Must internal auditors be employed by the organization?

The choice indicating that internal auditors can be external is correct because ISO 9001 allows for flexibility in how internal audits are conducted. While the standard outlines that an organization must maintain an internal audit process to evaluate the effectiveness of its Quality Management System, it does not stipulate that these auditors must be employees of the organization.

External auditors can be used as long as they have the necessary competence and impartiality to conduct the audit. This approach can be beneficial, especially for organizations that want to leverage external expertise or maintain objectivity. Additionally, utilizing external auditors may help in bringing in fresh perspectives, thus leading to more effective audits and improvements in the management system.

This flexibility is significant in enabling organizations to choose the best resources for their needs without being constrained to only in-house personnel.