ISO 9001 internal audit checklist: how to plan and run an internal audit
By Evin Lim, Founder and Managing Director, AA Alive Sdn Bhd · Published
Key points
- Clause 9.2 of ISO 9001 requires planned internal audits that check whether the QMS meets your own requirements and ISO 9001, and whether it is effectively implemented.
- You need an audit programme, defined criteria and scope for each audit, objective and impartial auditors, reported results, and retained records.
- Before the first certification audit, a full internal audit cycle and a management review must be completed.
- Good internal audits follow processes and evidence, not just a clause checklist.
What clause 9.2 requires
ISO 9001 clause 9.2 asks you to run internal audits at planned intervals. Each audit checks two things: does the QMS conform to your own requirements and to ISO 9001, and is it effectively implemented and maintained? To meet the clause you need to:
- Plan an audit programme covering frequency, methods, responsibilities and reporting, taking into account the importance of each process, changes, and previous audit results.
- Define the criteria and scope of each audit.
- Choose auditors who are objective and impartial. In practice, people should not audit their own work.
- Report results to relevant management.
- Take correction and corrective action without undue delay.
- Keep records of the programme and the audit results.
Build a simple audit programme
Most SMEs use a one-page annual plan: processes down the side, months across the top. Higher-risk processes, and areas with customer complaints or past findings, are audited more often. Every clause and every process should be covered at least once in each audit cycle.
| Process | Owner | Key clauses | Priority |
|---|---|---|---|
| Sales and contract review | Sales manager | 8.2 | High if orders are often changed |
| Purchasing and suppliers | Purchasing | 8.4 | High if suppliers affect quality |
| Production or service delivery | Operations | 8.5, 8.6, 8.7 | High |
| Calibration and equipment | QA / maintenance | 7.1.5 | Medium |
| Training and competence | HR | 7.2, 7.3 | Medium |
| Management and planning | Top management | 4, 5, 6, 9.3 | Medium |
| Complaints and improvement | QA | 9.1.2, 10 | High if complaints are rising |
ISO 9001 internal audit checklist by clause
Use these questions as prompts, then follow the evidence. Ask to see records, not just descriptions.
Context and leadership (clauses 4 and 5)
- Is the QMS scope documented, and does it match what the company actually does?
- Have internal and external issues, and interested parties and their requirements, been reviewed recently?
- Can staff explain the quality policy and how their job affects it?
- Are roles, responsibilities and authorities for the QMS assigned and understood?
Planning (clause 6)
- Is there a current list of risks and opportunities, with actions and owners?
- Are quality objectives measurable, monitored and updated? Is there a plan for each one?
- Were changes to the QMS planned, rather than made ad hoc?
Support (clause 7)
- Is measuring equipment calibrated or verified, labelled, and are results recorded?
- Are competence requirements defined for each role, and is there evidence staff meet them?
- Are documents controlled: current version in use, obsolete versions removed or marked?
- Are records legible, retrievable and protected?
Operation (clause 8)
- Are customer requirements reviewed before accepting an order, and are changes recorded?
- Are suppliers evaluated, and is performance monitored and re-evaluated?
- Are work instructions available where needed and followed in practice?
- Is product or service released only after planned checks are done and authorised?
- Is nonconforming output identified, controlled and recorded?
Performance evaluation and improvement (clauses 9 and 10)
- Is customer satisfaction monitored, and are the results used?
- Was the previous internal audit completed as planned, and are its findings closed?
- Did management review cover all required inputs and record decisions?
- For each nonconformity, was the root cause found and was the corrective action checked for effectiveness?
Running the audit: five steps
- Prepare. Read the procedure, the last audit report and open actions for the area. Draft your questions.
- Opening. Agree the scope and timing with the process owner.
- Collect evidence. Interview, observe and sample records. Note what you saw: record numbers, dates and names of documents.
- Evaluate. Compare the evidence with the criteria. Classify each finding as a nonconformity, an observation or an opportunity for improvement.
- Report and follow up. Share findings at a short closing meeting, issue the report and track corrective actions to closure.
How to write a good finding
A finding your certification body will respect has three parts: the requirement, the evidence and the gap. For example:
Then follow the corrective action process described in our guide to nonconformities and corrective action.
Common mistakes
- Auditing only documents and never watching the work being done.
- Asking "do you have a procedure?" instead of "show me the last three times you did this".
- Writing vague findings with no objective evidence.
- Closing findings with a correction only (fixing the instance) and no corrective action (fixing the cause).
- Auditing your own department.
Internal auditor training is part of our ISO 9001 consulting. For how the internal audit fits into the path to certification, see the ISO 9001 certification process.
Frequently asked questions
How often should ISO 9001 internal audits be done?
ISO 9001 says "at planned intervals" and does not fix a frequency. Most companies cover every process and clause at least once a year, and audit high-risk or problem areas more often.
Who can be an ISO 9001 internal auditor?
Any competent employee who is objective and impartial, usually someone trained in ISO 9001 and audit techniques who does not audit their own work. Small companies sometimes use an external auditor to keep audits impartial.
Do I need an internal audit before the certification audit?
Yes. Certification bodies expect to see at least one complete internal audit cycle and a management review before the Stage 2 audit.
What is the difference between an internal audit and a certification audit?
An internal audit is done by you, or someone acting for you, to check your own QMS. A certification audit is done by an independent certification body, which decides whether to issue or keep your ISO 9001 certificate.
Need help with your ISO 9001 system?
We prepare Malaysian companies for ISO 9001 certification by an accredited certification body. The first consultation is free.