ISO 9001:2026 Internal Audit Services in the Philippines: Outsourced Audits to the 2026 Standard

Updated 18 September 2026 against the ISO 9001:2026 standard (sixth edition, published 16 September 2026). Reviewed by Kaushal Sutaria, Lead Auditor, Sterling International Consulting.

Sterling conducts internal audits against ISO 9001:2026 for organisations across the Philippines, as the outsourced first-party auditor under 9.2, led by lead auditors who also audit for certification bodies. The service delivers the audit programme, the audit itself, a report with findings cited to the 2026 clauses, and follow-up to closure, in the sequence a certification body expects before a transition audit: changes implemented, internal audit to the 2026 edition, management review, then the certification body’s visit. Auditor competence is evidenced under 7.2 and ISO 19011; independence from the work audited is built into every assignment. This page describes the service; the how-to is on the internal audit checklist page.

Key facts about internal audit under the 2026 edition

• ISO 9001:2026 was published on 16 September 2026 as the sixth edition; 9.2 (internal audit) is unchanged in substance, but the criteria it audits against have changed.
• Global ACI (successor to IAF and ILAC since 1 January 2026) issued Global ACI-TECH-3-TR 2029-09-30 (M): transition to 30 September 2029; the certification body’s transition audit reviews the changed requirements of ISO 9001:2026 and changes in the organisation’s context.
• A certification body will expect at least one full internal audit against the 2026 edition, with findings closed and results reviewed by management, before the transition audit. An audit run on a 2015 checklist cannot have tested the new requirements.
• Internal auditors must be competent (7.2); Annex A.7.2 NOTE 2 points to ISO 19011 for auditor competence, and 9.2.2 requires objectivity and impartiality, which means no one audits their own work.
• Sterling audits as your internal auditor; it does not certify. The certification body’s audit is separate and independent of ours.

What the service delivers

An outsourced internal audit from Sterling is a complete 9.2 cycle, not a visit. It produces the programme, the plan, the audit, the report and the follow-up, in a form the certification body will read as evidence that the transition is real. The table sets out each deliverable and the requirement it satisfies.

Deliverable	What it contains	Requirement satisfied
Audit programme	Frequency, methods, responsibilities, planning requirements and reporting for the cycle; weighting for process importance, previous results and changes, including the transition	9.2.2
Audit plan for each audit	Objectives, criteria (ISO 9001:2026 and your documented requirements), scope, sites and processes sampled, interviewees, timing	9.2.2
Rebuilt checklist	Questions in the language of the auditee with the 2026 clause reference kept separately; the new requirements weighted; an evidence column, not a tick box	Method under ISO 19011
On-site or remote audit	Interviews at several levels, observation, records sampled; culture and ethics tested by triangulation across levels	9.2.1, 5.1.1 i), 7.3 e)
Audit report	Findings graded and cited to the 2026 clause with the evidence seen; positive observations; opportunities for improvement; a summary for management review	9.2.2, 9.3.2 d) 3)
Corrective action follow-up	Cause analysis facilitated, owners and dates agreed, effectiveness verified before closure	9.2.2, 10.2.1
Records	Programme, plans, reports and closure evidence, in your system or in Effivity where you use it	9.2.2
Auditor competence records	Lead auditor qualifications, ISO 9001:2026 update, sector experience, for the certification body’s file	7.2, A.7.2 NOTE 2

Every finding cites the 2026 clause, not the 2015 letter. That matters because the list lettering changed in 5.1.1, 5.3, 6.1.1, 6.2.1, 6.3, 7.3, 9.1.3 and 9.3.2, 6.1 gained a third sub-clause and 10.3 no longer exists; a report that cites the old references points your corrective action at the wrong place.

Auditor competence: who audits, and how it is evidenced

7.2 applies to internal auditors as to anyone whose work affects the performance of the QMS: competence must be determined, achieved and evidenced. Annex A.7.2 NOTE 2 points to ISO 19011 for auditor competence, and the certification body will ask how your auditors were brought up to date for the 2026 edition. Sterling’s audits are led by lead auditors who conduct certification, surveillance and transition audits for certification bodies.

For the 2026 edition that competence has three parts. Knowledge of the changes, at the level of the list item: the auditor must know that 6.1.2 now says “determine, analyse and evaluate”, that 6.3 has seven considerations and that 9.3.2 c) is a new input, or the audit will miss them. Interview skill for the behavioural requirements: 5.1.1 i) and 7.3 e) are tested by asking the same questions of people at three levels and comparing the answers, and by observing how a problem raised during the audit is received, which is a skill rather than a checklist. And sector knowledge: a food plant, a hospital, a contractor and a BPO produce different evidence for the same clause, and an auditor who has never seen a hold point or a CCP log will accept the wrong thing. Our lead auditors have audited manufacturing, construction, healthcare, food, BPO and public-sector organisations for certification bodies, and their competence records go into your file. Where we train your own auditors instead, the training page sets out the course and the transition module.

Independence and objectivity

9.2.2 requires auditors to be selected and audits conducted so as to ensure objectivity and impartiality of the audit process, and the NOTEs to the definition of audit (3.18) describe independence as freedom from responsibility for the activity being audited. No one may audit their own work. In a small organisation that rule alone can make an outsourced audit the only compliant option.

Sterling’s independence works in two directions. We are independent of your processes, so a quality manager who wrote the procedures is not the person testing them, and a finding is a finding regardless of who it embarrasses. We are also independent of the certification body: an internal audit by Sterling is a first-party audit under your control, the certification body’s audit is a third-party audit, and neither substitutes for the other. Where Sterling has helped implement or transition your system, we assign an auditor who did not do that work, and we say so in the report, because a certification auditor will ask. Where you prefer your own staff to audit, we cross-train them so that each audits an area outside their own responsibility, and we audit the quality function itself, which is the area internal teams most often leave untested.

The sequence before a transition audit

Global ACI’s transition requirements state that the certification body’s transition audit reviews the changed requirements of ISO 9001:2026 and changes in the organisation’s context, and certification bodies expect the organisation’s own system to have tested those changes first. The sequence below is the one we build every transition engagement around, and the internal audit sits in the middle of it, not the week before the visit.

Step	Activity	Requirement	Why the order matters
1	Gap analysis against the published register; gap report	4 to 10	You cannot audit changes that have not been decided
2	Changes implemented: policy, registers split and analysed, change-planning method, review agenda, awareness of culture and ethics	5.2, 6.1.2, 6.1.3, 6.3, 7.3 e), 9.3.2	Changes must bed in before they can be audited; culture needs weeks, not days
3	Audit programme updated with 2026 criteria; checklist rebuilt	9.2.2	An audit on a 2015 checklist cannot test the new requirements
4	Full internal audit to the 2026 edition, head office and a sample of sites	9.2.1	The certification body will ask for it, and will read the report
5	Findings closed: cause, action, effectiveness verified	10.2.1	Open findings at the transition audit become the certification body’s findings
6	Management review with the 2026 inputs, including audit results and the effectiveness of risk and opportunity actions	9.3.2 c), d) 3), g), h)	The review is the evidence that leadership has seen the audit
7	Transition audit by the certification body at surveillance, recertification or a special audit, once it is accredited for the 2026 edition	—	Certification bodies must complete their own accreditation transition by 30 September 2027

Allow at least four months between step 1 and step 7 for a single-site organisation, and longer for multi-site organisations that audit in rounds. The internal audit should be complete and its findings closed before the management review, and the review should precede the certification body’s visit by enough time to act on its decisions.

What we audit differently under the 2026 edition

The requirements that need a different audit approach in 2026 are few and specific, and our checklist weights them. The table summarises the approach for each; the full question set with evidence and who answers is on the internal audit checklist page.

Requirement	How it is audited
4.1 climate determination; 4.2 c) which interested-party requirements the QMS addresses	Ask for the recorded determination and the interested-party table with its decision column
5.1.1 i) and 7.3 e) quality culture and ethical behaviour	Same three questions to a new joiner, a supervisor and top management; observation of how findings are received; records read for honesty; no document requested first
5.2.1 e) and 5.2.2 d) policy	Top management asked how the policy supports the strategy and for a decision it shaped; staff asked what it means for their work
6.1.2 and 6.1.3 risks and opportunities	The analysis behind each rating, the evaluation behind each decision, and the effectiveness result; opportunities audited as decisions, not as mirror images of risks
6.3 c), e), f), g) planning of changes	One recent change traced: information needed, who was told, how effectiveness was monitored, where results were reviewed
7.1.6 knowledge	A process owner asked what would be lost if the most experienced person left, and where it is kept
8.2.1 e) contingency information including disruptions	Customer-facing staff asked what customers hear when delivery is disrupted, and where that is agreed
9.1.3 e) and f); 9.3.2 c), g), h)	Analysis records and management review minutes checked for the separate risk and opportunity evaluations and the interested-party changes input
10.1	Process owners asked what was improved that was not a fix to a past problem

Outsource, train your own, or both

Three models work, and the choice depends on size, sites and how much independence the organisation can achieve internally. Fully outsourced audits give independence and a certification auditor’s eye; trained internal auditors build lasting capability; a hybrid uses Sterling for the first 2026 cycle while staff observe and then hands over.

Fully outsourced suits organisations too small to separate auditor from auditee, organisations with one quality professional who wrote everything, and organisations that want the transition audit rehearsed by someone who has conducted one. Trained internal auditors suit larger organisations with several functions that can audit each other, provided the auditors are brought up to date for the 2026 edition and the update is evidenced. The hybrid is the most common in our transition work: we conduct the first full audit to the 2026 edition with your auditors alongside, they take the following cycles, and we return each year to audit the quality function and the leadership requirements that internal teams find hardest to test. Whichever model you choose, the audit programme is yours and the records stay in your system.

Multi-site programmes and remote audits

Organisations with several sites audit in rounds, and the programme has to cover every site over the cycle while giving the transition its own weight. Sterling plans multi-site programmes so that head office and the processes that changed most are audited first, findings from early rounds inform later ones, and the sample the certification body will take is already covered.

Remote internal audits by ICT are appropriate for document review, for interviews with remote staff and for sites where travel cost is disproportionate, and Global ACI permits the certification body’s own transition audit to be conducted remotely where appropriate. For the behavioural requirements we audit on site wherever possible, because how a supervisor reacts to a finding in front of the team is evidence that a video call does not show. Across Luzon, the Visayas and Mindanao we audit from Makati, Cebu and Davao, and travel is stated as a separate line rather than buried in the fee.

Findings, corrective action and management review

An audit that ends with a report has done half the job. 9.2.2 requires correction and corrective action without undue delay, 10.2.1 requires the cause to be evaluated and the effectiveness of the action reviewed, and 9.3.2 d) 3) requires audit results to reach management review as a trend, not a pile. Sterling’s follow-up covers each.

For every nonconformity we facilitate the cause analysis with the process owner, agree an owner and a date, and return to verify that the action worked before closing it, because a finding closed on a promise reopens at the certification audit. Where a nonconformity shows that a risk or opportunity was misjudged, the registers are updated, as 10.2.1 requires. The report’s summary section is written for the management review agenda, with the pattern across findings stated plainly, so that top management reviews what the audit found rather than a count. Where the organisation runs its records in Effivity, findings, actions and verification sit in the audit module with an audit trail the certification body can read directly.

How Sterling runs your internal audit

Sterling International Consulting delivers internal audits on site and by ICT from Makati, Cebu and Davao, through Sterling OS™, our delivery method: programme, plan, rebuilt checklist, audit, report, follow-up and management review input, with Sterling lead auditors who audit for certification bodies and therefore know what the transition audit will look for. We audit as your first-party auditor and never as the body that certifies you.

For organisations transitioning from ISO 9001:2015, the internal audit is step 7 of Sterling Revise™, the fixed-scope transition, and can also be commissioned on its own for organisations that have done the update themselves and want an independent test before the certification body arrives. For first-time implementations it is the audit before stage 2. Call +63 977 815 1204, email info@iso-philippines.com or book a consultation to schedule an audit ahead of your certification body.

Frequently asked questions

Is an internal audit the same as a gap analysis? No. A gap analysis compares the system as it is with the 2026 requirements to plan the transition; an internal audit tests, once the changes are live, whether the system conforms to the standard and to your own requirements and is effectively implemented (9.2.1). The gap analysis comes first, the internal audit comes after the changes have bedded in, and the certification body expects both.

Can Sterling run our internal audit for us? Yes. ISO 9001:2026 requires internal audits by objective and impartial auditors (9.2.2) and does not require them to be employees. Sterling conducts the full 9.2 cycle as your outsourced first-party auditor, led by lead auditors who audit for certification bodies, or trains and mentors your own auditors, or does both in a hybrid where we audit the first 2026 cycle and hand over.

Does Sterling’s internal audit replace the certification body’s transition audit? No. Ours is a first-party audit under your control; the certification body’s is a third-party audit that it plans and conducts independently. The certification body will read our report and your management review as evidence that the transition has been tested, and will then conduct its own audit of the changed requirements and your context, as Global ACI’s transition requirements describe.

How do you audit quality culture and ethical behaviour? By asking the same questions of a new joiner, a supervisor and a member of top management and comparing the answers; by observing how problems raised during the audit are received; by reading records for concerns raised and acted on without penalty; and by checking what the reward system pays for. We read the values statement last, so that it does not anchor the interviews. Consistency is the evidence; contradiction is the finding.

When should the internal audit happen before our transition audit? After the changes have been implemented and bedded in, and before the management review that precedes the certification body’s visit. Allow at least four months from gap analysis to transition audit for a single site. An audit the week before the visit leaves no time to close findings, and open findings become the certification body’s findings.

Do our ISO 9001:2015-trained auditors need retraining? They need to be brought up to date and the update evidenced under 7.2, because the criteria changed: renumbered lists, the new 6.1.3, seven items in 6.3, no 10.3, and requirements tested by interview. A half-day transition module with a practical exercise is proportionate for experienced auditors; new auditors take the two-day course on the 2026 standard. The certification body will ask.

How often should we audit internally? At planned intervals set by your programme (9.2.2), which in practice means every process at least once per certification cycle and the important or changed processes more often. Before a transition or certification audit, one full cycle to the 2026 edition is the minimum. Multi-site organisations audit in rounds with early findings informing later ones.

Read next

The ISO 9001:2026 internal audit checklist; ISO 9001:2026 training; ISO 9001:2026 gap analysis in the Philippines; the transition checklist; management review inputs; and the ISO 9001:2026 playbook.

Sources

ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026): 3.18 and NOTEs, 4.1, 4.2 c), 5.1.1 i), 5.2.1 e), 5.2.2 d), 6.1.2, 6.1.3, 6.3 c) and e) to g), 7.1.6, 7.2, 7.3 e), 8.2.1 e), 9.1.3 e) and f), 9.2.1, 9.2.2, 9.3.2 c), d) 3), g), h), 10.1, 10.2.1, Annex A.7.2 NOTE 2. ISO 19011, Guidelines for auditing management systems. Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026 (issue date 4 September 2026; announced 16 September 2026), including the content of the transition audit and remote conduct by ICT.