Must internal auditors be employed by the organization?

The correct response is that internal auditors can be external. This understanding aligns with the ISO 9001 standard, which specifies that the organization must ensure that audits are carried out impartially and objectively, essential characteristics of effective auditing.

Organizations have the flexibility to choose whether to use internal auditors, who are employees and members of the organization, or external auditors, who are independent and not affiliated with the organization. External auditors can bring a fresh perspective and may offer expertise that the organization lacks internally. This choice allows organizations to select auditors based on the specific needs of the audit and the particular circumstances of the organization.

The other choices suggest limitations that do not reflect the full range of options available under ISO 9001 regarding auditor selection. Therefore, the standard promotes flexibility in determining the most suitable approach to achieving effective quality management system audits.