Choose the transaction because it matters
Consider a clearly illustrative Sharjah engineering-service example: an urgent customer request includes a subcontracted activity, and the first issued report later needs correction. The internal auditor selects that job because it combines time pressure, an external provider, changed information and a customer-facing correction. It is an example for learning—not a reported LETA client case or a claim about measured results.
Select samples because they can illuminate the system. Recent change, complaints, supplier issues, recurring NCRs and significant risk are stronger reasons than choosing the easiest completed file. One transaction cannot prove that every similar job works, but it can reveal a handover, control or evidence question that justifies widening the sample.
Trace six decision points
1. Enquiry and clarification: What did the customer ask for, which acceptance criteria were clarified, who approved the promise and how did later changes reach the people doing the work? Compare the quotation, correspondence, contract review and current job instructions.
2. Planning: How were competence, resources, equipment and timing decided for the urgent work? Ask the planner to show how availability and suitability were checked, then ask an employee to demonstrate the actual preparation rather than only describing the procedure.
3. Purchasing: What requirements reached the subcontractor, and were the current technical and acceptance requirements used? Trace the approved supplier decision, purchase information, change communication and received evidence back to the customer promise.
4. Delivery and verification: What work was completed, what was checked, which equipment or method supported the result and what evidence shows that the output met the applicable criteria before it moved forward?
5. Authorised release and customer response: Who had authority to release the report, what did that person review, which version reached the customer and how was the customer's response captured? A system status marked ‘approved’ is a lead to evidence, not the evidence by itself.
6. NCR and effectiveness: When the report was corrected, how was the affected output contained, how was the cause evaluated, what correction and corrective action were taken, and what later evidence showed whether recurrence was prevented? A closed action with no follow-up sample should prompt an effectiveness question.
Use three evidence views
Begin with the process owner's explanation of how the transaction should move and where decisions occur. Then ask an employee to demonstrate how the work is actually performed at one or more handovers. Finally, follow a coherent trail of records across sales, planning, purchasing, operations, verification, release, customer communication and the NCR. Agreement strengthens the audit trail; differences are audit leads, not automatic findings.
For digital evidence, test what sits behind the screen. Who can change the workflow status? Which document, criteria or transaction version does the status represent? Does the underlying quotation, purchase order, inspection record, release and customer communication support it? A timestamp or approval icon can be useful, but only when its permissions, meaning and connection to the actual transaction are understood.
Write findings around process effect
A useful finding identifies the applicable criterion, the objective evidence and the gap between them. It then makes the process effect understandable without exaggerating it. In this illustrative transaction, the customer updates an acceptance criterion after order confirmation. Sales records the change, but the current requirement does not reach purchasing, so the subcontract purchase order still carries the earlier criterion. The evidence can be stated precisely and linked to the handover risk; the auditor should not invent a wider failure that the sample has not established.
This transaction trace is LETA's practical internal-audit method, not a mandatory ISO form, a substitute for an audit programme or copied clause text. Use the organisation's controls and the applicable requirements from an authorised copy of ISO 9001:2026 as audit criteria. ISO 19011:2026 provides management-system audit guidance and does not itself provide certification. The ISO 9001 Auditing Practices Group process paper is useful background guidance that predates ISO 9001:2026; it is not 2026 transition criteria.
LETA Advisory supports organisations with internal audit consultancy, practical sampling and corrective-action follow-up. An independent certification body conducts the certification audit and makes certification decisions.