ISO 9001 Internal Audit Checklist: A Practical Guide

An internal audit checks the quality management system against ISO 9001:2015 before a certification body assesses it. Source: UniCert

Editorial note: UniCert is UAF-accredited for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation. See our accreditation for scope details.

An ISO 9001 internal audit checklist turns the "shall" requirements of ISO 9001:2015 into questions you can ask process by process, so you can confirm the quality management system is working before a certification body arrives to assess it for ISO 9001 certification in the UK. This guide gives you a working checklist for clauses 4 to 10, with example questions and the evidence to sample for each, then covers how to build the programme, how to grade findings, and the mistakes that cost organisations time. Where quality runs alongside environmental and health and safety systems, the same programme structure supports integrated management system certification.

Internal auditing is a requirement, not a nice-to-have. ISO 9001:2015 Clause 9.2 requires organisations to carry out internal audits at planned intervals under a documented, risk-based programme [1]. Treat it as a box-ticking exercise and you invite a certification finding.

What an ISO 9001 internal audit checklist is, and what Clause 9.2 requires

An internal audit checklist is a structured list of questions that verifies the management system is implemented and maintained. Each line takes a single ISO 9001:2015 requirement, rephrases it as a question, and gives the auditor a field to record the finding and a note of the evidence examined. These checklists are often long, and some run to a hundred or more questions. The version below is a shorter working set you can expand, and UniCert also publishes an internal audit checklist template built on the same structure.

Clause 9.2 sets out what the programme has to achieve [1]. Organisations must conduct internal audits at planned intervals to check that the QMS conforms to both the standard and the organisation's own requirements, and that it is effectively implemented and maintained. The clause requires a documented, risk-based audit programme, the selection of competent auditors, and audits run so that objectivity and impartiality are protected, which means auditors do not audit their own work. Results must be reported to relevant management, and the organisation must make corrections and take corrective action without undue delay [1]. ISO 19011 provides the supporting detail on how to design and run the programme [2].

How to build the internal audit programme

Build the programme around risk, then fix the schedule. ISO 9001 sets no minimum frequency, so most organisations audit every process at least once a year and audit higher-risk, higher-complaint or recently changed processes more often [1]. Weight both frequency and depth using past audit findings, customer complaints, process performance data, and any significant change to people, systems or products. ISO 19011 describes this risk-based approach to programme design [2].

Record auditor competence. Auditors need working knowledge of ISO 9001:2015 and of auditing technique, and ISO 19011 sets out the competence a programme should expect its auditors to hold [2]. Keep the evidence: training certificates, mentoring records, or a competence matrix. Structured ISO 9001 internal auditor training is one way to build and demonstrate it.

Protect independence. Because Clause 9.2 requires objectivity, an auditor cannot audit an area they manage or work in [1]. In a small company this usually means cross-auditing, for example the office manager audits production controls while a production supervisor audits document control, or engaging an external auditor for the areas no one internal can cover impartially.

Keep the programme running all year. Certification bodies sample your internal audit programme at every surveillance visit under ISO/IEC 17021-1 [3], and surveillance audit time is set at roughly one third of the initial certification audit under IAF MD 5 [4]. A programme that only wakes up before an external audit will show gaps. An audit reminder tool helps keep the programme running to schedule, and this continuity is what links your internal audit cycle to preparing for a surveillance audit.

When UniCert auditors review an internal audit programme at Stage 2, they check three things in particular: that it is genuinely risk-based, that it has been followed to the planned schedule, and that each auditor was independent of the area they audited.

The internal audit cycle runs continuously through the year, not only in the weeks before an external audit. Source: UniCert

The ISO 9001 internal audit checklist, clause by clause

Use the following as the core of your checklist. For each clause there are example audit questions and the evidence to sample. Ask open questions, follow the evidence where it leads, and record what you actually saw, including document references, not just a tick.

Clause 4: Context of the organisation

Check that the organisation has defined what the QMS covers and why.

Example audit questions:

• How were the external and internal issues relevant to the QMS determined, and when were they last reviewed?
• Who are the relevant interested parties, and which of their requirements does the QMS address?
• What is the documented scope, does it match what the organisation actually does, and are any exclusions justified?
• How have the QMS processes been identified, sequenced and measured?

Evidence to sample: issues register with review dates; interested parties register; scope statement; process map, turtle diagrams or process KPI records.

Clause 5: Leadership

Test whether top management is actively running the QMS rather than delegating it wholesale.

Example audit questions:

• How does top management show involvement, for example through resourcing decisions, objectives and management review?
• Is there a quality policy that fits the organisation, and can staff explain what it means for their work?
• How are roles, responsibilities and authorities assigned and communicated?
• How are customer, statutory and regulatory requirements determined and kept in focus?

Evidence to sample: management review minutes; the quality policy and how it is communicated; organisation chart and role descriptions; customer requirement reviews and complaint trends.

Clause 6: Planning

Check that risks, opportunities and quality objectives are a live part of planning, not a document written once.

Example audit questions:

• How were risks and opportunities for the QMS identified, and what actions were planned in response?
• How is the effectiveness of those actions evaluated?
• What are the quality objectives, are they measurable, who owns each, and how is progress tracked?
• When a process changes, how is the change planned and controlled?

Evidence to sample: risk and opportunity actions with status; quality objectives with targets, current performance and action plans; change records.

Clause 7: Support

This is the largest clause to audit. It covers resources, people, infrastructure, monitoring and measuring equipment, organisational knowledge, awareness and documented information.

Example audit questions:

• How is competence determined for roles that affect quality performance, and how are gaps closed?
• How is monitoring and measuring equipment identified, calibrated and protected from damage?
• How is organisational knowledge captured and retained, for example when experienced staff leave?
• How is documented information controlled for version, approval, distribution and retention?
• Can staff describe the quality policy and how their work contributes to it?

Evidence to sample: competence matrix and training records; calibration certificates and schedule; document control list and obsolete document handling; staff interviews.

Clause 8: Operation

Follow the actual delivery of the product or service, from enquiry through to delivery and any post-delivery support.

Example audit questions:

• How are customer requirements reviewed before the organisation commits to an order?
• Where there is design and development, how is it planned, reviewed, verified, validated and changed?
• How are external providers selected, evaluated and re-evaluated, and how is purchased product verified?
• How is production or service provision controlled, including identification and traceability?
• How is nonconforming output identified, contained and dispositioned?

Evidence to sample: contract or order reviews; design records including verification and validation; approved supplier list and supplier performance data; work instructions, batch or job records, traceability records; nonconformance reports and concessions.

Clause 9: Performance evaluation

Check that the organisation measures the right things, audits itself, and reviews the system at management level. This clause is also where the auditor examines the internal audit programme itself.

Example audit questions:

• What is monitored and measured, how often, and how are the results analysed and used?
• How is customer satisfaction tracked, and what is done with the findings?
• Is the internal audit programme documented, risk-based and being followed to schedule?
• Are internal auditors competent and independent of the areas they audit?
• Does management review cover the required inputs, and do the outputs turn into assigned actions?

Evidence to sample: performance data and trend analysis; customer satisfaction records; audit programme, audit reports and auditor competence records; management review inputs and minutes with actions and owners.

Clause 10: Improvement

Test whether nonconformities lead to real corrective action and whether the system improves over time.

Example audit questions:

• When a nonconformity occurs, how is the immediate correction recorded?
• How is root cause established, and how do you check whether the same cause exists elsewhere?
• How is the effectiveness of corrective action verified before the action is closed?
• What evidence is there of continual improvement, for example tighter objectives, less waste, simpler processes?

Evidence to sample: corrective action log with dates, root cause and verification; analysis of repeat nonconformities; improvement projects with before and after measures.

A thorough internal audit across these clauses should surface the nonconformities certification auditors raise most often while you still have time to fix them.

Process-based auditing: an alternative to the clause-by-clause approach

Instead of walking down the standard, follow a whole process from start to finish and pick up the clauses as they appear. An order-fulfilment audit, for example, might move from enquiry (Clause 8.2) to planning and resourcing (Clauses 6 and 7), through production controls and traceability (Clause 8.5), to measurement, nonconformity and corrective action (Clauses 9 and 10), all in one thread of evidence. ISO 19011 treats this process approach as the default auditing technique [2], and our guide to the ISO 19011 auditing guidelines works through it in more detail.

A turtle diagram helps structure this. Define the process inputs and outputs, then ask what equipment is used, who does the work and how their competence is assured, which procedures apply, and which metrics show the process is performing.

The advantage is realism. Audits that only compare documents to the standard, without watching how the process runs day to day, miss the evidence ISO 19011 expects an auditor to gather [2]. Process-based auditing tends to expose handover failures and gaps between the written system and actual practice.

Many teams combine the two. They do process-based fieldwork, then use a clause checklist as a coverage map to confirm every requirement has been audited somewhere across the annual programme.

How to record findings and route corrective actions

Grade every finding with the same simple scale so trends are comparable:

• Conformity: the requirement is met and you have seen the evidence.
• Opportunity for improvement: the requirement is met, but the approach could be more robust. No corrective action is required.
• Minor nonconformity: an isolated lapse against a requirement.
• Major nonconformity: a requirement not addressed at all, a process that has broken down, or several minor nonconformities against the same requirement.

This mirrors the grading certification auditors apply under ISO/IEC 17021-1, so using it internally prepares your team for external findings [3]. It also feeds directly into how you prepare for an ISO 9001 audit.

Route each nonconformity through a controlled process: record the immediate correction, establish and record the root cause, define corrective action with an owner and a target date, then verify that the action worked before closing it. Clause 9.2 requires that corrections and corrective actions happen without undue delay, and that audit results are reported to relevant management [1]. Report minor findings through management review and escalate majors straight away.

Common internal audit mistakes

These are the internal audit weaknesses UniCert auditors raise most often at certification.

• Auditing only in the weeks before the certification or surveillance audit, so the programme has obvious gaps for the rest of the year.
• Comparing documents to the standard without observing the process, interviewing operators, or sampling live records, which falls short of the evidence-based approach ISO 19011 sets out [2].
• A programme that is not risk-based, or that is documented but not followed to schedule.
• Auditors reviewing their own work, which removes the objectivity Clause 9.2 requires [1].
• Findings closed with "operator retrained" and no root cause analysis, so the same issue returns.
• Not reporting results to management, so audit findings never influence decisions or resourcing.
• Using the checklist as a script of closed questions, which produces ticks rather than evidence.

Practical summary of the key steps covered in this guide. Source: UniCert

Frequently asked questions

How often should we run ISO 9001 internal audits?

ISO 9001:2015 says "planned intervals" and sets no fixed frequency [1]. A common approach is to audit every process at least once a year, with more frequent audits for processes that are higher risk, attract more complaints, or have recently changed. Spread the audits across the year rather than running them all at once.

Who can be an internal auditor?

Anyone competent in ISO 9001:2015 and in auditing technique, provided they are independent of the area under audit. Competence usually comes from internal auditor training plus practice alongside an experienced auditor. Keep records of that competence, because certification auditors will ask for them.

Do we have to audit every clause every year?

Every requirement of the standard should be covered across the audit programme, but not necessarily in a single audit or a single month. What matters is that, over the programme cycle, the whole QMS and all applicable clauses have been audited, with more attention where risk is higher.

What is the difference between a minor and a major nonconformity?

A minor nonconformity is an isolated slip against a requirement. A major nonconformity is a requirement that is missing entirely, a process that is not working, or a cluster of minor nonconformities against the same requirement that together show a systemic problem [3]. Majors usually need to be cleared before certification is granted or maintained.

Can we outsource internal audits?

Yes. Many small and medium-sized organisations use an external auditor for part or all of the programme, particularly where no one internal can audit a given area impartially. The organisation still owns the programme, the findings and the corrective actions.

Turning the checklist into a working programme

A good ISO 9001 internal audit checklist does two jobs: it makes sure every requirement of ISO 9001:2015 gets tested, and it gives auditors a consistent way to record what they found and the evidence behind it. Build the programme around risk, keep auditors independent of their own work, grade findings the way a certification body would, and drive every nonconformity to a verified root-cause fix.

Your next steps are concrete. Set a twelve-month schedule, assign each area to an auditor who does not manage it, and run the first round early enough to clear any major nonconformities before your certification or surveillance visit. Where quality sits alongside environmental and health and safety systems, align the cycle so one audit programme supports integrated management system certification.

References

1. ISO 9001:2015, Quality management systems, Requirements, Clause 9.2 Internal audit. International Organization for Standardization. https://www.iso.org/standard/62085.html
2. ISO 19011:2018, Guidelines for auditing management systems. International Organization for Standardization. https://www.iso.org/standard/70017.html
3. ISO/IEC 17021-1:2015, Conformity assessment, Requirements for bodies providing audit and certification of management systems, Part 1. International Organization for Standardization. https://www.iso.org/standard/61651.html
4. IAF MD 5:2019, Determination of Audit Time of Quality, Environmental, and Occupational Health and Safety Management Systems. International Accreditation Forum. https://iaf.nu/en/iaf-documents/
5. Advisera, "ISO 9001 Internal Audit Checklist" (secondary). Referenced only for typical checklist structure and length, not for any quantified claim. https://advisera.com/