ISO 9001 Internal Audit Checklist: How to Prepare and Conduct One

Plenty of quality managers understand what Clause 9.2 requires on paper but freeze the first time they actually have to run an audit: how do you open it, what do you ask, how many records do you sample, and what turns an observation into a nonconformity? This checklist walks through the mechanics an auditor actually needs on the day, not just the clause text.

Step 1 — Build the annual audit programme

Clause 9.2.2 requires the organisation to plan, establish, implement and maintain an audit programme that takes into account the importance of the processes concerned, changes affecting the organisation, and the results of previous audits. In practice this means every process in the QMS scope gets audited at least once per certification cycle (most organisations run it annually), with higher-risk or previously nonconforming processes audited more frequently.

• List every process in scope — pull it directly from your process map or context-of-the-organisation documentation (Clause 4).
• Weight by risk and history: a process with recurring nonconformities or one that is safety- or customer-critical gets audited more than once a year; a stable, low-risk support process may only need one visit.
• Assign an auditor to each process respecting independence (see Step 2).
• Set the calendar — spread audits through the year rather than compressing them into the month before the certification audit; a rushed programme is itself a common finding.
• Get the programme approved by top management or the quality manager and keep it as documented information — the certification auditor will ask for it directly.

Step 2 — Confirm auditor independence and competence

Two requirements trip up small teams more than any other part of Clause 9.2:

• Independence: an auditor cannot audit their own work. A production supervisor can audit purchasing, HR, or sales — never the production line they manage day to day. In a small company with few people qualified to audit, this is usually solved by cross-training staff to audit each other's areas, or by contracting an external auditor to cover the processes nobody internally can audit independently.
• Competence: ISO 9001 requires auditors to be objective and impartial and to have the competence needed to conduct audits — it does not mandate a specific certification such as ISO 9001 lead auditor (ISO 17021). The recommended practical minimum is a 16-24 hour internal auditor course based on the ISO 19011 guideline, plus enough process knowledge of the area being audited to ask meaningful questions and recognise a real gap.

Document who is qualified to audit which processes, and keep the training evidence (course certificate, or a record of mentored audits if trained internally) — auditors are asked for this as often as they ask for it.

Step 3 — Plan the individual audit: criteria and scope

Before walking the floor, every individual audit needs two things defined in writing:

• Criteria — what you are auditing against: the relevant ISO 9001 clauses plus the organisation's own procedures, work instructions and quality objectives for that process.
• Scope — which processes, areas, shifts or locations are included, and which are explicitly excluded.

Prepare an audit checklist or question list in advance, built from the criteria — this is what keeps the audit systematic rather than a free-form conversation, and it is what you will annotate with findings on the day.

Sample question structure by audit area

Step 4 — Run the audit: opening meeting, evidence gathering, closing meeting

Whether it is a two-person internal team or a contracted external auditor standing in, the mechanics of the day follow the same three-part structure certification auditors use, scaled down:

• Opening meeting (5-10 minutes): confirm scope, criteria, timing and who will be interviewed. Restate that the audit is about the system, not about testing individuals.
• Evidence gathering: combine three methods — interview staff performing the process, observe the process actually happening, and sample documented information (records, forms, logs). A verbal answer alone ("yes, we always do that") is not evidence; ask to see the record that proves it.
• Take notes against the checklist as you go, referencing the specific clause and document each finding relates to — this is what turns into the audit report.
• Closing meeting: summarise what was observed, present preliminary findings (nonconformities, observations, opportunities for improvement) to the process owner before leaving, and agree next steps. No auditee should hear about a finding for the first time in the written report.

Step 5 — Classify findings correctly

Not every gap found during an internal audit is a nonconformity. Distinguish:

• Nonconformity: a documented requirement — from ISO 9001 or from the organisation's own procedure — that is not being met, backed by objective evidence.
• Observation: a potential weakness that is not yet a breach of a requirement but could become one if left unaddressed.
• Opportunity for improvement: a suggestion that goes beyond compliance — nothing is wrong, but something could work better.

Certification bodies further split nonconformities into major (systemic, or an entire required process missing) and minor (an isolated lapse). Applying the same discipline internally — rather than logging everything as a generic "finding" — makes the corrective action process meaningful and gives management review something concrete to act on under Clause 9.3.

Step 6 — Structure the audit report

Clause 9.2.2 requires audit results to be reported to relevant management and retained as documented information. A usable internal audit report covers, at minimum:

Step 7 — Close the loop: corrections and corrective action

Clause 9.2.2 explicitly requires that management of the area audited take corrections and corrective actions without undue delay, and verify their implementation. This is where internal audits most often lose their value: the finding gets written down, a correction is made, and nobody ever checks whether the corrective action actually worked. Every nonconformity from an internal audit should carry an owner, a target date, and a scheduled effectiveness check — the same discipline covered in our article on why ISO 9001 audits fail on common nonconformities.

The complete checklist in one place

• ☐ Annual audit programme covers every process, weighted by risk and audit history, and is approved.
• ☐ Auditor assigned to each process does not audit their own work.
• ☐ Auditors have documented competence (course certificate or mentored-audit record).
• ☐ Each individual audit has written criteria and scope before it starts.
• ☐ A checklist or question list is prepared in advance from the criteria.
• ☐ Opening meeting held; process owner knows scope and timing.
• ☐ Evidence gathered via interview, observation and document sampling — not verbal assurance alone.
• ☐ Closing meeting held; no finding is a surprise in the written report.
• ☐ Findings correctly classified as nonconformity, observation, or opportunity for improvement.
• ☐ Report retained as documented information and distributed to relevant management.
• ☐ Every nonconformity has an owner, a target date, and a scheduled effectiveness check.
• ☐ Audit results feed the next management review (Clause 9.3.2).

Frequently asked questions

How long should an internal audit of a single process take?

ISO 9001 does not set a duration. For a small process in an SME, half a day including the opening and closing meeting is typical. Larger or more complex processes, or ones with a history of findings, can take a full day. What matters is that the time is enough to sample real evidence, not just skim the documentation.

Can one person run the entire internal audit programme alone?

Only for the processes they are independent of. A sole quality manager cannot audit their own department's processes with credibility. In very small organisations this usually means contracting an external auditor for a handful of processes each cycle, or training a second internal staff member to audit reciprocally.

What is the difference between this checklist and preparing for the certification audit?

This checklist covers the internal audit your own organisation runs under Clause 9.2, which is a requirement of the standard itself and happens on your own schedule. Preparing for the certification body's Stage 1 and Stage 2 audit is a separate, related exercise — see our guide on preparing for the ISO 9001 certification audit for that process.

Does every internal audit need a formal checklist document?

ISO 9001 does not mandate a specific format, but a written checklist derived from the audit criteria is the practical way to keep the audit systematic, make sure nothing is missed, and give the auditor something to annotate findings against during the visit. It also becomes part of the objective evidence that a real audit — not a conversation — took place.

What happens to findings that never get an effectiveness check?

They are one of the most common nonconformities auditors raise against Clause 9.2 and 10.2 together: a correction was made, but nobody verified whether the root cause was actually eliminated. Certification auditors routinely sample closed internal audit findings specifically to check this.

Article reviewed by IgeraIndustria Quality Team, updated 2026-08-13. References: ISO 9001:2015 Clause 9.2 (Internal audit); ISO 19011:2018 Guidelines for auditing management systems. This article does not constitute certification advice — consult your certification body for scheme-specific requirements.