ISO 9001 Internal Audit Checklist (Downloadable)
By the IgeraIndustria Quality & Compliance Team · October 2026 · 11 min read
A certification-ready ISO 9001:2015 checklist walks clause by clause through the seven auditable clauses (4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement). For each requirement it lists an audit question, the objective evidence you expect to see, and a Conform / Minor / Major result. Every Major or Minor then needs a documented correction and corrective action under Clause 10.2 before the certification or surveillance audit.
An audit finding is only as strong as the evidence behind it: if you cannot point to a record, treat the requirement as not yet demonstrated.
— Working principle for evidence-based internal auditing, aligned with Clause 9.2
What this checklist is for (and how it differs from our how-to guide)
We already publish a step-by-step execution guide: ISO 9001 Internal Audit Checklist: How to Prepare and Conduct One. That article explains how to build the audit programme, open the meeting, sample records and write the report. This article is the working template: a clause-by-clause grid you can copy into a spreadsheet, fill in during the audit, and show your certification body as proof your internal audit was thorough.
Use the how-to guide to learn the method and this checklist to run it. If you are preparing for an initial certification, a surveillance visit or a recertification, work through the tables below, score each line, and close every gap before the external auditor arrives.
How to use the checklist and score findings
Each table has five columns. Copy them into a spreadsheet and add your own columns for auditor, date and record reference.
- Audit question: what you ask or verify. Reword it to fit your processes.
- Expected evidence: the records, observations or interviews that would prove conformity. Sample, do not read everything.
- Result: tick one score using the definitions below.
- Notes: record reference numbers, sample sizes and names so a finding can be reproduced.
| Score | Typical meaning | Example |
|---|---|---|
| Conform | Requirement met, evidence found and consistent across the sample. | Calibration certificates valid for every instrument sampled. |
| Minor | Isolated lapse or partial gap that does not put the system's ability to deliver conforming outputs in doubt. | One training record missing a sign-off in an otherwise complete matrix. |
| Major | Requirement absent, not implemented, or a systemic or repeated failure that raises doubt about conforming outputs. | No internal audits conducted in the period, or management review never held. |
The standard does not define these grades. "Major" and "Minor" are a common certification-body convention, so agree your own definitions in the audit procedure and check how your certification body grades findings so you score the same way.
The checklist: clauses 4 to 10
Clause numbers follow ISO 9001:2015, which uses the common Annex SL high-level structure shared by other management system standards. Clauses 1 to 3 (scope, normative references, terms) contain no auditable requirements, so the checklist starts at Clause 4. Questions are paraphrased; check the wording in your licensed copy of the standard.
Clause 4 — Context of the organization
Auditors start here because scope and process definitions decide what every later clause is tested against.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 4.1 | Has the organization identified the external and internal issues that affect its purpose and strategic direction, and are they reviewed? | Context analysis (e.g. SWOT/PESTLE), management review minutes showing issues revisited, evidence of changes since last review | ☐ Conform ☐ Minor ☐ Major | |
| 4.2 | Are interested parties and their relevant requirements determined and monitored? | Interested-parties register, customer and regulatory requirement lists, update history | ☐ Conform ☐ Minor ☐ Major | |
| 4.3 | Is the QMS scope documented, including applicability and justified exclusions? | Scope statement, list of products/services and sites, justification for any non-applicable requirement | ☐ Conform ☐ Minor ☐ Major | |
| 4.4 | Are the QMS processes, their sequence, interactions, inputs/outputs, owners, risks and performance indicators defined? | Process map, process cards or turtle diagrams, named process owners, KPIs per process | ☐ Conform ☐ Minor ☐ Major |
Clause 5 — Leadership
This is where top management has to be visible in the evidence, not only in the signature on the policy.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 5.1 | Can top management show it takes accountability for QMS effectiveness and promotes the process approach and risk-based thinking? | Interview with top management, resourcing decisions, objectives linked to the business plan | ☐ Conform ☐ Minor ☐ Major | |
| 5.1.2 | Is customer focus demonstrated, including requirements, risks affecting conformity and the ability to enhance satisfaction? | Customer requirement reviews, satisfaction and on-time delivery data, actions taken on customer risks | ☐ Conform ☐ Minor ☐ Major | |
| 5.2 | Is the quality policy documented, appropriate to context, communicated, understood and available to interested parties as relevant? | Controlled policy, display or intranet location, staff interview results, awareness evidence | ☐ Conform ☐ Minor ☐ Major | |
| 5.3 | Are roles, responsibilities and authorities assigned and communicated for all QMS processes? | Organization chart, job descriptions, role assignments for process owners, responsibility for reporting QMS performance | ☐ Conform ☐ Minor ☐ Major |
Clause 6 — Planning
Check that risk-based thinking is traceable from the risk register into real actions and changes.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 6.1 | Are risks and opportunities relevant to context, interested parties and the QMS identified, with actions planned and their effectiveness evaluated? | Risk and opportunity register, action plans with owners and dates, evidence of reviewing whether actions worked | ☐ Conform ☐ Minor ☐ Major | |
| 6.2 | Are measurable quality objectives set at relevant functions and levels, consistent with the policy, and is there a plan to achieve them? | Objectives with metrics, owners, resources and deadlines; progress tracking; objective results in management review | ☐ Conform ☐ Minor ☐ Major | |
| 6.3 | Are changes to the QMS planned and carried out in a controlled way? | Change records (new process, site, system, organization change) showing purpose, consequences, resources and responsibilities | ☐ Conform ☐ Minor ☐ Major |
Clause 7 — Support
The most frequent source of minor findings: records exist but are out of date, unapproved or hard to retrieve.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 7.1.2 to 7.1.4 | Are the people, infrastructure and process environment needed for conforming products and services determined and provided? | Staffing plans, maintenance schedules and records, environmental controls where relevant | ☐ Conform ☐ Minor ☐ Major | |
| 7.1.5 | Are monitoring and measuring resources suitable, maintained and, where traceability is required, calibrated? | Equipment list, calibration certificates and status labels, action taken when equipment is found out of tolerance | ☐ Conform ☐ Minor ☐ Major | |
| 7.1.6 | Is the organizational knowledge needed for process operation determined, maintained and available? | Lessons-learned records, succession or cross-training plans, knowledge captured from incidents | ☐ Conform ☐ Minor ☐ Major | |
| 7.2 | Is competence defined for roles affecting QMS performance, and is it evidenced, with action to acquire it where lacking? | Competence matrix, training and qualification records, effectiveness checks | ☐ Conform ☐ Minor ☐ Major | |
| 7.3 | Are people aware of the policy, relevant objectives, their contribution and the implications of not conforming? | Staff interviews, induction records, communication materials | ☐ Conform ☐ Minor ☐ Major | |
| 7.4 | Are internal and external communications defined (what, when, with whom, how)? | Communication plan or matrix, meeting records, customer communication logs | ☐ Conform ☐ Minor ☐ Major | |
| 7.5 | Is documented information created, updated and controlled (identification, approval, distribution, retention, access, change control)? | Document register, approval trail, current versions at point of use, record retention rules, obsolete documents withdrawn | ☐ Conform ☐ Minor ☐ Major |
Clause 8 — Operation
Sample real jobs end to end here. Pull one order, one purchase and one nonconforming output and trace them through the records.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 8.1 | Are operational processes planned, controlled and kept in line with requirements, with planned changes reviewed and outsourced processes controlled? | Quality plans, work instructions, acceptance criteria, records proving processes ran as planned | ☐ Conform ☐ Minor ☐ Major | |
| 8.2 | Are customer requirements communicated, determined and reviewed before commitment, and are changes handled? | Contract or order review records, quotations, amended-order records, customer communication | ☐ Conform ☐ Minor ☐ Major | |
| 8.3 | Where design and development applies, are planning, inputs, controls (reviews, verification, validation), outputs and changes managed and recorded? | Design plan, input and output records, review and validation evidence, change approvals. Mark N/A with justification if excluded in the scope | ☐ Conform ☐ Minor ☐ Major | |
| 8.4 | Are external providers evaluated, selected, monitored and re-evaluated, and is the type and extent of control based on impact on conformity? | Approved supplier list, evaluation criteria and scores, purchase orders with clear requirements, incoming inspection or supplier performance data | ☐ Conform ☐ Minor ☐ Major | |
| 8.5.1 / 8.5.2 | Is production and service provision carried out under controlled conditions, with outputs identified and traceable where required? | Work orders, routing and batch records, identification and traceability records, process parameter logs | ☐ Conform ☐ Minor ☐ Major | |
| 8.5.3 to 8.5.5 | Is customer or external provider property protected, outputs preserved, and post-delivery activities (such as warranty or service) addressed? | Handling and storage records, property inventories, warranty and service records, packaging and delivery controls | ☐ Conform ☐ Minor ☐ Major | |
| 8.5.6 | Are changes to production or service provision reviewed and controlled to keep conformity? | Change review records, authorization evidence, results of verification after change | ☐ Conform ☐ Minor ☐ Major | |
| 8.6 | Is release of products and services verified against planned arrangements, with evidence of conformity and who authorized release? | Inspection and test records, release signatures or authorizations, certificates of conformity | ☐ Conform ☐ Minor ☐ Major | |
| 8.7 | Are nonconforming outputs identified, controlled and dispositioned, and are records kept? | Nonconformity log, quarantine and tagging evidence, concession and rework records, re-verification after correction | ☐ Conform ☐ Minor ☐ Major |
Clause 9 — Performance evaluation
Audit your own audit process here: the programme, independence and management review are exactly what a certification body sets out to test.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 9.1.1 | Is it determined what needs to be monitored and measured, how, when, and how results are analyzed and evaluated? | Monitoring plan, KPI dashboard, measurement method definitions, evidence that results are used | ☐ Conform ☐ Minor ☐ Major | |
| 9.1.2 | Are customer perceptions of the extent to which needs and expectations are met monitored, and are the methods for obtaining that information determined? | Surveys, complaints, delivery performance, review meetings, trend analysis | ☐ Conform ☐ Minor ☐ Major | |
| 9.1.3 | Is data analyzed to evaluate conformity, satisfaction, QMS performance, planning effectiveness, risk actions, provider performance and improvement needs? | Analysis reports with trend charts and conclusions feeding decisions | ☐ Conform ☐ Minor ☐ Major | |
| 9.2 | Is an audit programme planned, with defined criteria, scope, frequency and methods, objective and impartial auditors, reports to management, and timely corrections? | Annual audit programme, audit plans and reports, auditor competence and independence records, finding tracker | ☐ Conform ☐ Minor ☐ Major | |
| 9.3 | Does top management review the QMS at planned intervals with all required inputs and documented decisions on improvement, QMS changes and resource needs? | Management review agenda and minutes, input data pack (including audit results and nonconformities), tracked outputs and owners | ☐ Conform ☐ Minor ☐ Major |
Clause 10 — Improvement
The closing clause is where a certification auditor tests whether findings are really closed or just reclassified.
| Ref | Audit question | Expected evidence | Result | Notes |
|---|---|---|---|---|
| 10.1 | Are improvement opportunities determined and selected to meet customer requirements and enhance satisfaction? | Improvement project records, customer-driven changes, link to analysis outputs | ☐ Conform ☐ Minor ☐ Major | |
| 10.2.1 | On a nonconformity, does the organization react, control and correct it, evaluate the need for action to eliminate causes, implement action, review effectiveness and update risks if needed? | Corrective action records with root cause analysis, implementation evidence, effectiveness verification, risk register updates | ☐ Conform ☐ Minor ☐ Major | |
| 10.2.2 | Is documented information retained on the nature of nonconformities, actions taken and results of corrective action? | Nonconformity and corrective action register with status and dates | ☐ Conform ☐ Minor ☐ Major | |
| 10.3 | Is the suitability, adequacy and effectiveness of the QMS continually improved, using analysis and management review outputs? | Evidence that review outputs became projects, with measured results over time | ☐ Conform ☐ Minor ☐ Major |
How to close findings before the certification body audit
A scored checklist is only useful if the findings are closed. Clause 10.2 expects the organization to react to the nonconformity, evaluate whether action is needed to eliminate its causes, implement that action, review its effectiveness and keep records. For each Minor or Major use this sequence:
- Contain and correct: fix the immediate problem (quarantine the product, issue the missing record, recalibrate the instrument) and record the date.
- Find the root cause: ask why the gap occurred, not only what it was. "Retrain the operator" is rarely a root cause by itself.
- Plan and implement corrective action: assign an owner and a due date, and decide whether the same cause could affect other processes or sites.
- Verify effectiveness: after enough time has passed, re-audit the area or check the data. Closing on "action completed" without checking that the problem stopped is the most common weakness.
- Update the system: amend procedures, the risk register (Clause 6.1) and the training matrix where the finding revealed a wider gap.
- Report to management: include audit results, open actions and trends in the next management review (Clause 9.3).
Suggested prioritization before the external audit
- Close all Majors first, with verified effectiveness where time allows. Treat any unresolved Major as a likely external finding.
- Group Minors by root cause. Five Minors with one cause are one corrective action, not five.
- Keep a visible open-action list with owners and dates for anything that cannot close in time. Auditors respond better to a controlled open item than to a hidden one.
- Re-run the checklist on Clauses 9.2, 9.3 and 10.2 last, since they test the audit and improvement process itself.
For sample wording of findings that close first time, see how to write a nonconformity that closes the first time, and for the reasons audits go wrong, why ISO 9001 audits fail.
Where auditors tend to dig deeper
- Risk-based thinking without actions: a risk register that has not been updated since certification and is not linked to objectives or changes.
- Management review as a formality: minutes missing required inputs, or decisions with no owner or follow-up.
- Supplier control gaps: providers shipping before evaluation is complete, or control that does not match the risk of what is purchased.
- Documented information drift: uncontrolled copies in use, or procedures that describe a process no longer followed as written.
- Audit programme coverage: some processes audited every year and others never, and auditors reviewing their own work.
- Corrective actions closed without effectiveness checks: the same nonconformity returning in the next period.
To go deeper on individual clauses, our guides cover Clause 4, Clause 6, Clause 7, Clause 8, Clause 9 and Clause 10. For the documents you need on file, see required documents and templates by clause.
Checklists for other standards
If your organization runs more than one management system, the same format is available for ISO 17025 laboratories and ISO 13485 medical device quality systems. Because they share the clause-by-clause logic, a single integrated audit can often cover several standards at once.
A note on the ISO 9001 revision
ISO 9001 is under revision, and a new edition is expected. We do not quote dates here because the final publication and transition period are set by ISO and the accreditation bodies. Until a new edition is published and your certification body confirms its transition rules, audit against ISO 9001:2015. Check the current status on the ISO website and with your certification body.
Turning the checklist into an evidence-ready habit
The slowest part of any internal audit is not deciding what to ask, it is locating the record that proves the answer. Hunting through shared drives for the current procedure revision, the last supplier evaluation or the training record behind a competence claim takes time that should go into judging whether the process works.
That is the gap IgeraIndustria is built to close. Your quality team can ask a direct question, such as "which suppliers are overdue for re-evaluation?" or "what does our change control procedure require?", and receive an answer sourced from your own QMS documents, with the exact source cited. Auditors, internal or external, get the evidence on the spot.
Be certification-ready without the night-before scramble
IgeraIndustria connects your procedures, records and audit history so every checklist line has evidence behind it, found in seconds and cited to its source.
Discover IgeraIndustriaFrequently asked questions
How often must ISO 9001 internal audits be carried out?
Clause 9.2 requires internal audits at planned intervals but does not set a fixed frequency. Most organizations run an annual programme covering all processes within the certification cycle, with higher-risk or previously nonconforming areas audited more often. Plan the programme using the importance of the processes, changes affecting the organization and previous audit results.
Does the internal audit need to cover every clause?
The audit programme should cover the whole QMS within its cycle, including all processes and the requirements of the standard that apply within your scope. It does not have to happen in one session, so many teams spread it across the year and audit by process rather than by clause.
Can the quality manager audit the QMS they manage?
The standard requires auditors to be objective and impartial, and auditors should not audit their own work. In small organizations, cross-auditing between departments or using an external auditor for processes nobody can audit independently are the usual solutions.
Do we need a lead auditor certificate to audit internally?
ISO 9001 does not require a specific auditor certificate. Auditors need to be competent for the task, which is typically shown through internal auditor training (commonly based on ISO 19011 guidance), knowledge of the area audited and practice. Keep the evidence in your competence records.
What is the difference between a Minor and a Major nonconformity?
The standard does not define the grades. Certification bodies commonly treat a Major as the absence or systemic failure of a requirement that casts doubt on conforming outputs, and a Minor as an isolated or partial lapse. Ask your certification body how it grades findings and mirror that in your audit procedure.
Must internal audit findings go to management review?
Yes. Clause 9.3 includes audit results and the status of nonconformities and corrective actions among the inputs top management has to consider, and decisions arising from the review should be recorded and followed up.
Can I use this checklist for a surveillance audit?
Yes. It works for initial certification, surveillance and recertification preparation. For surveillance, focus on areas that changed since the last visit, previous findings, and Clauses 9 and 10, which are routinely sampled.
Important notice
This article is a practical self-assessment aid and does not constitute certification, legal or regulatory advice. It does not reproduce the text of ISO 9001:2015 and is no substitute for it or for your certification body's own audit criteria. Clause references are given for orientation and requirements are paraphrased; always verify the exact wording against the current published standard. For guidance specific to your organization, consult a qualified quality management consultant or your certification body.
Summary
- A certification-ready checklist covers Clauses 4 to 10 with a question, expected evidence and a Conform / Minor / Major score per requirement.
- Sample real jobs end to end in Clause 8, and audit your own audit programme, management review and corrective action process in Clauses 9 and 10.
- Close findings with correction, root cause, corrective action and a verified effectiveness check before the external auditor arrives.
- Use the how-to guide to learn the method and this checklist to execute it.
Last updated: October 2026 | Reference: ISO 9001:2015 — Quality management systems — Requirements | Author: IgeraIndustria Quality & Compliance Team | IgeraIndustria. This checklist is a summary aid; where it differs from the current published standard or your certification body's requirements, those sources take precedence.