An ISO 9001 internal audit checklist is a working aid for evaluating processes. It should connect relevant requirements to questions, evidence and conclusions. A list of clause numbers with yes or no boxes can help navigation, but it cannot replace judgement about whether the system works.
Build the checklist for the audit’s objectives and scope. The internal audit guide provides the wider sequence from programme planning through follow-up. The checklist is one tool within that sequence, not a separate certification requirement or a substitute for the official standard.
Start with criteria and process boundaries
Identify which processes and interfaces the audit will cover. Review applicable requirements, current procedures, customer commitments and relevant obligations. Cite the actual criterion and its version rather than inserting remembered wording from a different edition.
A process-oriented checklist can follow a transaction from requirement review to delivery. It can also include targeted questions about supporting activities such as competence, purchasing or measuring equipment. The structure should help the auditor see connections without forcing every department into an identical interview.
Distinguish a criterion from a suggested question. The organisation may choose a different method from the one an auditor expects. That is not a failure if the applicable requirement is met and the evidence supports the result.
Use fields that preserve the audit trail
A useful checklist normally has space for the criterion, the question, evidence references, the sample examined, the result and any further enquiry. These fields are suggested design choices. They can be implemented on paper, in a spreadsheet or in audit software.
Avoid recording only the word satisfactory. Another reviewer should be able to identify what was examined and why it supported the conclusion. Protect confidential information by referring to controlled record identifiers where copying full personal or customer information is unnecessary.
| Process question | Possible evidence | Further enquiry |
|---|---|---|
| How are changed requirements reviewed? | Changed order, approval and communication | Did operations receive the final version? |
| How is competence confirmed? | Assignment criteria and observed performance | Was the person assessed for this task? |
| How is an exception released? | Exception record and authorisation | Was customer agreement needed? |
| How are supplier problems addressed? | Rejection history and supplier action | Did later deliveries improve? |
These questions are original examples. They are not copied clause text or a complete checklist for every organisation.
Ask questions that can reveal how work happens
Open questions often produce more informative explanations than requests for confirmation. Ask someone to show how a recent change was handled rather than asking whether changes are controlled. Follow the answer into evidence, including exceptions or unusual conditions.
Do not turn the checklist into a script that prevents listening. If an interview reveals that a service is partly outsourced, examine the relevant handover and control arrangements. If performance data contradicts the procedure, investigate the difference instead of ticking the procedure box and moving on.
The companion article on audit questions explains how to progress from broad enquiry to a specific evidence trail without coaching the interviewee toward a desired answer.
Select evidence deliberately
Include prompts for sampling across meaningful variation. Possible distinctions include different shifts, customer types, product families, changed specifications and previous problem cases. These choices should reflect the audit objectives rather than a fixed universal sample size.
Record relevant limitations. If night-shift work was outside the audit scope, do not imply that the checklist established conformity for every shift. If access failed for a required record, determine whether the problem is a temporary access limitation or evidence of a control failure.
A checklist that requests one favourable example from each process owner risks becoming a demonstration exercise. The auditor should retain responsibility for selection and for pursuing contradictory evidence.
Separate notes from findings
Working notes can capture questions that need investigation. A final finding should be supported by a requirement and reliable evidence. Do not automatically convert every unchecked item into a nonconformity: the question itself may be inapplicable, poorly drafted or broader than the criterion.
Equally, do not dismiss an unmet requirement because the checklist lacks a matching row. Audit scope and criteria govern the evaluation. Where a finding is justified, describe the evidence and the gap clearly in the report.
If the organisation grades internal findings, define the method. Avoid assuming that every certification body’s major and minor categories apply automatically to internal audits. Grading should support appropriate response, not obscure the requirement that was missed.
Maintain the checklist as processes change
Review the aid after audits, process changes, revised requirements and significant incidents. Remove obsolete references, clarify ambiguous prompts and add questions where earlier coverage was weak. Preserve the completed checklist as an audit record under the organisation’s controls.
A reusable master can save time, but each assignment still needs preparation. A purchasing audit should not blindly carry questions intended for a design function that is outside its scope. Conversely, deleting difficult questions simply to obtain a clean result defeats the purpose.
The test of a good checklist is practical: does it help the auditor obtain relevant evidence, retain context and reach a defensible conclusion? Its length, colour scheme and completion percentage are secondary to that purpose.