Quality Auditing: Internal, Second-Party, and Third-Party Audits

Types of quality audits

Understanding the three audit types is the starting point for building an audit program, because each type has a different purpose, audience, and outcome:

First-party (internal) audits: conducted by the organization’s own trained auditors on its own quality management system, processes, or products. The purpose of internal audits is to verify that the quality system is implemented as planned, that documented procedures are being followed, and to identify nonconformances and improvement opportunities before external audits or customer visits. Internal audits are a mandatory requirement of ISO 9001, IATF 16949, AS9100, and all major quality management system standards. The internal audit program must cover all processes and clauses of the applicable standard over a defined audit cycle, typically one to three years.

Second-party audits: conducted by a customer (or a third party acting on behalf of a customer) on a supplier’s quality management system, manufacturing process, or specific product quality controls. Second-party audits are a standard tool in supplier quality management: they are used to qualify new suppliers, to verify supplier conformance to Customer Specific Requirements, to investigate a supplier’s response to a quality escape, and to monitor high-risk or underperforming suppliers. The scope and frequency of second-party audits are typically defined in the customer’s supplier quality requirements or in the supply agreement.

Third-party audits: conducted by an independent accredited certification body to assess conformance to a quality management system standard and to issue or maintain certification. ISO 9001, IATF 16949, AS9100, ISO 13485 (medical devices), and ISO 45001 (occupational health and safety) are among the standards for which third-party certification is available and, in many industries, commercially required. Third-party auditors are employed by accredited certification bodies (CBs) and are required to demonstrate competence in both the applicable standard and the industry sector they audit.

The audit process: planning, execution, and reporting

Regardless of audit type, a quality audit follows a defined process that includes planning, opening meeting, evidence collection, analysis, closing meeting, and audit report:

Audit planning: the audit plan documents the audit objective (what is being determined), scope (what processes, areas, or clauses are covered), criteria (the requirements against which the auditee will be evaluated), methods (document review, interviews, observation, sampling), and schedule. The audit plan is communicated to the auditee in advance, typically at least one week before the audit. The lead auditor prepares audit checklists based on the scope and criteria to guide the evidence collection process.

Opening meeting: the audit begins with a formal opening meeting at which the lead auditor introduces the audit team, confirms the scope and objective, describes the audit process and schedule, and establishes communication channels. The opening meeting provides the auditee’s management with an opportunity to raise concerns or constraints before evidence collection begins.

Evidence collection: auditors collect objective evidence through document review (procedures, work instructions, records, data), interviews with personnel at all levels, and direct observation of processes and working conditions. The audit is a sampling activity: auditors cannot review every document or observe every activity, so they select representative samples designed to provide sufficient evidence to reach an objective conclusion. Evidence is recorded in audit notes tied to specific requirements, so that any findings can be traced back to the objective evidence that supports them.

Closing meeting and audit report: the audit concludes with a closing meeting at which the audit team presents the audit findings to the auditee’s management. Findings are classified as: conformances (requirements met), nonconformances (requirements not met), and observations or opportunities for improvement (practices that do not violate requirements but represent a risk or improvement opportunity). The audit report documents the findings, the evidence supporting each finding, and any recommendations. For third-party audits, the report is submitted to the certification body for review before certification decisions are made.

Nonconformances and corrective action linkage

The value of an audit is realized not at the closing meeting but through the corrective action process that follows. Every audit nonconformance must be addressed through a formal corrective action process: the auditee investigates the root cause, implements corrective action, and provides objective evidence of effectiveness to the auditor or audit program manager.

Nonconformances from quality audits are classified by severity. A major nonconformance is a systematic failure of a requirement that represents a significant risk to the quality of product or service outputs, or the complete absence of a required process or procedure. A minor nonconformance is an isolated failure of a requirement that does not represent a systemic pattern. Observations or opportunities for improvement are not nonconformances but are recorded to support continuous improvement. For third-party certification audits, major nonconformances must be corrected and verified before certification can be issued or maintained; minor nonconformances must be addressed within a defined period, typically 90 days.

Auditor competence and independence

The credibility of an audit depends on the competence and independence of the auditors. ISO 19011 defines the generic competencies required of all management system auditors: understanding of auditing principles and methods, ability to plan and conduct an audit, ability to collect and evaluate objective evidence, communication skills sufficient to conduct effective interviews and present findings clearly, and professional judgment to assess evidence objectively and reach well-supported conclusions.

In addition to generic auditing competence, auditors must have sector-specific technical knowledge of the processes and products they are auditing. An auditor evaluating a supplier’s machining process must understand dimensional metrology, control plan requirements, and process capability concepts. An auditor evaluating a software quality management system must understand software development life cycle concepts and software-specific quality requirements.

Independence is the other essential characteristic of an effective auditor. Internal auditors must not audit their own work: a process owner should not lead the audit of their own process. This does not mean that subject matter experts cannot participate in an audit of their area; it means that the lead auditor who is responsible for forming the audit conclusions must be independent of the area being audited. For third-party audits, the certification body’s auditors are required to be independent of both the auditee and any consulting relationship with the auditee.

Managing an audit program

A single audit produces a point-in-time snapshot of conformance. An audit program produces a longitudinal view of quality system health across processes, over time, and across the supply base. An effective audit program requires:

Risk-based audit scheduling: audit frequency and depth should be proportional to the risk associated with each process or supplier. Processes with a history of nonconformances, processes linked to critical product characteristics, and suppliers with recent quality problems warrant more frequent and deeper audits than stable, well-performing processes and suppliers.

Audit coverage tracking: the audit program manager must track which processes and standard clauses have been audited within the current audit cycle to ensure that all required areas receive coverage. A process that has not been audited in three years may have drifted significantly from the documented procedure without anyone detecting it.

Trend analysis: audit findings should be analyzed for patterns over time. An increase in the number of document control nonconformances across multiple audits may indicate a systemic problem with the document management system rather than isolated individual failures. Trend data from the audit program is an important input to the management review process.

Auditor development and calibration: internal auditors require initial training to a recognized standard (many organizations use IRCA-registered lead auditor training), periodic calibration to ensure consistent application of audit criteria, and continuing development to stay current with changes to standards and industry sector requirements.

Common errors in quality auditing

• Conducting compliance audits rather than effectiveness audits. An audit that only checks whether documents exist and whether procedures are written correctly confirms paper compliance but does not determine whether the quality system is actually controlling product quality. Effective auditing requires following the evidence: if a control plan specifies a dimensional check every 50 parts, the auditor should review the actual measurement records to verify the check is being performed at the specified frequency, review the data for control chart signals, and ask operators how they respond to out-of-control conditions.
• Telegraphing audit findings informally before the closing meeting. Sharing preliminary findings with auditee management before the closing meeting allows the auditee to correct visible evidence before the formal close, which undermines the integrity of the audit. Findings should be presented formally at the closing meeting with the full audit team and auditee management present.
• Accepting verbal assurances as objective evidence. When an auditee says “we always do that” or “that is covered in our procedure,” the auditor should verify the statement with documentary or observable evidence. Audit findings must be based on objective evidence, not assertions.
• Allowing corrective actions to remain open indefinitely. An audit nonconformance with no defined response due date and no follow-up mechanism will often never be closed. The audit program manager must track open corrective actions, enforce response timelines, and escalate overdue responses to management.

Frequently asked questions

What is the difference between a first-party, second-party, and third-party audit?

The three audit types are defined by the relationship between the auditing organization and the organization being audited. A first-party (internal) audit is conducted by an organization on its own quality management system and processes, using its own trained auditors. The purpose is to verify that the system is implemented as planned and to identify improvement opportunities. Internal audits are a mandatory requirement of ISO 9001, IATF 16949, and other quality management standards. A second-party audit is conducted by a customer on a supplier, or by a party acting on the customer’s behalf. Second-party audits are used to qualify new suppliers, assess supplier conformance to Customer Specific Requirements, or investigate supplier quality problems. A third-party audit is conducted by an independent accredited certification body to determine whether an organization’s quality management system conforms to a standard such as ISO 9001 or IATF 16949, and to issue or maintain certification. The independence of the third-party auditor is the key characteristic that allows the certification to serve as credible evidence of conformance to external customers and regulators.

What is a major nonconformance versus a minor nonconformance in a quality audit?

A major nonconformance is a finding that represents a systematic, significant failure of a requirement: the absence of a required process, a pattern of widespread failure to implement a documented procedure, or a condition that directly threatens the organization’s ability to meet customer or regulatory requirements. For third-party certification audits, a major nonconformance must be corrected and verified before the certification can be issued or maintained. A minor nonconformance is an isolated instance of a requirement not being met that does not represent a systemic pattern. Minor nonconformances must still be addressed through the corrective action process, but the timeline for resolution is typically longer than for major nonconformances (often 90 days for third-party audits). The classification of a finding as major or minor requires auditor judgment: an isolated missing record might be classified as minor, but five instances of missing records for the same procedure in different areas would likely be classified as major because they indicate a systemic problem. An observation or opportunity for improvement is not a nonconformance but is recorded to support continuous improvement; it does not require a corrective action response.

What is ISO 19011 and what does it cover?

ISO 19011 is the international standard that provides guidelines for auditing management systems. It covers: the principles of auditing (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach); the management of an audit program (establishing objectives, scope, risk-based scheduling, auditor competence, program monitoring and review); the conduct of individual audits (planning, execution, evidence collection, audit conclusions, closing meeting, audit report); and the competence and evaluation of auditors (knowledge, skills, personal attributes, and the processes for evaluating and maintaining auditor competence). ISO 19011 is a guidance standard, not a requirements standard: it provides recommendations for how to conduct audits and manage audit programs but does not itself impose requirements that organizations must demonstrate conformance to. It is applicable to all types of management system audits and all three audit parties. The current version (ISO 19011:2018) introduced a risk-based approach to audit planning as a significant enhancement to earlier versions.

How often should internal quality audits be conducted?

ISO 9001 requires that the organization conducts internal audits at planned intervals but does not specify a minimum frequency. The organization must define its own audit cycle based on the importance of the processes involved, changes affecting the organization, and the results of previous audits. In practice, most organizations complete a full audit cycle (covering all processes and all clauses of the applicable standard) within one to three years. High-risk processes, processes that have generated recent nonconformances, and processes that have undergone significant changes should be audited more frequently than stable, well-performing processes. IATF 16949, the automotive quality management standard, is more prescriptive: it requires a minimum of one complete system audit, one manufacturing process audit, and one product audit per audit cycle, with the manufacturing process audit scope covering all manufacturing processes over the cycle. Many automotive suppliers conduct monthly or quarterly process audits of critical manufacturing lines to provide more frequent surveillance of process conformance.

What qualifications does an internal auditor need?

ISO 19011 defines the generic competencies required of management system auditors, but does not specify a minimum qualification. Most organizations define their own internal auditor qualification requirements in their quality management system procedures. Typical requirements include: completion of an internal auditor training course covering the applicable quality management standard (ISO 9001, IATF 16949, or other), audit methodology, and evidence collection techniques; a defined number of audit hours as an observer or co-auditor under a qualified lead auditor before conducting independent audits; and technical knowledge of the processes and products being audited sufficient to evaluate whether documented controls are adequate and effectively implemented. For IATF 16949, the standard specifies that internal auditors must be competent to audit the Core Tools (APQP, PPAP, FMEA, SPC, MSA, and CP) and must understand the automotive sector’s Customer Specific Requirements. Organizations may also choose to train internal auditors to Lead Auditor level using IRCA-registered training courses, which provide a more rigorous curriculum and result in a formal certification upon passing an examination.

What is the purpose of the audit opening and closing meetings?

The opening meeting formally initiates the audit and establishes the context and ground rules before evidence collection begins. The lead auditor uses the opening meeting to: introduce the audit team and confirm their roles; confirm the audit objective, scope, criteria, and schedule with auditee management; explain the audit process including how evidence will be collected, how findings will be documented, and how nonconformances will be classified; identify the auditee guides who will accompany auditors during evidence collection; and invite the auditee to raise any concerns or constraints. The opening meeting also provides a courtesy signal that the audit has formally begun. The closing meeting is the point at which the audit team presents its findings to the auditee’s management before leaving the site. The closing meeting should be attended by all auditors and by senior management of the auditee. The lead auditor summarizes the audit scope and methods, presents each finding with its supporting evidence, clarifies any questions about the basis for findings, and explains the corrective action response process and timeline. Findings should not be negotiated at the closing meeting: if the auditee disagrees with a finding, the process for formal disagreement should be explained, but findings should not be withdrawn based on verbal argument alone.