors to hold a certificate. It requires them to be competent and objective. The difference between those two things is exactly why some internal audits find problems before the customer does, while others fill in forms.
Key Takeaways
- The standard requires competence, not a certificate. ISO 9001 obliges the organisation to determine the necessary competence and to ensure it — how remains the organisation’s choice.
- ISO 19011:2026 is the current framework for auditor competence, published on 27 May 2026. It explicitly adds digital skills and remote auditing skills.
- Competence is three things — knowledge, skills and personal behaviour. A course gives the first, practice gives the second, and the third is why not every good specialist makes a good auditor.
- Objectivity is mandatory. Auditors shall not audit their own work — this is an explicit requirement, not good practice.
- ISO 9001:2026 is published on 16 September 2026. Your auditors will need a top-up on the new requirements before they can assess transition readiness.
- Two to three trained auditors cover the needs of most small and medium organisations — provided they actually audit at least once a year.
Does ISO 9001 require certified auditors?
No. ISO 9001 does not require an internal auditor to hold a certificate. The requirements sit in two clauses and are worth separating:
- Clause 9.2 (internal audit) requires the organisation to plan an audit programme, define the criteria and scope of each audit, and select auditors and conduct audits to ensure objectivity and impartiality.
- Clause 7.2 (competence) requires you to determine the necessary competence of persons affecting performance, ensure that competence, and retain documented information as evidence.
In other words the standard asks two questions: is the person competent and are they independent of what they audit. A course certificate is convenient evidence of the first, but it is neither the only nor a mandatory form. Training records combined with audits performed under the supervision of an experienced auditor do the same job.
The requirement that is genuinely not open to interpretation: auditors do not audit their own work. The production manager does not audit production; the quality manager does not audit the document control they maintain themselves. This is the most frequently raised finding in this area — and an external auditor spots it immediately, just from the names on the audit plan.
What ISO 19011:2026 says about competence
ISO 19011 is the guidance standard for auditing management systems and contains the framework for evaluating auditor competence. The new edition was published on 27 May 2026 and replaces the 2018 version. You cannot be certified against it — it is guidance, but it is the guidance every external auditor expects you to follow.
The revision is evolutionary. Two changes bear directly on training:
- Digital competences. Working with audit platforms, evaluating electronic evidence and analysing data are now part of the expected profile rather than a bonus.
- Remote auditing skills. Remote and hybrid audits are recognised as a normal method. Interviewing over video is a different skill from interviewing on the shop floor and has to be learned separately.
Competence: knowledge, skills, behaviour
| Component | What it covers | How it is acquired |
|---|---|---|
| Knowledge | The requirements of the standard, audit principles, the organisation’s processes and risks, applicable legal requirements | Training, self-study, sector experience |
| Skills | Planning, asking open questions, gathering objective evidence, writing a finding, writing a report | Supervised practice across several audits |
| Personal behaviour | Observance, diplomacy, composure under pressure, impartiality, the ability to listen | Selecting the right person, not training |
That last row explains why choosing whom to send on a course matters more than choosing the course. The best process engineer is not automatically a good auditor — if they cannot listen, they will look for confirmation of an opinion they already hold instead of for evidence.
What good training contains
An internal auditor course typically runs two to three days. The difference between a useful and a useless course is not the number of hours but the ratio of theory to practice.
- The requirements seen through an auditor’s eyes. Not a retelling of the clauses, but what evidence you look for against each of them.
- Audit principles and the audit process. Planning, opening meeting, gathering evidence, closing meeting, report.
- Interview technique. Open questions, following one case end to end, separating fact from opinion.
- Writing a finding. Statement, evidence, requirement — the three elements without which a nonconformity cannot be closed meaningfully.
- Practical exercises. Role play and worked cases — the part missing from cheap online courses.
- A supervised audit. The first real audit is led by an experienced auditor while the new one observes and participates. This step costs one day and achieves more than the entire course.
Training is only worth anything if the person then audits. An auditor trained in 2023 and unused since is, in practice, not competent — and an external auditor can take that position entirely legitimately.
In-house training, open course or Lead Auditor?
| Option | Suits | What it gives | What it does not give |
|---|---|---|---|
| On-site training for the team | Organisations with two or more future auditors | Examples from your own processes, shared terminology | An outside view from other sectors |
| Open internal auditor course | One or two people | Comparison with practice in other companies | The specifics of your processes |
| Online self-study | Refreshing an already trained auditor | Low cost, flexibility | Practice, feedback, behavioural skills |
| Lead Auditor (5 days, with exam) | Consultants and supplier auditors | An internationally recognised qualification | More scope than purely internal needs justify |
For internal purposes the Lead Auditor course is nearly always over-investment. It becomes justified when the same people will also perform supplier audits — there the external weight of the qualification pays off when negotiating access and defending findings.
ISO 9001:2026: why your auditors need a top-up
The new version of ISO 9001 is published on 16 September 2026 and starts a three-year transition period. What matters for internal auditors is this: the internal audit is where transition readiness is tested first — months before the certification body arrives.
That means your auditors need to know what to look for against the new emphases: climate change in the context analysis, quality culture and ethical behaviour, and the clearer separation between risks and opportunities. An auditor unfamiliar with the new requirements will run a technically correct audit against the old text and leave you with a false sense of readiness.
The practical recommendation: schedule the short top-up training together with the gap analysis, not after it. The details of the transition itself are in our article on ISO 9001:2026.
If an ISO 14001:2026 transition is also coming, or you run an integrated system, train the auditors on the common clauses once. They are being updated at the same time, and a second course would repeat the first.
How to evidence competence to the external auditor
- Defined competence criteria — what your organisation requires of an internal auditor. Half a page is enough.
- Training records — certificate, course programme, date, duration.
- Evidence of practice — audits performed, naming the auditors, including supervised audits.
- Auditor evaluation — a short annual review: report quality, deadlines met, feedback from auditees.
The last point is skipped by nine organisations out of ten, and it is the strongest evidence that competence is being maintained rather than having been a one-off event.
Four mistakes in auditor training
Mistake 1: training only the quality manager. They then become the only auditor and cannot audit their own work. By definition the system is left with uncovered processes.
Mistake 2: training with no practice after it. A course in March and a first audit in November means a course that has to be repeated.
Mistake 3: auditors only from the quality function. Auditors from production, logistics and sales see things a quality specialist does not — and take the benefit back to their own department.
Mistake 4: choosing the cheapest online course. If the programme contains no exercises, you get a certificate rather than an auditor. The certificate passes the external audit; the missing skills show up in the first report.
Internal auditor training with practice on your own processes
We deliver training on site or remotely — for ISO 9001, 14001, 45001 and integrated systems, including top-up sessions on the changes in the new versions and a supervised first real audit.
Conclusion
The internal audit is the only mechanism by which an organisation sees itself before someone else does. Whether it does that job depends less on the standard and more on people: who is chosen, whether they were taught technique rather than only clauses, and whether they audit often enough not to forget what they learned.
If you are starting from scratch, take two people from different departments, train them together and give them a real audit within a month of the course. What external auditors expect to see is covered in our guide to preparing for the certification audit.
Frequently Asked Questions
Does ISO 9001 require a certified internal auditor?
No. ISO 9001 does not require internal auditors to hold a certificate. Clause 9.2 requires auditors to be selected so that objectivity and impartiality are ensured, and clause 7.2 requires the organisation to determine the necessary competence, ensure it and retain evidence of it. A course certificate is convenient but not the only acceptable evidence.
How long does internal auditor training take?
Internal auditor training typically runs two to three days. Lead Auditor courses last around five days and end with an examination, but for purely internal needs that scope is usually unnecessary. More important than duration is the ratio between theory and practical exercises.
How many internal auditors does a company need?
For most small and medium organisations two to three trained auditors are enough. The minimum is two, because one auditor cannot audit their own work and the system would be left with uncovered processes. It is better for auditors to come from different departments rather than only from the quality function.
Can the quality manager be an internal auditor?
Yes, but they cannot audit the processes for which they are responsible. If the quality manager maintains document control and the internal audit programme, those areas must be audited by another trained auditor or by an external provider. This is an explicit objectivity requirement, not a recommendation.
What is ISO 19011:2026 and is it mandatory?
ISO 19011:2026 is the guidance standard for auditing management systems, published on 27 May 2026, replacing the 2018 edition. It is not mandatory and no certificate is issued against it, but it is the reference framework for audit principles, managing the audit programme and evaluating auditor competence.
Do internal auditors need extra training because of ISO 9001:2026?
Yes, it is recommended. The new version of ISO 9001 is published on 16 September 2026 and introduces new emphases – climate change in the context analysis, quality culture and ethical behaviour, and a clearer separation between risks and opportunities. The internal audit is the first place transition readiness is tested, so auditors should know the new requirements before the gap analysis.
Can internal audits be outsourced?
Yes. The standard does not require auditors to be employees, only that they are competent and impartial. Outsourcing is common in small organisations, in specialised technical areas, and where the work of the quality manager themselves has to be audited. Responsibility for the audit programme remains with the organisation.