The cycle of internal audits is determined in the Internal audit program - here's how to define when to perform audits:
- An initial internal audit needs to be performed prior to the first management review and certification audit.
- Smaller companies will typically have only one internal audit every year (during which they will cover the whole scope of the management system) - this audit must happen before the surveillance visit.
- Larger companies will typically have a series of internal audits every year, where every audit will cover only one part of their management system - e.g., a department, a location, or only a part of the standard (e.g., only clause 7.5 Documented Information).