Free quality tools from Aegis: templates, kits and guides you can use today →

The Internal Audit Execution Kit HandbookChapter 2 of 19

The Internal Audit Execution workflow

Every audit moves through the same stages, inside a program that is planned once a year and adjusted every month. The shaded boxes are gates: Yes continues down, No goes to the note on the right.

  1. Program: rate each process on four factors, set its interval, plan the year with a named lead auditor for every audit (A06).
  2. Decision: Is the lead auditor qualified and independent of the area? If yes, continue to the next step.
    No:Reassign, pair with a qualified auditor, or use a contract auditor for the quality team's own processes.
  3. Plan and prepare: agree scope, criteria and samples a week ahead; ready the area, the crew and the evidence (A06, A09, A04).
  4. Audit: follow a real job, test each line on evidence, log requests (A07 or A05, A04).
  5. Decision: For each Partial or Gap, can you name the requirement and show the evidence? If yes, continue to the next step.
    No:Not a nonconformity: write an OFI or observation, or keep looking.
  6. Classify and write each finding, agree them at the closing meeting, report within ten working days (A08, A11).
  7. Decision: Does the response correct, find root and escape causes, and set an effectiveness criterion (A10)? If yes, continue to the next step.
    No:Return it with what is missing; escalate if late (CAPA Command Kit).
  8. Follow up: check effectiveness, look again at the next audit, change the program if risk changed, report to management review (A06 Summary).
Process flowchart. Shaded boxes are decisions: Yes continues down, No goes to the note. Open the flowchart as an image (as it appears in the handbook).
StagePurposeToolsOutputAS9100D
ProgramAudit where the risk is, cover every process in the cycleA06Process list, intervals, schedule, auditors9.2.1, 9.2.2
PlanAgree what will be audited, against what, howA06Audit plan sent a week ahead9.2.2
PrepareReady the area, the people and the evidenceA09, A04Area ready; evidence map checked7.5.3
AuditTest the process on evidence from the workA07, A05, A04Checklist with evidence; request log9.2.2
FindingsClassify and write findings that hold upA08Findings agreed at the closing meeting9.2.2
ReportRecord what was found and concludedA11Report issued within ten working days9.2.2, 7.5.3
RespondRemove the causes, prove it workedA10, CAPA Command KitAccepted response; effectiveness checked10.2.1, 10.2.2
ReviewKeep the program moving and learn from itA06 SummaryMonthly review; management review input9.1.3, 9.3.2

Need more than one resource, or not sure where to start? Book a complimentary 30-minute Aegis Quality Guidance Call. We'll find the tools that fit your situation and a sensible place to start. No sales pressure, no obligation.

A management aid, not certification or a registrar audit. Using it does not by itself show conformity to AS9100D or any other standard, and your customers' requirements may add to it.

Clause numbers refer to AS9100D (SAE AS9100 Rev D) unless another document is named. The standards' text is not reproduced here: use your own licensed copy.

Aegis Insights are our own guidance, labeled wherever they appear: how we approach this work, not a requirement of any standard or customer.