Direct answer
A 30-person factory preparing for an ISO 9001, 14001, or 45001 surveillance or certification audit needs an internal audit that covers six areas at minimum: document control, training records, calibration records, the nonconformity log, management review minutes, and a realistic audit schedule sized to a team without a dedicated QHSE department. The checklist below is built for exactly that situation — a quality or operations manager doing double duty, not a five-person compliance department. It is a preparation tool, not a substitute for the certification body's own audit.
Most internal audit checklists online are written for organisations with a QHSE department of three or four people and a dedicated audit calendar. That is not the reality for a 30-person manufacturer, where the "quality function" is often one person's Tuesday afternoon, squeezed between production scheduling and customer calls. This checklist is built for that reality: it tells you exactly what to check, roughly how long each check takes, and how to spread the work across a year without anyone losing a week to it.
Why a small factory still needs a real internal audit
Internal audits are a mandatory clause in ISO 9001 (Clause 9.2), ISO 14001 (Clause 9.2), and ISO 45001 (Clause 9.2) — not a nice-to-have. Skipping them, or running a token walk-through the week before the external audit, is one of the fastest routes to a major nonconformity, because it signals the whole management system is not actually being operated, only documented. External auditors can usually tell the difference between an internal audit that happened and one that was backdated: real audits leave messy evidence — corrective actions, follow-ups, the occasional disagreement recorded in the notes. A clean, uniform internal audit trail with no findings ever recorded is itself a red flag.
The good news for a small operation: an internal audit does not need to be a formal, multi-day event. Spread correctly across the year, in the areas that matter most, it takes a competent quality lead roughly 20-30 hours total per standard per year — manageable alongside a full-time operational role.
The six core areas, and what "good" looks like in each
1. Document control
Check that every controlled document in active use — procedures, work instructions, forms — carries a current revision number, an approval date, and an approver's name, and that obsolete versions are not still sitting on the shop floor or a shared drive where someone might follow them by mistake. Confirm the master document list matches what is physically posted at workstations. This is consistently the single most common minor nonconformity in small manufacturers: an outdated work instruction taped to a machine, superseded six months ago, that nobody pulled down.
2. Training records
For every operator performing a task with a documented procedure, there should be a record showing they were trained on the current revision — not just trained once, years ago, on an earlier version. Cross-check the training matrix against the actual shift roster: a common gap is a new hire or a temporary worker operating equipment with no training record on file at all. Competence evidence under Clause 7.2 does not have to be elaborate — a signed sign-off sheet is sufficient — but it has to exist and be current.
3. Calibration records
Every measuring instrument used for product acceptance decisions — calipers, torque wrenches, pressure gauges, scales — needs a calibration record with a due date, and instruments past that due date should be visibly tagged out of service, not quietly still on the bench. Check that the calibration interval is justified (manufacturer recommendation or documented internal rationale) and that out-of-tolerance findings, when they occur, trigger a review of product measured with that instrument since its last good calibration. A missed calibration due date is an easy, mechanical check — and an easy finding for an auditor who asks to see the calibration log.
Review a sample of recent entries for completeness: a clear description of what went wrong, root cause analysis rather than a symptom restated as a cause, a corrective action with an owner and a due date, and evidence that effectiveness was actually checked after the fix — not just that the box was ticked closed. An empty or near-empty nonconformity log at a 30-person factory is rarely a sign of a flawless operation; it is far more often a sign that problems are being fixed verbally on the shop floor and never logged, which is itself the finding.
5. Management review minutes
Confirm management review happened at the required frequency (annually is common for a small manufacturer, though the standard requires "planned intervals" — define and stick to yours) and that the minutes cover the required inputs: audit results, customer feedback, process performance, nonconformity trends, and status of actions from the previous review. Then check the outputs — did the review actually produce decisions (resource changes, objective updates, improvement actions) or is it a meeting that happened with no trace of a decision? Auditors look specifically for evidence that top management engaged with the data, not just attended.
6. Internal audit schedule and records
Check that the internal audit programme itself covers every clause and every relevant process at least once within the certification cycle, that auditors did not audit their own work area (an independence requirement, even informally applied in a small team), and that findings from the previous internal audit were tracked to closure before the next one started. A schedule that exists on paper but was never actually followed is worse than no schedule — it shows a gap between what the system says and what happened.
The downloadable checklist
Use this table as a working checklist during the audit itself. Print it, or copy it into a spreadsheet with columns for auditor initials, date checked, and finding reference.
| Area |
Check |
Evidence to sample |
Typical time |
| Document control |
Current revision posted at point of use; obsolete copies removed |
Master document list vs. 5 shop-floor postings |
45-60 min |
| Training records |
Every operator trained on current procedure revision |
Training matrix vs. shift roster, 5 operator files |
45-60 min |
| Calibration records |
No instrument past due date in active use |
Calibration log vs. physical instrument tags |
30-45 min |
| Nonconformity log |
Root cause, owner, due date, effectiveness check present |
5-8 most recent entries, closed and open |
45-60 min |
| Management review |
Required inputs covered; decisions recorded as outputs |
Most recent review minutes |
30 min |
| Audit programme |
Full clause coverage in cycle; prior findings closed |
Audit schedule vs. actual audit dates and reports |
30-45 min |
| Objectives & monitoring |
Quality/EHS objectives measured and tracked, not just set |
Current-year objectives tracker |
20-30 min |
A realistic audit schedule for a small team
Trying to audit everything in one week, once a year, is the most common reason internal audits get skipped entirely at small manufacturers — the time block never materialises. Splitting the programme into short, focused sessions across the year is far more sustainable and produces better evidence besides, because it catches drift earlier rather than finding a year's worth of accumulated gaps at once.
- Quarter 1: Document control + training records (roughly 2 hours combined)
- Quarter 2: Calibration records + nonconformity log (roughly 1.5-2 hours combined)
- Quarter 3: Process-specific spot check (production control, incoming inspection, or purchasing — rotate each year) plus a follow-up on any open corrective actions
- Quarter 4: Management review preparation, objectives review, and a final readiness check before the external surveillance visit
This spreads the total annual workload to roughly 20-25 hours — a few focused mornings rather than one exhausting week — and, just as importantly, means findings surface with enough time left in the year to actually fix them before the certification body shows up.
Common mistakes small factories make on internal audits
- Running the internal audit the week before the external audit. This leaves no time to close findings and often looks, to an experienced auditor, exactly like what it is.
- The same person auditing their own department. Even in a 30-person team, swap responsibilities where possible — a production supervisor can audit document control while the quality lead audits the shop floor.
- Recording findings but never checking effectiveness. Closing a corrective action because the fix was applied, without checking weeks later that the problem actually stopped recurring, is a gap auditors specifically probe for.
- Treating the audit as a document review only. Walking the shop floor and asking operators what they actually do, compared against what the procedure says, catches gaps a desk review never will.
- No record of the audit having happened at all. An internal audit with no plan, no scope, no report, and no findings trail does not satisfy Clause 9.2 even if the checks were genuinely performed.
What auditors actually want to see when the evidence request lands mid-audit
The real test of this checklist is not the internal audit itself — it is whether the same evidence can be produced fast, correctly, and completely when a certification body auditor asks for it live, mid-audit, with the clock running. This is where most small teams struggle: the records exist, technically, but finding the right revision of the right procedure, or the calibration certificate for the specific gauge used on a specific batch, takes ten minutes of searching a shared drive while the auditor waits. IgeraIndustria indexes exactly this kind of evidence — procedures, training records, calibration logs, nonconformity entries — so a quality lead can retrieve the precise document and revision an auditor is asking about in seconds, with the source cited, rather than searching folder by folder under pressure.
// IgeraIndustria RAG demo — mid-audit evidence request
Auditor: Show me the calibration record for the torque wrench used on the line 2 assembly last month.
IgeraIndustria: Torque wrench TW-04, calibration certificate CAL-2026-0142, calibrated 2026-06-03, due 2026-12-03. Linked to Line 2 Assembly Work Instruction WI-ASSY-007 Rev 4. No out-of-tolerance findings on record.
How this fits the wider ISO audit picture
This checklist covers the internal audit preparation stage — one part of a much broader audit lifecycle. IgeraIndustria publishes clause-by-clause breakdowns for ISO 9001, 14001, 45001, 50001, and 27001, walking through what each individual clause actually requires and what evidence satisfies it. If your internal audit surfaces a gap in a specific clause, the corresponding clause-by-clause guide for that standard is the next place to look for exactly what "conformance" means for that requirement.
Frequently asked questions
How often does a small factory need to run a full internal audit?
The standards require that the entire management system — every clause and every applicable process — be audited at least once within each three-year certification cycle, with the frequency and method left to the organisation to define based on risk and past performance. Most small manufacturers find an annual full-coverage cycle, split into quarterly sessions as shown above, works well and satisfies both ISO 9001 and ISO 14001/45001 if run as an integrated audit.
Can one person run the whole internal audit programme in a 30-person factory?
Yes, in principle, provided they do not audit their own area of direct responsibility — the standard's independence requirement can be satisfied informally in a small organisation, for example by having a supervisor from another department review sections outside their own remit. Many small manufacturers use a trained cross-functional pair for this reason.
The standards do not mandate a specific certificate, only that the person is competent to conduct the audit objectively and impartially. A short internal-auditor training course (often one or two days, widely available from training providers and some certification bodies) is common practice and helps demonstrate competence if an external auditor asks how internal auditors were qualified.
Treat it the same way an external major would be treated: root-cause it, assign an owner and a realistic due date, implement the correction, and verify effectiveness before closing it. Finding and fixing it internally, before the certification body arrives, is the entire point of the exercise — it is a far better outcome than the same issue surfacing during the external audit.
Is this checklist a substitute for the certification body's audit?
No. This is a preparation tool to help identify and close gaps before your certification body visits — it is not an official audit, does not produce a certifiable outcome, and does not replace the judgment of your accredited certification body's auditor. Scope, depth, and specific requirements can vary by certification body and by your accreditation scope; always confirm specifics with them directly.
How long before the external audit should the last internal audit happen?
Leave enough time to close any findings with verified effectiveness — generally at least 4-6 weeks before the external surveillance or certification visit. An internal audit completed the day before the external one, with open findings still unresolved, provides little protection and can itself look like a compliance-theatre exercise to an experienced auditor.
Do I need a different checklist for ISO 14001 and ISO 45001, or can I use the same one?
The six core areas above — document control, training, calibration, nonconformities, management review, and audit programme — apply across all three standards, since Clause 9.2 has near-identical structure in each. Layer in standard-specific checks on top: legal/regulatory compliance evaluation and environmental aspects for 14001, and incident records plus worker consultation evidence for 45001. Running one integrated audit across all three standards at once, rather than three separate exercises, is usually the more efficient approach for a small team.
This article is provided for general informational purposes and does not constitute professional, legal, or certification advice. Internal audit requirements, evidence expectations, and accreditation scope can vary by certification body, sector, and jurisdiction — always confirm specifics with your own certification body before your surveillance or certification audit. Article reviewed by IgeraIndustria Quality Team, updated 2026-09-18. References: ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018 Clause 9.2 (Internal audit) and Clause 9.3 (Management review).
