An internal audit is the single best way to find problems in your quality management system before a certification body does. Done well, it exposes gaps, confirms what works, and gives top management real data for improvement. Done badly, it becomes a paperwork exercise that no one trusts.
This guide gives you a complete ISO 9001 internal audit checklist you can use today. It covers every auditable clause from 4 to 10, tells you what evidence to look for, and explains how to record findings so they stand up in a certification audit.
What Is an ISO 9001 Internal Audit?
An internal audit is a planned, documented review of your quality management system (QMS) carried out by your own organization, or on its behalf. Its purpose is to check two things:
• Your QMS meets the requirements of ISO 9001 and your own stated requirements
• Your QMS is effectively implemented and maintained
Clause 9.2 of ISO 9001:2015 makes internal audits mandatory. You must run them at planned intervals, and you must keep documented information as evidence of the audit programme and its results.
What Clause 9.2 Requires?
Before using any checklist, be clear on what the standard asks of your audit programme. You must:
• Plan, establish, implement, and maintain an audit programme covering frequency, methods, responsibilities, planning requirements, and reporting
• Take into account the importance of the processes, changes affecting the organization, and results of previous audits
• Define the criteria and scope for each audit
• Select auditors and conduct audits so that objectivity and impartiality are ensured
• Report results to relevant management
• Take correction and corrective action without undue delay
• Retain documented information as evidence of the programme and the results
The objectivity point matters most in practice. Auditors must not audit their own work.
How to Use This Checklist?
The checklist below follows the clause structure of ISO 9001:2015. For each requirement, you will find the question to ask and the typical evidence to check.
1. Copy the tables into a spreadsheet or document, or use the PDF version
2. Add three columns on the right: Result (Conforming, Nonconformity, Observation, Opportunity for Improvement), Evidence seen, and Auditor notes
3. Tailor the questions to your processes, products, and risks
4. Sample real records and talk to the people doing the work, rather than reading procedures alone
A checklist is a prompt, not a script. Follow the evidence wherever it leads.
ISO 9001 Internal Audit Checklist by Clause
Clause 4: Context of the Organization
| Requirement | What to check | Typical evidence |
| 4.1 Understanding the organization | Are internal and external issues identified and reviewed? | SWOT or PESTLE analysis, management review inputs |
| 4.2 Interested parties | Are relevant parties and their requirements identified and monitored? | Interested parties register, review records |
| 4.3 Scope of the QMS | Is the scope documented, and are any exclusions justified? | Scope statement, exclusion rationale |
| 4.4 QMS and its processes | Are processes identified with inputs, outputs, sequence, owners, risks, and performance indicators? | Process map, process sheets, KPI records |
Clause 5: Leadership
| Requirement | What to check | Typical evidence |
| 5.1 Leadership and commitment | Does top management take accountability for QMS effectiveness and promote customer focus? | Management review minutes, resource decisions, interviews |
| 5.2 Quality policy | Is the policy documented, appropriate, communicated, and available to interested parties? | Policy document, staff interviews |
| 5.3 Roles and authorities | Are responsibilities and authorities assigned and understood? | Organization chart, job descriptions, interviews |
Clause 6: Planning
| Requirement | What to check | Typical evidence |
| 6.1 Risks and opportunities | Are risks and opportunities determined, planned for, and evaluated for effectiveness? | Risk register, action plans |
| 6.2 Quality objectives | Are objectives measurable, consistent with the policy, monitored, and updated? | Objectives list, KPI dashboards |
| 6.3 Planning of changes | Are QMS changes planned and carried out in a controlled way? | Change records, impact assessments |
Clause 7: Support
| Requirement | What to check | Typical evidence |
| 7.1 Resources | Are people, infrastructure, work environment, and organizational knowledge adequately provided? | Resource plans, maintenance records |
| 7.1.5 Monitoring and measuring resources | Is equipment calibrated or verified, with traceability maintained? | Calibration certificates, equipment register |
| 7.2 Competence | Are competence requirements defined and gaps addressed? | Competence matrix, training records |
| 7.3 Awareness | Do staff know the policy, objectives, and their contribution? | Staff interviews |
| 7.4 Communication | Is it defined what, when, with whom, and how to communicate? | Communication plan, meeting records |
| 7.5 Documented information | Is documentation controlled for identification, approval, version, and retention? | Document register, version history |
Clause 8: Operation
| Requirement | What to check | Typical evidence |
| 8.1 Operational planning and control | Are criteria set for processes and acceptance, and are outsourced processes controlled? | Process plans, control plans |
| 8.2 Customer requirements | Are requirements determined, communicated, and reviewed before commitment? | Contract and order review records |
| 8.3 Design and development | If applicable, are plans, inputs, controls, outputs, and changes managed? | Design reviews, verification, validation records |
| 8.4 External providers | Are suppliers evaluated, selected, monitored, and re-evaluated? | Approved supplier list, evaluation records |
| 8.5.1 Production and service provision | Are controlled conditions in place, including monitoring? | Production and inspection records |
| 8.5.2 Identification and traceability | Can outputs be identified and traced where required? | Batch or serial records, traceability tests |
| 8.5.3 Customer or provider property | Is property handled, protected, and reported if lost or damaged? | Property registers, incident records |
| 8.5.4 Preservation | Are outputs preserved during processing and delivery? | Storage procedures, site observation |
| 8.5.5 Post-delivery activities | Are warranty, maintenance, and feedback requirements met? | Service records, complaint logs |
| 8.5.6 Control of changes | Are production or service changes reviewed and documented? | Change records, approvals |
| 8.6 Release of products and services | Is release authorized, with evidence of conformity? | Inspection and release records |
| 8.7 Nonconforming outputs | Are nonconforming outputs identified, controlled, and corrected? | Nonconformance reports, concessions, rework records |
Clause 9: Performance Evaluation
| Requirement | What to check | Typical evidence |
| 9.1.1 Monitoring and measurement | Are what to measure, methods, and timing defined and followed? | KPI reports, data analysis |
| 9.1.2 Customer satisfaction | Is customer perception monitored and used? | Survey results, feedback analysis |
| 9.1.3 Analysis and evaluation | Is data analysed to evaluate conformity, effectiveness, and risk actions? | Trend reports |
| 9.2 Internal audit | Is there a programme, are auditors impartial, and are results actioned? | Audit programme, reports, auditor records |
| 9.3 Management review | Does the review cover all required inputs and drive decisions? | Review minutes, action tracking |
Clause 10: Improvement
| Requirement | What to check | Typical evidence |
| 10.1 General | Are improvement opportunities identified and acted on? | Improvement log, project records |
| 10.2 Nonconformity and corrective action | Is root cause determined, and is action effectiveness verified? | Corrective action reports, root cause analysis |
| 10.3 Continual improvement | Is there evidence the QMS is improving over time? | Trend data, completed actions |
Finding Template: How to Record a Nonconformity?
A clear finding has four parts. Use this structure in every audit report:
- Requirement: the clause or the organization’s own procedure that applies
- Statement of nonconformity: what is not being met, in one factual sentence
- Evidence: records, locations, dates, or interviews that support the finding
- Classification: major nonconformity, minor nonconformity, observation, or opportunity for improvement
Example:
- Requirement: ISO 9001:2015, clause 7.1.5.2
- Statement: Two of five measuring instruments in the inspection area had calibration due dates earlier than the audit date.
- Evidence: Calibration register entries for instruments I-014and I-022.
- Classification: Minor nonconformity
Keep findings factual. Avoid opinions, blame, or vague wording such as “poor control.”
How to Run the Audit: Step by Step
1. Build the audit programme
List all processes and departments, and set audit frequency based on risk, importance, and past results. High-risk or poorly performing areas deserve more frequent audits.
2. Plan each audit
Define the scope, criteria, auditors, date, and the processes to be covered. Send the plan to auditees in advance so people are available.
3. Hold an opening meeting
Confirm scope, method, schedule, and how findings will be communicated. Keep it short.
4. Gather evidence
Use three methods together: interviews, observation, and record review. Trace a sample from start to finish, such as one customer order from enquiry to delivery.
5. Record findings
Use the template above. Note good practice as well as problems. Auditees notice when audits only look for faults.
6. Hold a closing meeting
Present findings, confirm they are understood, and agree timelines for correction and corrective action.
7. Follow up
Verify that corrections were made and corrective actions were effective. Closing a finding without checking effectiveness is a common weakness.
Common Internal Audit Mistakes
- Auditing only against procedures and ignoring ISO 9001 requirements
- Using the same checklist for every process without tailoring
- Asking only managers, and never the people doing the work
- Writing vague findings with no evidence
- Letting auditors audit their own department
- Closing corrective actions without verifying effectiveness
- Treating the audit as a once-a-year event before certification
- Skipping the management review link, so results never reach decision-makers
Tips for Better Audits
- Audit processes, not just departments, so interfaces between teams get tested
- Prioritise areas with customer complaints, repeat nonconformities, or recent changes
- Ask open questions starting with how, what, and show me
- Check that risk-based thinking appears in real decisions, not just in a register
- Rotate auditors where possible to bring fresh perspectives
- Share positive findings with teams to build trust in the audit process
Who Should Conduct Internal Audits?
ISO 9001 does not prescribe a specific qualification, but auditors must be competent and impartial. In practice, that means understanding the standard, knowing audit techniques, and being able to communicate findings clearly.
Formal training is the fastest way to reach that level. A structured internal auditor course teaches clause interpretation, audit planning, evidence gathering, and reporting through practical exercises, so new auditors can start contributing quickly.
Frequently Asked Questions
How often should internal audits be done?
ISO 9001 says “planned intervals” without fixing a number. Many organizations audit all processes at least once a year, with higher-risk processes audited more often.
Can a small company run internal audits?
Yes. In small teams, use auditors from a different function or a trained external auditor to preserve impartiality.
Do internal audits need to cover every clause?
Over the audit programme cycle, yes. Every applicable clause and every process in scope should be audited.
Is an internal audit checklist mandatory?
No. ISO 9001 does not require a checklist, but it helps you stay consistent, cover all requirements, and keep records.
What is the difference between an internal audit and a certification audit?
An internal audit is performed by or for your organization to improve the QMS. A certification audit is performed by an independent certification body to decide whether your QMS meets ISO 9001 for certification.
What happens if internal audits find major problems?
That is the purpose of the audit. Correct the problem, find the root cause, and implement corrective action. Finding issues internally is far better than finding them during a certification audit.
Build Internal Audit Skills with Verger Academy
A checklist only works in the hands of a capable auditor. Verger Academy is an SHI-authorized provider of live, instructor-led online ISO training, helping professionals worldwide develop practical audit skills.
If you are building or strengthening your internal audit team, explore our ISO 9001 internal auditor training and learn how to plan, conduct, and report audits with confidence.
Download Free ISO 9001 Internal Auditor Checklist PDF
Ready to train your auditors? Call +971-529-735-616 or visit www.vergeracademy.com to find the right ISO 9001 course for you or your team.
