Your 2027 internal audit of 7.1.5: a sampling plan the transition auditor would recognise

It is October and you are writing next year’s internal audit programme. The row for clause 7.1.5 reads the same as last year: "Sample calibration records — verify in date." Last year’s internal auditor opened the calibration spreadsheet, chose ten instruments, found ten certificates in date, and wrote "no findings". Three months later the certification body auditor walked over to a lathe, opened a drawer and picked up a thread plug gauge that wasn’t in the register at all.

Both audits sampled 7.1.5. Only one of them tested it. What separated them wasn’t the sample size. It was which way the auditor traced. This article sets out a sampling plan for a 7.1.5 internal audit that holds up when the transition auditor arrives, and works through an example you can adapt to your own plant.

What is verified about the transition, and what is not

ISO 9001:2026 was published on 16 September 2026 as the sixth edition. Global Accreditation Cooperation (Global ACI) took over from the IAF on 1 January 2026, and its transition requirements give a three-year window: certificates to the 2015 edition stop being valid after 30 September 2029. Accreditation bodies are expected to be ready by 31 March 2027, and no new 2015 certificates are issued after 31 March 2028. You can run the transition audit together with a surveillance or recertification audit, or as a separate audit. Either way it has to review the changed requirements.

Clause 7.1.5 does not appear on Global ACI’s summary of key changes, and Global ACI describes the overall change as minimal. Some consultancy pages still repeat claims about 7.1.5 that come from the 2025 draft (DIS), such as new software-validation wording. We have not checked those claims against the published clause text. Read your own copy of the standard and confirm with your certification body before you rewrite any procedure. If you are under IATF 16949 or AS9100, the sector standards are also being revised, so confirm those dates with IATF, IAQG or your CB.

For audit planning, this is the conclusion that matters: 7.1.5 probably hasn’t changed much, and it will be sampled regardless. For most organisations, the 2027 internal audit is the last full look at measuring resources before the transition auditor takes one.

Why sampling from the register proves so little

Pull ten records from your own calibration register and you are only testing the instruments you already control. You will confirm that the instruments you know about have certificates. Measuring-equipment findings rarely come from there. The repeat findings in auditor write-ups and practitioner forums are:

• overdue instruments still in use, with nothing that enforces recall;
• out-of-tolerance results with no assessment of product already measured (7.1.5.2 requires you to determine whether earlier results were adversely affected);
• circular traceability, where two instruments are used to calibrate each other and the chain never reaches a national standard;
• "reference only" instruments being used for accept/reject decisions;
• equipment that was moved and never re-verified.

None of these shows up when you go from register to certificate. They only show up when you start somewhere else.

Trace in four directions

ISO 9001 clause 9.2.2 requires an audit programme that takes into account the importance of the processes, changes affecting the organisation, and the results of previous audits. ISO 19011 accepts both judgement-based and statistical sampling. For 7.1.5, judgement-based stratified sampling is the better fit, because the failures cluster: they sit on the shop floor, in reference standards and in recent OOT events, not spread evenly across the register. Split your sample across four directions:

1. Floor to register. Start where the instrument is used: drawers, machine-side holders, personal toolboxes. Is it registered, identified, in date, and is its status visible to the user? This is the only direction that finds unregistered gauges.
2. Register to floor. Start from the record. Is the instrument physically where the record says it is, and in the state the record says? This finds instruments that were lost, lent out or moved.
3. Product to instrument. Start from a released inspection record or a product characteristic. Which instrument made the measurement, and was it in calibration on that date? If it later failed, was the impact assessed? This is the direction that tests 7.1.5.2.
4. Instrument to reference. Start from a working gauge’s certificate and go up the chain: the reference standard used, its own certificate, and the national or international standard behind that. This finds circular traceability and gaps in supplier competence.

Worked example: a plant with 640 instruments

The figures below are an example, not a norm. Change the strata and counts to fit your own risk.

| Stratum | Population | Sample | Direction | What you are looking for |
|—|—|—|—|—|
| Reference standards (gauge blocks, setting rings, master weights) | 18 | 6 | Instrument to reference | Unbroken chain, accredited supplier scope, no circularity |
| Instruments used for product release or special characteristics | 140 | 8 | Product to instrument | Status on the measurement date, OOT impact recorded |
| General shop-floor gauges | 420 | 8 | Floor to register | Registered, identified, in date, status visible |
| Instruments with an OOT result in the last 12 months | 14 | 4 | Product to instrument | Impact assessment, affected lots, actions closed |
| Relocated, returned from loan or recently allocated | 30 | 3 | Register to floor | Re-verification after the move, possession history |
| "Reference only" or indication-only instruments | 18 | 3 | Floor to register | Justification on record, never used for acceptance |

That gives 32 traces. One competent auditor with good records access can finish them in about a day, and each trace tests something a register-only sample cannot.

One trace, end to end

Take a thread plug gauge from the drawer at a lathe cell (floor to register). Its ID matches a register entry. The record shows a pass, with as-found and as-left values on a certificate issued ten months ago against a 12-month interval. Fine so far. Then look at its possession history: it was booked out of the gauge crib to this cell eight months ago, and the cell has changed location since then. Was it verified after the move? If yes, you have the record. If not, you have a finding, and you also have a reason to check the other gauges that went with it.

The objection: "Our CB auditor only looks at five instruments"

That is probably true, and it argues for a bigger internal sample, not a smaller one. The external auditor picks five because the time is limited and the audit is designed to find system failures from a small sample. Your internal audit exists so that those five turn up nothing new. If your internal sample only travels the register-to-certificate path, the CB auditor’s first walk to a machine is the first time anyone has tested floor to register.

The second objection is that statistical sampling would be more defensible. For large, homogeneous populations, perhaps. But 7.1.5 risk isn’t homogeneous. Six reference standards carry the traceability of hundreds of working gauges. A judgement-based sample with a documented rationale, as ISO 19011 allows, is easier to defend than a random sample that happened to miss the masters.

What the plan needs from your records

The four directions only fit into one day if the records can answer these questions quickly:

• [ ] Every instrument has a unique ID, a location and an owner or holder
• [ ] Calibration status as of a past date, not only today
• [ ] As-found and as-left results, with the certificate attached
• [ ] Reference standards linked to the working instruments they calibrate
• [ ] OOT events linked to an impact assessment and the affected product
• [ ] Possession and location history, including moves and loans
• [ ] Justification recorded for every "reference only" designation

If answering any of these means opening three spreadsheets and a binder, budget for that time in the audit programme. Or fix it before the audit and record the fix as an improvement.

Where PrüfDesk fits, and where it doesn’t

PrüfDesk manages the calibration records layer. It holds the instrument register, calculates due dates automatically, stores pass/fail records with as-found/as-left values and certificates, provides reusable procedure templates that you can override per unit, applies configurable overdue blocking (hard block or soft warning), keeps a full check-out and possession audit trail, and exports audit-ready PDF reports. That covers most of the checklist above, so the register-to-floor and floor-to-register traces become lookups rather than archaeology. Plans are priced by instrument volume with unlimited users: Starter €49/month (250 assets), Professional €129/month (1,000 assets), Enterprise €299/month (unlimited).

It is not a QMS. It won’t write your audit programme, it won’t perform the impact assessment for you, and it doesn’t certify anyone. The judgement in the sampling plan stays with your auditors.

If you are planning your 2027 programme and want to see how your 7.1.5 records would support a four-direction trace, talk to us about your 7.1.5 evidence.