Internal Quality Audits in Garment Factories with Evidence Based Sampling

Give the internal audit a question worth answering

A factory can complete every audit on its calendar and still learn very little. That happens when auditors visit the same desk, read the same files, and tick the same boxes. The report confirms that an audit took place. It may reveal little about how the quality system works under pressure.

An internal quality audit should test a clear question. Can staff control a changed specification on every shift? Do release decisions use the required evidence? Does a recent process change work outside the trial line? The question guides the records, people, and events that the auditor needs to examine.

This guide focuses on a factory's ongoing internal audit programme. It shows how to choose risks and assign fair auditors. It then explains evidence samples and findings that others can check. All factory cases, record counts, and risk scores below are hypothetical.

Separate the programme from one audit visit

The programme covers a period of work across the quality system. It sets priorities, resources, coverage, and follow-up. An audit plan describes one event within that programme. It names the objective, scope, criteria, team, timing, and intended evidence.

ASQ's audit guidance distinguishes process, product, and system audits. Choose the form that fits the question. A review of revised work instructions will cross several teams. Each team controls part of the change. A check on one defined process may have a much narrower boundary.

Do not let the word “audit” blur different decisions. An internal process audit does not release a shipment. A final inspection does not assess the whole quality system. ApparelDiary's quality assurance and quality control guide explains how these responsibilities connect.

Establish the criteria and their versions

Audit criteria are the requirements used to judge the evidence. They may come from the factory's own rules or a customer agreement. Laws and adopted system standards can also set requirements. List the actual documents and versions before fieldwork starts.

As checked in October 2026, ISO lists ISO 19011:2026 as its current guidance for auditing management systems. It covers how to plan and conduct audits. It also addresses the skills auditors need. ISO also lists ISO 9001:2026 as the current quality management system requirements standard.

The edition used in an audit depends on its agreed basis. Transition rules may also apply. A new edition has a publication date. That date alone does not settle the terms of a contract or certificate. Record that basis and resolve doubts before raising a finding.

Use guidance with care. The ISO 9001 Auditing Practices Group states that its papers offer guidance for learning. They do not set mandatory audit criteria. Several papers cited here were written for earlier editions. Their useful ideas must not be presented as new clauses in the 2026 standards.

Build priorities from process risk

Start with the processes that affect whether products meet requirements. Include the evidence used to release work. Consider changes, past failures, and customer complaints. Review outside work and the strength of routine checks too. Include support processes when their failures could damage the result.

An original planning worksheet can use three questions:

Give each question a score from one to three if that helps the team discuss priority. For example, a revised instruction system might score 3 + 3 + 2 = 8. A stable document archive might score 1 + 1 + 1 = 3. These are local planning scores, not measured probabilities or ISO rules.

Do not let a low total cancel a serious concern. One issue with severe effects may justify an early audit. Clean recent records may not remove that need. Write the reason for the decision beside the score.

The APG paper on internal audits discusses critical processes and change. It also covers skills and the risks in audit sampling. Use those ideas to direct attention where a failed control would matter.

Choose frequency and timing deliberately

A programme needs broad coverage. Yet departments rarely carry equal risk or need equal audit time. Give a changing process more attention until evidence shows that it has settled. A stable process may need fewer visits. First check that the programme's basis and applicable rules allow this.

Keep a coverage map. Show the processes, shifts, sites, and relevant requirements already examined. Record the planned date for those not yet covered. Explain the risk basis for the schedule. Do not use it as a reason to ignore an awkward area for years.

Time the audit to see the work. A setup control is best examined during a real setup. A weekend release process needs evidence from weekends. Visit when the usual manager is absent too, where relevant. The control must also work in those conditions.

The APG audit planning paper discusses process links and changes in audit priorities. Its certification context does not dictate a factory's internal timetable. The practical lesson is to plan around the work and its risks.

Protect independence without losing technical skill

Assign auditors who can judge the work fairly and understand what matters. Someone may know sewing very well yet struggle to test a software approval trail. Another person may be skilled at records but miss a crucial setup condition.

Use a small team when one person cannot cover both needs. A lead auditor can guide the evidence review. A technical expert can explain the process. Keep the expert's role clear if they helped design the control under review.

Avoid asking an auditor to judge their own recent decisions. In a small factory, rotate staff across suitable areas. Or bring in a skilled, independent person for that scope. State any conflict and how the programme manager resolved it.

Check competence through observed work. Watch how the auditor asks questions and chooses the criterion. Check their evidence trail and the conclusion they draw. Course attendance alone does not prove those skills.

Budget time for the full audit task

The calendar entry should allow more than the floor visit. Allow time to study the criteria and select records. Auditors must also compare evidence, write the report, and review the response. If those tasks are invisible, the programme can appear affordable while relying on rushed work.

Consider an illustrative audit. Allow two hours to prepare and four for fieldwork. Analysis and reporting need two hours; follow-up needs one. It needs nine auditor-hours. A technical expert joins for two fieldwork hours. Total staff effort then becomes eleven hours. Calendar duration and staff effort are different measures.

Use that estimate to protect the important work. If only six staff-hours are available, narrow the objective or change the timing. Do not keep a broad scope on the cover page while silently removing the evidence needed to support it.

Test a digital record set before relying on it

When the sampling frame comes from software, save the report filters and extraction time. Check its date field. The approval, issue, and last edit can have different dates. Each can place the same change in a different week.

Compare the extracted count with the source system using the same boundary. Investigate duplicate identifiers and gaps in expected sequences where they matter. Do not assume that a spreadsheet containing 480 rows represents 480 distinct events.

Use a read-only view when possible. Keep the chosen record identifiers in the workpapers. A record may change after selection. Keep evidence of the version examined and explain the later change. Others should be able to repeat the audit trail. Keep the working file clearly separate from the factory's master records.

For remote observations, state what the view could not show. A camera may show only one workstation. That view cannot establish conditions across a whole line. Poor visibility or missing system access limits the evidence. Record that limit and plan a suitable follow-up.

Create a sampling frame before choosing records

A sampling frame is the list or other defined set from which items will be selected. If the list is incomplete, a neat random sample can still miss important work. Ask where the list came from and reconcile it to the period and process in scope.

Suppose the audit covers specification changes issued over eight weeks. The system shows 480 change records. Check what the set includes. Look for cancelled changes, urgent manual changes, and changes made while the system was offline. Decide which belong in the population before drawing the sample.

Define the sampling unit. It may be one change event, one release decision, or one job setup. It is not always one file. One event may need several records. These can include the request, approval, issue record, and workstation evidence.

Record four things in the plan: the population, period, unit, and selection method. This lets a reviewer understand what the sample could reveal and what it left outside the audit.

Match selection to the audit question

Different selection methods answer different questions. Use them openly rather than treating every small sample as representative.

For the 480-change example, the auditor might select 12 routine changes across three shifts. They may also choose six urgent changes and two system outages on purpose. Keep two parts of the sample distinct. One uses random or group-based selection; the other targets known risks.

If four of those 20 selected events have a gap, report four observed cases. Do not claim that 20% of all changes fail. The sample gives urgent cases extra weight by design. The count alone does not correct that bias.

Understand what sample size can and cannot prove

Larger samples can improve the chance of seeing a common problem. They cannot fix a poor selection method or the wrong test. Reading 100 daytime records will still tell little about an unrecorded night-shift workaround.

An elementary probability example helps show the limit. Assume records are selected independently. Each has the same 10% chance of containing a defined gap. Under that model, take 30 records. The chance of seeing at least one gap is:

1 − (1 − 0.10)^30 = 95.76%.

This is a teaching calculation, not a rule that every audit needs 30 records. It assumes independent selections and a stated underlying rate. Sampling without replacement from a small finite set needs a different calculation. Linked records from one incident may also violate independence.

Zero findings in a sample do not prove that the whole process is free of failures. A report should state the tested boundary and evidence limit. Management may need a formal estimate or statistical decision. Design that study before collecting data. Use a person with the needed statistical skills.

Follow evidence across the handoffs

An audit trail should test what happens between steps. Start with one approved specification change. Follow its issue to the line and removal of the old version. Check the staff briefing. Then examine the first work completed under the change.

Then reverse the direction. Select a workstation instruction and trace it back to the approved master. The two directions can reveal different gaps. One tests whether an issued change reached the floor. The other tests whether the floor has a valid source.

Use the detailed method in standard work change control as a process reference. Check that it fits the factory's own rules. The audit judges the adopted requirements and evidence, not whether staff copied an online procedure.

Avoid building the entire conclusion from a supervisor's explanation. Combine relevant records, observation, and statements that can be checked. The APG evidence collection paper stresses verifiable evidence and the limits of sampling. It also warns about missing evidence. Failure to find it does not always prove a breach.

Ask neutral questions and record precise answers

Begin with the task: “Show how you know this is the current version.” Let the person demonstrate the normal method. Follow with questions about exceptions, changes, and what happens when information is missing.

Avoid leading questions such as “You always check the version, don't you?” They invite agreement rather than evidence. Also avoid testing memory when staff are meant to use a controlled reference. Knowing where to find the correct instruction may be the relevant skill.

Take notes that another auditor can follow. Include the record identifier, date, location, requirement, and observed result. Keep personal details only when needed for the audit purpose. Store working notes under the factory's access and retention rules.

Give the person a chance to correct a factual misunderstanding. A record may sit in a linked system or use a code the auditor has not seen. Confirm the explanation against the evidence before deciding whether a finding exists.

Extend the sample for a reason

If a sampled record shows a gap, ask what it suggests about the boundary. Was the event isolated to one system outage, one shift, or one type of change? Select further evidence to test that question.

Record why the sample expanded and how the additional items were chosen. Keep the initial result visible. Do not quietly discard awkward cases or replace them with easier records.

For example, two failed change issues may both occur during a three-day outage. The auditor could examine all changes during that outage. Then select later changes to test whether the normal route resumed. This is a targeted extension. It does not turn the whole combined set into a simple random sample.

Set stopping rules that fit the purpose. The audit may already have enough evidence to establish a control gap. The process owner may then need to contain its effects. The auditor can report a finding once the evidence supports it. They need not inspect every affected item first.

Write a finding in three connected parts

A useful nonconformity states the requirement and evidence. It then explains the gap between them. The APG paper on documenting nonconformity describes these elements. Describe the evidence. Avoid judgments about a person's attitude.

Here is an original example based on a hypothetical internal rule:

The wording identifies the actual control failure. It does not claim that every line used the wrong instruction. It also leaves the cause open for investigation.

If the only issue is an auditor's preferred layout, there may be no breach. Record a helpful suggestion separately if useful. Record a confirmed breach as a finding. Do not call it a suggestion just to avoid disagreement.

Distinguish missing records from missing controls

First ask whether the applicable requirement demands the record. If it does, its absence may be evidence of a failure to retain required information. State that failure precisely.

If the rule does not require a particular form, look for other valid evidence. A system log, observed demonstration, or linked record may support the decision. The auditor should not invent a paperwork requirement during the visit.

Also test the opposite risk. A complete form may not prove that the control happened. Compare timing, content, and actual practice where relevant. Ten identical approval times may justify further checks. So may a signature entered after release. They are clues, not automatic proof of misconduct.

Keep the distinction clear in the report. One possible result is that no evidence was available within the audit period. Another is that the required approval did not occur. Those are different findings. Use the stronger statement only when the evidence supports it.

Report scope and limitations beside the conclusion

The report should let management understand both the result and its reach. Include the objective, scope, criteria, dates, team, sampled work, findings, and unresolved limits. State any cancelled observation or unavailable record set.

An illustrative conclusion could describe the sampled routine changes. These reached all three shifts reviewed. It may then identify the documented gap during system outages. That is more useful than “document control satisfactory” or “document control failed” without a boundary.

Include good practice when it helps explain why a control works. Keep praise specific. For example, describe a clear link between the approval log and workstation version. A balanced report does not require equal numbers of good and bad findings.

Give process owners the factual record promptly. Agree owners and response dates through the established system. Do not let a debate over wording delay action on a known product risk.

Judge follow-up by evidence of use

The process owner chooses and implements the response. The auditor later checks the agreed action. Does it address the finding? Does it work in the relevant conditions? Where practicable, assign that check to an independent person. They should not have carried out the change.

For the outage case, a new form alone is weak closure evidence. Examine a later outage or a suitable controlled exercise. Check that staff used the fallback route and obtained valid approvals. Check that records entered the normal system afterwards.

Set a review date that allows the control to be tested. If the event has not occurred, show the action's status honestly. “Implemented, awaiting effectiveness check” can be more accurate than “closed.”

Track recurring findings by process and control weakness, not just by report number. The same issue can reappear under different wording. That pattern should influence the next programme review.

Check whether the audit programme itself works

Completion rate is useful, but it measures schedule delivery. Add measures that show coverage, quality of evidence, and response. Review any high-risk areas missed and overdue follow-ups. Look for repeat findings and reports returned for weak evidence.

For example, nine completed audits out of ten planned gives 90% completion. If the missed audit covers the new release system, that percentage hides a material gap. Report the missed scope and its risk beside the number.

Periodically review a sample of closed findings. Can another person trace the criterion, evidence, action, and later check? If not, improve the audit method or training. Do not set a target number of findings. That can reward trivial issues and discourage fair judgments.

Frequently asked questions

Must every department be audited once a year?

Use the applicable requirements and the factory's justified programme. A fixed annual pattern is not a universal answer. Coverage, process risk, change, and past results should shape timing.

Can the quality manager audit production?

That depends on competence, responsibilities, and conflicts. Review whether the manager is judging their own decisions. A different lead or an independent reviewer may be needed for part of the scope.

Is a ten-record sample enough?

First define the objective, population, and selection method. Consider the effect of missing a gap. Record the reasoning. Ten targeted records can reveal a specific problem while saying little about its overall frequency.

Does a clean audit prove all orders conform?

No. An audit examines defined evidence within limited time and scope. Product release and routine controls still carry their own responsibilities.

Build an audit cycle that learns

Choose meaningful questions. Examine the work under relevant conditions, and state the sample's limits. Write findings that connect a real requirement to verifiable evidence. Then use the result to improve both the process and the next audit. That cycle gives management a view it can trust. It shows where quality controls hold and where they need attention.

References

ASQ. What is auditing?.

ISO. ISO 19011:2026, Guidelines for auditing management systems.

ISO. ISO 9001:2026, Quality management systems — Requirements.

ISO 9001 Auditing Practices Group. Guidance status and topic index.

ISO 9001 Auditing Practices Group. Internal audits, 2020.

ISO 9001 Auditing Practices Group. Audit planning, 2017.

ISO 9001 Auditing Practices Group. Evidence collection, 2016.

ISO 9001 Auditing Practices Group. Nonconformity — Documenting, 2016.