ISO 9001 Internal Audit Checklist: How to Plan, Run and Close an Audit

Internal audits are your chance to find problems before the certification body or a customer does. ISO 9001:2015 clause 9.2 requires them, but leaves the method to you. This checklist covers the full cycle, from the annual programme to closing findings.

1. Build the audit programme

• List every process and clause in scope, and every site.
• Set frequency by risk and past results: weak or critical processes more often, stable ones less.
• Cover the whole QMS at least once in the certification cycle; most companies do it every year.
• Assign auditors who do not audit their own work (clause 9.2.2 c).
• Publish the programme and keep it up to date when audits move.

2. Plan each audit

• Define scope, criteria (clauses, procedures, customer requirements) and date.
• Review previous findings, open CAPAs, complaints and KPIs for the area.
• Prepare questions and the records you want to sample.
• Send the plan to the auditee a few days ahead.

3. Questions by clause

Clause	Ask or check
4 Context	Are internal and external issues and interested parties reviewed? Is the scope current?
5 Leadership	Do people know the quality policy and objectives that apply to their work?
6 Planning	Are risks and opportunities identified with actions and owners?
7.1.5 Monitoring	Are measuring instruments calibrated and identified, with records?
7.2 Competence	Is training recorded and effectiveness checked for the roles sampled?
7.5 Documented information	Is the version in use current and approved? Are obsolete copies withdrawn?
8.4 Suppliers	Are suppliers evaluated and re-evaluated with records?
8.5 Production	Are work instructions available at the point of use and followed?
8.7 Nonconforming output	Is nonconforming product identified, segregated and dispositioned?
9.1 Evaluation	Are KPIs measured and analysed, and customer satisfaction monitored?
9.3 Management review	Do minutes cover all required inputs, with decisions and actions?
10.2 Corrective action	Are root causes found and effectiveness verified before closure?

4. Run the audit

• Hold a short opening meeting to confirm scope and timing.
• Follow the process: ask, observe and sample records. "Show me" beats "tell me".
• Record objective evidence: document numbers, record IDs, dates and names.
• Note good practice as well as gaps.
• Close with a meeting that summarises findings so nothing is a surprise in the report.

5. Write clear findings

Each finding should state the requirement, the evidence and the gap. For example:

Grade findings consistently, for example major nonconformity, minor nonconformity and opportunity for improvement.

6. Close the loop

• Raise a corrective action for every nonconformity, with an owner and due date.
• Require root cause, not only correction.
• Verify effectiveness before closing, ideally at the next audit of that area.
• Report audit results and overdue actions to management review (clause 9.3).

Common internal audit findings from certification bodies

• Audit programme not covering all processes or sites.
• Auditors auditing their own area.
• Findings closed without evidence of effectiveness.
• Audit results not discussed in management review.

Keeping the programme, checklists, findings and corrective actions in one place makes each of these easy to prove.

← All articles