I start by checking if they have an annual audit program. If the program is approved and is being followed. I pick two internal audits and ask to see the audit reports. After checking the name of the auditors, I ask to see evidence that they comply with the organization’s requirements for competence. If there were non-conformities raised I ask to see if they were treated and properly closed. If there is an internal audit procedure I can check if the right forms were used and if records are correctly kept.