ISO 9001 internal audit checklist: how to use the 40 points in practice

Most quality teams have lived this: the internal audit ends, the report is signed and, two months later, the same failure comes back. The problem is rarely the fieldwork. It usually lies in what was left out before it, such as a vague scope and samples picked on the spot, or after it, when a finding never becomes an action with an owner and a deadline.

An ISO 9001 internal audit checklist helps close those gaps. This article explains how to use ours, which brings together 40 points in 8 stages and covers the whole cycle, and where each stage tends to fail.

The PDF is available in Portuguese: download the ISO 9001 internal audit checklist.

What an audit checklist is for (and what it is not)

It is for checking the method: whether the audit was planned, whether the auditors are suitable, whether evidence was gathered with care and whether actions were followed through. It is not a list of questions for the audited process, which is why it works in any area.

Nor does it replace the auditor’s judgment. A closed list nudges the team to look only for what is written on it. Use it as a safety net and keep asking open questions and observing real work. For more depth, see the guide to ISO 9001 internal audit.

The 8 stages of the checklist

The material has two parts: what to check before and during the audit, and what to check afterwards.

Part 1: before and during

A. Programme and planning. Confirm there is an audit programme with frequency, methods and responsibilities, and that each process’s priority reflects its importance, recent changes and earlier results. Every audit needs an objective, scope and criteria. A common mistake is auditing “the purchasing area” without saying what you want to conclude about it.

B. Auditors. Check that they know the method and the criteria for the scope, that there is a record of training or experience and that nobody audits their own work. Impartiality is a requirement of clause 9.2.2 and, when it fails, it undermines the credibility of the whole report.

C. Preparation. Before fieldwork, prepare open questions per process, define samples (records, periods, customers, suppliers), review the period’s indicators and complaints, and set aside documents in their current revision. Arriving without defined samples is the shortest path to conclusions based on memory.

D. Execution. Open with a short meeting to confirm scope, agenda and criteria. Observe the process in practice and cross-check at least two sources for each finding (document, interview and record). Note strengths too: an audit that only lists failures loses the trust of the people audited.

Part 2: afterwards

E. Evidence and findings. Record the fact: where, when and how many samples. “8 of 12 records without a deadline” is verifiable; “the area does not control deadlines” is an opinion. Each finding cites the criterion, describes its impact and is validated with the process owner before closing.

F. Reporting and closing meeting. The report needs scope, criteria, date, areas, evidence and conclusions, and results should reach management and feed the management review (clause 9.3). Nobody should learn of a nonconformity only by reading the report.

G. Actions and effectiveness. This is the longest stage and the most neglected. For each nonconformity, check correction or containment, cause analysis proportionate to risk, an action with an owner, deadline and evidence of completion, a search for similar cases in other areas, and effectiveness verification before closing. Without it, a finding is just a memory of a meeting. The guide to nonconformity management details this flow.

H. Records and traceability. Programme, plans, reports and evidence are documented information. They must be retrievable by audit, process and period, and the history should show how findings evolved from one cycle to the next.

How to use the checklist without creating bureaucracy

1. Before the audit, go through stages A to C with whoever owns the programme. If a point is still open, resolve it before setting the date.
2. During, carry stage D as a printed or on-screen reminder. There is no need to tick items one by one in front of the auditee.
3. Right afterwards, use E and F to review the report before sending it, especially with more than one auditor. Classification into conformity, opportunity for improvement and nonconformity must be consistent.
4. In the following weeks, return to G and H at fixed intervals. Overdue actions without effectiveness verification are the clearest sign the cycle did not close.

Where manual work weighs most

The points that fail most are those that depend on tracking information for a long time: action deadlines, current document versions, scattered evidence and history across cycles. When this lives in spreadsheets, emails and separate folders, the next audit starts by looking for what the previous one already found.

Konvéz Quality brings the audit plan, findings, nonconformities, actions and documents into one traceable flow, with an owner and deadline on each item. The checklist solves the method; the system helps you keep the thread afterwards.

This material is a support guide and does not replace the standard, your organization’s audit procedure or the assessment of a qualified professional.

Sources and references

• ISO 9001: Quality management systems
• ISO 19011: Guidelines for auditing management systems

Frequently asked questions

Does the checklist replace my company's audit procedure?

No. It is a support guide to check that nothing was missed. The audit procedure, the criteria and the assessment of qualified professionals remain the organization's responsibility.

Can I use the checklist for any process?

Yes, because the points address the audit method (planning, evidence, findings and actions) rather than a specific process. Adapt the questions and samples to the scope you are auditing.

Does the checklist cite ISO 9001 clauses?

Yes. References follow ISO 9001:2015, mainly clause 9.2 (internal audit), plus 7.2, 7.5, 9.3 and 10.2. Confirm the numbering in the version of the standard your organization uses.

Is a checklist enough for a good audit?

It helps you avoid skipping steps, but it should not limit the audit. Open questions, observation of real work and cross-checking sources reveal what a closed list does not.