An audit programme must cover the important processes at least once a year, use knowledgeable auditors who do not audit their own work and lead to timely action.
What applies today
The body must have procedures for internal audits that verify it fulfils the standard and that the system is effectively implemented and maintained. It must plan an audit programme that considers how much each process and area matters and what earlier audits found. Audits must normally take place at least once every twelve months, or a segmented or rolling programme must be completed within twelve months. A documented decision process must be followed to change the frequency or the time frame, based on the stability and ongoing effectiveness of the system, and the decision and its rationale must be recorded. The body must ensure that audits are conducted by people who know certification, auditing and the standard; that nobody audits their own work; that the people responsible for the area are told the outcome; that actions follow promptly and in proportion; and that opportunities for improvement are identified.
Why it matters
Internal audit is the body's own check that the system it sells to clients is real. Independence inside a small body is hard, which is why the clause focuses on not auditing your own work rather than on a separate audit department. The clause also allows a risk-based frequency but requires the decision to be written down. A body that quietly moves to a two-year cycle without a rationale is exposed.
The public FDIS contents lists clause 8.6 as Internal audits (Option A). This site uses the shorter label Internal audits for the page. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
Clause 8 is where the 8.8 replacement meets management review, internal audit and corrective action. The public record confirms the titles; the requirement wording is not held. A first artefact an assessor commonly asks for here is audit programme with scope, frequency and rationale. The party this touches first is The internal audit owner and the auditors, who must not audit their own work.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Programme | Audit programme with scope, frequency and rationale |
| Audit records | Reports with findings, evidence and the area owner's acknowledgement |
| Competence | Auditor competence and independence record |
| Frequency decision | Documented decision to change frequency, with the reason |
| Actions | Findings tracked to closure with dates |
One common question. ask who audited the certification process and whether that person also runs it. A self-audit is a direct finding.
Common failures
- The quality manager audits every area, including their own
- The programme has no audit of the certification decision
- Findings are closed by email with no evidence
Prepare before publication
Add an audit of the transition to the programme and assign an auditor who does not own the process.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 8.6 has no separate date.
Cross-references
8.5 Management review · 8.7 Corrective actions · 8.8 Actions to address risks and opportunities (FDIS change) · 7.5 Review
Source
Source for 8.6: ISO/IEC 17065:2012, Clause 8.6, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.