ISO 9001 audit criteria: how to define and apply them

ISO 9001 audit criteria are the references used to compare objective evidence and determine whether a process conforms. They may include standard requirements, policies, procedures, contracts, legal obligations and controls defined by the organization. Criteria describe what should happen; evidence shows what happened; a finding records the result of that comparison.

This distinction matters. Vague criteria turn an audit into an exchange of opinions. Clear criteria show which reference was applied, what fact was observed and why the conclusion can be supported.

Audit criteria, evidence and findings

Element	Question answered	Example
Audit criterion	What should be fulfilled?	The procedure requires approval before publication
Objective evidence	What was verified?	The history shows approval on September 8
Audit finding	What does the comparison show?	The document was published after approval: conformity
Audit conclusion	What does the set of findings indicate?	The sampled control is implemented and effective

ISO 19011:2026 explains that audits may use, separately or together, management-system standards, organizational policies and processes, statutory and regulatory requirements, and management-system plans. Auditing ISO 9001 therefore involves more than following isolated clauses: it tests how applicable requirements work in the actual process.

What can be used as audit criteria?

• applicable ISO 9001 and other adopted standard requirements;
• QMS policy, objectives and procedures;
• customer requirements, contracts and specifications;
• applicable laws, regulations and licences;
• acceptance criteria, indicators and operational limits;
• organizational plans, risks, controls and decisions;
• actions agreed after previous audits or reviews.

Not every source belongs in every audit. Selection follows the objective and scope. A purchasing audit, for example, may focus on supplier approval, purchase authorization and performance evaluation rather than a broad list of every QMS requirement.

How to build an audit criteria matrix

1. Start with the objective and scope

State which decision the audit must support. “Audit Purchasing” is broad. “Evaluate whether critical suppliers are selected, monitored and re-evaluated according to risk and performance” gives the team a verifiable direction.

Record the processes, sites, period, products or services included. This prevents requirements from being applied out of context and conclusions from being extended beyond the sample.

2. Identify applicable references

Locate current versions of standards, procedures, contracts and obligations. Do not paste entire documents into the checklist. Extract the requirement to be evaluated and preserve its source, code, revision and relevant section.

3. Link the criterion to risk and results

A criterion becomes useful when the auditor understands what it protects. Supplier approval may control delivery, specification or regulatory risk. This relationship guides sampling and helps the auditor evaluate effectiveness instead of merely checking completed fields.

4. Anticipate possible evidence

For each criterion, note sources that may support verification: interviews, observations, records, indicators, measurements or tests. This prepares the auditor without limiting professional judgement. The ISO 9001 Auditing Practices Group advises auditors to seek relevant evidence and evaluate it objectively against the criteria.

5. Validate the matrix before execution

Confirm the scope, current documents and contacts with the process owner. Validation is not a negotiation of the outcome; it prevents surprises about references, periods and boundaries.

Practical matrix example

Process or risk	Criterion and source	Possible evidence	Sample	Expected result
Obsolete document in use	PR-02 rev. 6: publish only after approval	revision history and point-of-use access	5 critical documents	only current versions available
Poor supplier performance	purchasing procedure and contract	evaluation, deliveries, actions and review	3 critical suppliers	decision reflects risk and performance
Ineffective corrective action	NC procedure and effectiveness rule	cause, plan, evidence and recurrence	actions closed this quarter	effectiveness verified before closure
Indicator without a decision	quality objective and analysis rule	source data, trend and minutes	last 6 periods	analysis produces action and follow-up

The “expected result” column makes questions more useful. Instead of asking “Is there a supplier evaluation?”, ask “How does performance change the decision to retain, develop or suspend a supplier?”

Mistakes that weaken audit criteria

• listing only a clause number without explaining the applicable requirement;
• treating an online checklist as an organizational rule;
• citing a procedure without identifying its current revision;
• confusing an auditor preference with a mandatory requirement;
• checking only for documents, without testing implementation and results;
• using leading questions;
• expanding criteria after a problem is found without communicating the change.

A nonconformity needs an identifiable criterion and verifiable supporting evidence. Without an applicable reference there may be an improvement opportunity, but not a requirement invented by the auditor.

How to write a traceable finding

Use the sequence criterion → evidence → comparison → finding.

Example: “Procedure PR-02, revision 6, requires approval before publication. For documents X and Y, published on September 4 and 6, the history contained no approval before availability. The sample does not fulfil the defined criterion.”

This format separates source, fact and conclusion. Avoid statements such as “the control is poor” or “the team is disorganized”, which cannot be reproduced objectively.

To strengthen evidence collection, read our guide to objective evidence in ISO 9001. For the complete workflow, see how to plan and conduct an ISO 9001 internal audit.

How Konvéz Quality supports audits

In day-to-day work, criteria often live in spreadsheets separated from evidence, findings and actions. This makes it harder to know which revision was used and reconstruct the decision later.

With Konvéz Quality, teams can connect controlled documents, audits, risks, nonconformities, owners and actions in one traceable flow. The system does not replace auditor judgement; it preserves context so the conclusion is clear and progress can be demonstrated.

Official sources consulted

• ISO 19011:2026 — Guidelines for auditing management systems
• ISO 9001 — Quality management systems — Requirements
• ISO 9001 Auditing Practices Group — Evidence collection
• ISO 9001 Auditing Practices Group — Auditing digital processes

Well-defined criteria make audits fairer and more useful. The team knows which reference guides the work, the auditor seeks evidence proportionate to risk and the organization receives a conclusion it can turn into measurable improvement.

Frequently asked questions

What are ISO 9001 audit criteria?

They are the references used to evaluate objective evidence, including applicable ISO 9001 requirements, policies, procedures, laws, contracts and controls defined by the organization.

Is an audit criterion always an ISO 9001 clause?

No. A clause may be part of the criteria, but the audit may also consider internal procedures, customer requirements, legal obligations, indicators and other controls relevant to the scope.

What is the difference between audit criteria and audit evidence?

Criteria describe what should be fulfilled. Evidence is the verifiable information observed during the audit. A finding results from comparing the evidence with the criteria.

Is an audit checklist mandatory?

ISO 9001 does not prescribe one checklist format. An organization may use a matrix, question guide or another resource that covers the scope without restricting investigation of the real process.

How can generic audit criteria be avoided?

Link every reference to a process, risk, control and expected result. Record the document version and use questions that test implementation and effectiveness, not merely whether a file exists.