An effective ISO 9001 internal audit checklist template 2026 should do much more than give an auditor a list of questions to tick off. It should help the auditor connect ISO requirements with real business processes, objective evidence, risks, customer requirements, performance results, and opportunities for improvement. 

This guide explains how to plan and perform a practical internal audit, what to check, how to record evidence, how to classify findings, and how to use audit results to strengthen the quality management system (QMS). 

It is written primarily for U.S. organizations, including manufacturers, engineering companies, construction and service organizations, healthcare-related businesses, technology companies, distributors, and small and medium-sized businesses.

Important 2026 update: ISO 9001:2026 was published on September 16, 2026, and it is now the current edition. ISO lists ISO 9001:2015 as withdrawn. Organizations certified to ISO 9001:2015 should therefore treat a 2015-based checklist as a transition tool and confirm the transition plan with their certification body. Existing certified organizations have until September 30, 2029, under the published transition arrangements, to complete the transition to ISO 9001:2026.

What Is an ISO 9001 Internal Audit?

An internal audit is a planned and systematic examination of an organization’s QMS to determine whether its processes conform to defined requirements and whether the system is effectively implemented and maintained.

In simple terms, an auditor is asking:

“Are we doing what we said we would do, are we meeting the applicable requirements, and is the process producing the intended results?”

An internal audit is not supposed to be a paperwork inspection.

For example, suppose a manufacturing company has a purchasing procedure stating that suppliers must be evaluated before being approved. A weak audit may simply check whether the supplier evaluation form exists.

A useful audit goes further:

• How are suppliers selected?
• What criteria are used?
• Who approves them?
• Are critical suppliers treated differently?
• Is supplier performance monitored?
• What happens when a supplier repeatedly delivers defective material?
• Are purchasing decisions based on current supplier performance?
• Can employees explain the process?
• Do records support what employees say?

That difference is what separates a useful internal audit from a checklist exercise.

ISO 19011 provides guidance for auditing management systems, including audit principles, audit-program management, conducting audits, and auditor competence. The 2026 edition of ISO 19011 also places clear emphasis on evidence-based and risk-based auditing.

Why Internal Audits Matter to a QMS

Internal audits provide management with an independent view of how the QMS is working.

They can identify problems before those problems become:

• Customer complaints
• Product failures
• Delivery problems
• Rework
• Scrap
• Regulatory issues
• Supplier problems
• Repeated corrective actions
• Certification audit findings

The value becomes especially clear when an organization moves away from the idea that “zero findings” means a successful audit.

A department can have zero findings because the auditor did not look deeply enough.

Conversely, a well-run audit can identify several improvement opportunities without indicating that the QMS is failing.

The objective is reliable information for management decision-making.

ISO states that ISO 9001 is used by more than one million organizations worldwide across 189 countries, demonstrating the broad adoption of formal quality management systems. The standard is not limited to large manufacturers; it can be applied to organizations of different sizes and sectors.

What Does Clause 9.2 Require?

For organizations working with ISO 9001:2015, clause 9.2 internal audit is the key requirement governing internal audits.

The requirement establishes the need for an audit process that determines whether the QMS:

1. Conforms to the organization’s own requirements.
2. Conforms to applicable ISO 9001 requirements.
3. Is effectively implemented and maintained.

The organization must also plan, establish, implement, and maintain an audit programme.

The programme should consider factors such as:

• Process importance
• Changes affecting the organization
• Results of previous audits
• Other relevant risks and opportunities

The organization also needs to define audit criteria and scope for each audit.

Auditors should be selected and audits conducted in a way that maintains objectivity and impartiality.

The organization must also ensure that audit results are reported to relevant management and that appropriate corrections and corrective actions are taken without undue delay when needed.

Finally, documented information must be retained as evidence that the audit programme was implemented and that the audit results were obtained.

A Simple Example of Clause 9.2 in Practice

Imagine a U.S. precision-machining company with four major processes:

• Sales and contract review
• Purchasing
• Production
• Inspection and testing

The company does not need to audit every process with the same depth every month.

If supplier performance has deteriorated significantly, purchasing may receive greater audit attention.

If customer complaints have increased about dimensional accuracy, production and inspection may need to be audited more deeply.

This is the practical meaning of risk-based auditing.

ISO 9001 Internal Audit vs. Certification Audit

An internal audit and an external certification audit are not the same thing.

An internal audit is conducted for the organization’s own management and improvement purposes.

A certification audit is conducted by an independent certification body to determine whether the organization meets the applicable certification requirements.

The internal auditor should therefore not attempt to copy the certification auditor.

Instead, the internal audit should help the organization understand where its QMS is strong, where it is weak, and where action is needed.

A good internal audit should ideally find problems while the organization still has time to correct them.

First-Party, Second-Party, and Third-Party Audits

It is useful to understand the basic difference:

This article focuses primarily on first-party internal audits.

What Is an ISO 9001 Audit Checklist?

An ISO 9001 audit checklist is a structured tool used by an auditor to plan questions, identify evidence to review, record observations, and determine whether audit criteria have been met.

However, a checklist should never become a script that prevents the auditor from following evidence.

A strong checklist normally contains fields such as:

The checklist should support auditor thinking rather than replace it.

Checklist-Based Auditing vs. Process-Based Auditing

One of the most common mistakes is auditing the standard clause by clause without understanding how the organization actually works.

Consider a customer order.

A real order may move through:

Customer inquiry → quotation → contract review → purchasing → planning → production → inspection → shipment → invoicing → customer feedback

Several ISO requirements can be involved in this single flow.

A process-based audit follows the flow and asks whether the controls work.

A clause-based audit may ask:

“Show me your documented information for clause X.”

A process-based auditor might instead ask:

“Show me three recent customer orders. How did you determine the requirements, who reviewed them, what changed after acceptance, and how did the organization communicate those changes to production?”

The second approach usually produces much stronger evidence.

How to Build an Internal Audit Procedure

An internal audit procedure should explain how your organization plans, performs, reports, and follows up internal audits.

A practical procedure can contain the following steps:

Step 1: Establish the Audit Programme

Define what processes will be audited during the audit cycle.

Consider:

• Process importance
• Business risk
• Customer complaints
• Previous audit findings
• Process performance
• Organizational changes
• New products or services
• Supplier problems
• Regulatory concerns

Do not automatically assume that every process deserves equal audit time.

Step 2: Define Audit Objectives

Each audit should have a clear objective.

For example:

“Determine whether the purchasing process is effectively implemented and whether supplier controls are adequate to ensure purchased products meet specified requirements.”

This is much better than:

“Audit purchasing.”

The first statement tells the auditor what the audit is expected to determine.

Step 3: Define Scope and Criteria

The audit scope tells people what will be examined.

For example:

Scope: Purchasing activities for production materials at the Texas manufacturing facility.

Criteria:

• Applicable QMS procedures
• ISO requirements
• Approved supplier controls
• Purchase-order requirements
• Customer-specific requirements
• Applicable contractual requirements

Clear scope prevents confusion and keeps the audit focused.

Step 4: Select a Competent Auditor

The auditor should have appropriate knowledge of:

• Auditing methods
• The QMS
• Relevant processes
• Applicable requirements
• Evidence evaluation
• Interview techniques
• Finding classification
• Report writing

An auditor does not necessarily need to be the organization’s most senior quality employee.

In fact, excessive hierarchy can sometimes discourage employees from speaking openly during interviews.

Step 5: Protect Auditor Independence

Whenever practical, auditors should not audit their own work.

For example, the person responsible for creating and approving a procedure should not be the sole auditor responsible for determining whether that same procedure is effectively implemented.

Small companies often have limited personnel.

In that situation, organizations can use cross-functional auditors, trained employees from another department, or qualified external assistance where appropriate.

What Evidence Should an Auditor Collect?

Audit conclusions should be based on objective evidence.

Evidence may include:

• Records
• Work orders
• Purchase orders
• Inspection reports
• Training records
• Customer complaints
• Calibration records
• Process measurements
• Production data
• Interviews
• Direct observations
• Electronic system records
• Approved specifications
• Contracts
• Management review outputs
• Corrective-action records

An auditor should avoid relying on statements alone.

For example, an employee may say:

“We always inspect incoming material.”

The auditor should then ask:

“Show me the last three incoming inspections.”

This creates a bridge between what people say and what the process actually does.

The Evidence Triangle

A useful auditing technique is to compare three sources:

Interview + Observation + Record

If all three tell the same story, confidence in the conclusion increases.

For example:

• Employee explains the inspection process.
• Auditor observes an inspection being performed.
• Inspection records demonstrate that the inspection was completed and reviewed.

That is much stronger than an interview alone.

Sampling During an Internal Audit

Auditors usually cannot examine every transaction.

Sampling is therefore an important part of auditing.

Suppose a company processed 2,400 purchase orders during the year.

An internal auditor may select a reasonable sample based on:

• Risk
• Process complexity
• Previous findings
• Supplier criticality
• Changes
• Transaction volume
• Audit objectives

The sample should be representative enough to support a reasonable audit conclusion.

For example, if the company operates three shifts but the auditor examines only first-shift activities, the audit may miss important differences.

Similarly, if an auditor reviews only successful projects, the audit may overlook weaknesses associated with delayed or failed projects.

Sampling should be intentional, not random simply for convenience.

Common Mistakes When Using an Audit Checklist

A checklist becomes ineffective when auditors use it mechanically.

Common problems include:

• Asking questions without examining evidence
• Checking documents without checking implementation
• Auditing only the quality department
• Ignoring process performance
• Using the same checklist for every department
• Failing to consider previous findings
• Recording vague findings
• Writing findings based on personal preference
• Treating every observation as a nonconformity
• Focusing on paperwork instead of process effectiveness

One of the most serious mistakes is confusing “missing documentation” with “nonconformity” without first determining whether the requirement actually requires documented information.

The organization should audit against the applicable requirement, not against the auditor’s personal preference.

What Makes a Good Audit Question?

Good QMS audit questions are open enough to encourage explanation but specific enough to produce verifiable evidence.

Weak question:

“Do you follow the procedure?”

Better question:

“Walk me through how you process a customer order from receipt through release to production.”

Even better:

“Show me two recently completed customer orders and explain how the organization reviewed customer requirements, communicated changes, and confirmed the final output met those requirements.”

The third question connects:

Process + evidence + actual transactions + requirements.

That is the foundation of effective auditing.

A Practical 2026 Audit Mindset

Organizations using a 2015-based checklist in 2026 should avoid treating it as the final authority.

ISO 9001:2026 is now the current edition, and ISO has confirmed that it replaces ISO 9001:2015. Existing certified organizations have a transition period, but the organization should not wait until the final deadline to understand what has changed.

For internal auditors, the practical approach is:

1. Continue understanding the organization’s current certified QMS.
2. Identify where the 2015 requirements are currently being audited.
3. Obtain and study the applicable ISO 9001:2026 requirements.
4. Compare the existing QMS against the new edition.
5. Update the audit programme.
6. Update audit questions where requirements have changed.
7. Train auditors on the revised requirements.
8. Integrate transition findings into the organization’s improvement activities.
9. Confirm transition expectations with the certification body.
10. Avoid creating duplicate systems unnecessarily.

The transition should be treated as a QMS improvement project, not simply a document-revision exercise.

The 2026 Transition: What U.S. Organizations Should Know

ISO 9001:2026 was published on September 16, 2026.

Published transition guidance states that accreditation bodies are to be ready to assess ISO 9001:2026 no later than March 31, 2027. From March 31, 2028, new and initial accredited certifications may only be issued to ISO 9001:2026. Organizations already certified to ISO 9001:2015 have until September 30, 2029, to complete the transition.

This creates an important window for U.S. companies.

There is no good reason to throw away a functioning 2015 audit system immediately. Instead, organizations should map their existing audit programme to the new edition and progressively update their audit questions, evidence expectations, auditor competence, and reporting process.

A company with an annual audit programme, for example, can use upcoming audits to identify transition-related gaps rather than waiting for a separate large-scale compliance project.

What Should Be Included in the Complete Audit Checklist?

A useful checklist should eventually cover more than individual ISO clauses.

The complete tool should address:

• Audit objectives
• Audit scope
• Audit criteria
• Audit programme
• Auditor assignment
• Process owners
• Previous findings
• Process risks
• Customer requirements
• Applicable legal and regulatory requirements
• Process performance
• QMS requirements
• Documented information
• Employee competence
• Operational controls
• Supplier controls
• Monitoring and measurement
• Customer feedback
• Nonconformities
• Corrective actions
• Management review inputs
• Improvement activities
• Audit conclusions
• Follow-up actions

The remaining parts of this guide will turn these concepts into a practical working tool.

Key Takeaways So Far

Before conducting your next internal audit, make sure you can answer these questions:

• What is the audit objective?
• What process is being audited?
• What are the audit criteria?
• What risks should receive greater attention?
• What happened during previous audits?
• Who is competent and independent enough to audit the process?
• What evidence will demonstrate conformity?
• What samples will be reviewed?
• How will findings be recorded?
• Who will receive the audit results?
• How will corrective action be verified?
• How will the audit contribute to QMS improvement?

The best internal audit is not the one with the longest checklist.

It is the one that gives management a clear, evidence-based picture of process performance and QMS effectiveness.

That principle will guide the detailed checklist, clause-by-clause audit questions, evidence examples, finding classification, audit report structure, and free template developed in the next parts.

The Complete ISO 9001 Internal Audit Checklist

A strong internal audit checklist should help an auditor move from the requirement to the process, from the process to objective evidence, and from evidence to a clear conclusion. It should not simply reproduce the wording of the standard.

For organizations still operating under ISO 9001:2015 during the transition to ISO 9001:2026, the following checklist can be used as a practical 2015-based audit framework. It should then be mapped against the organization’s applicable 2026 requirements before the next audit cycle. ISO itself explains that the 2026 edition maintains the established ISO 9001 framework while introducing targeted changes intended to improve clarity, usability, quality culture, leadership, and the treatment of risk and opportunity.

How to Use This Checklist

For every question, the auditor should avoid simply marking Yes or No.

Instead, use the following audit trail:

Requirement → Question → Evidence → Evaluation → Finding → Action

For example:

Question: How are customer requirements reviewed before an order is accepted?

Evidence: Three recent customer orders, contract review records, email communications, and ERP entries.

Evaluation: Requirements were reviewed and approved in all three samples.

Result: Conforming.

If one order was accepted without the required review, the auditor should investigate whether this was an isolated error or evidence of a wider process weakness.

Clause 4: Context of the Organization

The first area of the audit examines whether the organization understands the factors that can affect its ability to achieve intended QMS results.

4.1 Understanding the Organization and Its Context

Ask:

• What internal factors affect quality performance?
• What external factors could affect the QMS?
• How are significant changes identified?
• How are changes in customers, technology, markets, regulations, suppliers, or operations evaluated?
• How does management determine whether these issues remain relevant?
• How are important changes communicated to affected functions?

Evidence to review:

• SWOT or business analysis
• Strategic planning records
• Risk registers
• Management meeting records
• Business plans
• Market or customer information
• Regulatory updates
• Process performance data

4.2 Interested Parties

The auditor should determine whether the organization understands relevant interested parties and their applicable requirements.

Potential interested parties may include:

• Customers
• Employees
• Regulators
• Owners
• Suppliers
• Contractors
• Certification bodies
• Government agencies
• Local authorities
• Business partners

For a U.S. manufacturer, an auditor might ask:

“Which customer-specific requirements apply to your three largest customers, and where are those requirements controlled?”

That question is more useful than simply asking whether an interested-party list exists.

Climate Change Considerations

Organizations should also consider the applicable climate-change amendment requirements incorporated into ISO 9001:2015 concerning clauses 4.1 and 4.2.

An auditor can ask:

• Has the organization determined whether climate change is a relevant issue?
• Have relevant interested parties communicated climate-related requirements?
• Could climate-related conditions affect suppliers, logistics, infrastructure, production, or service delivery?
• Where relevant, have those issues been incorporated into the QMS?

The objective is not to force every organization to create a climate programme.

The objective is to determine whether relevant issues have been considered appropriately.

Clause 5: Leadership

Internal auditing should not stop at the quality department.

ISO 9001 places significant responsibility on top management for the effectiveness of the QMS.

5.1 Leadership and Commitment

Questions may include:

• How does top management demonstrate responsibility for QMS effectiveness?
• How are customer requirements integrated into business processes?
• How does management promote process thinking?
• How are quality objectives connected with business objectives?
• How does leadership support continual improvement?
• How does management respond to recurring quality problems?

Evidence may include:

• Management meeting minutes
• Business objectives
• Quality objectives
• Performance dashboards
• Investment decisions
• Resource approvals
• Corrective-action reviews
• Customer complaint reviews

Real-World Example

Suppose a company’s customer complaint rate has increased for six consecutive months.

The quality manager has opened corrective actions, but management continues to approve the same production process without additional resources.

An internal auditor should not automatically conclude that leadership is nonconforming.

However, the auditor should investigate whether management is actually evaluating QMS performance, providing appropriate resources, and addressing recurring problems.

The audit trail might extend from:

Complaint data → corrective action → management review → resource decision → process performance

That is a process-based audit.

5.2 Quality Policy

The auditor should verify whether the quality policy is:

• Appropriate to the organization’s purpose and context
• Used as a framework for quality objectives
• Communicated within the organization
• Understood by relevant employees
• Available to relevant interested parties where appropriate
• Maintained as documented information

Do not audit this only by asking employees to recite the policy.

Instead, ask an employee:

“What does the company’s quality commitment mean for your job?”

A production operator may answer:

“It means I don’t pass material forward if I find a defect.”

That response may provide stronger evidence of awareness than simply repeating a sentence from the quality policy.

5.3 Roles, Responsibilities, and Authorities

Check whether employees understand who is responsible for:

• Process ownership
• Product release
• Nonconforming outputs
• Customer communication
• Corrective actions
• Supplier approval
• Inspection
• Calibration
• Internal auditing

A useful question is:

“If you discover a serious product defect today, who has authority to stop or hold the process?”

Then verify the answer against actual organizational arrangements.

Clause 6: Planning

Planning requirements connect quality objectives, risks, opportunities, and changes.

6.1 Risks and Opportunities

A mature audit should not merely check whether a risk register exists.

Ask:

• What are the significant risks affecting this process?
• Who identified them?
• What controls were established?
• How are controls monitored?
• What happens when risk controls are ineffective?
• Have new risks emerged because of organizational changes?
• Are opportunities for improvement considered?

Example: Supplier Risk

A manufacturer depends on one supplier for a critical electronic component.

The supplier has experienced three late deliveries in six months.

A useful audit would examine:

• Supplier performance data
• Risk assessment
• Approved supplier status
• Escalation process
• Alternate-source planning
• Customer impact
• Corrective actions

The auditor is not merely checking whether “supplier risk” appears on a spreadsheet.

The auditor is checking whether the organization manages the actual risk.

6.2 Quality Objectives

Questions:

• What are the organization’s measurable quality objectives?
• Who owns each objective?
• What targets have been established?
• How is progress monitored?
• What happens when targets are missed?
• Are objectives communicated to relevant employees?

Possible metrics include:

• On-time delivery
• First-pass yield
• Customer complaints
• Scrap
• Rework
• Warranty claims
• Supplier defects
• Response time
• Service errors
• Corrective-action closure
• Customer satisfaction

Example

Suppose the quality objective is:

“Reduce customer complaints by 20%.”

The auditor should examine:

1. Baseline data
2. Target
3. Current performance
4. Trend
5. Responsible owner
6. Actions taken
7. Effectiveness of those actions

Simply having the objective posted on a wall is not enough.

Clause 7: Support

Clause 7 covers the resources and supporting controls that allow processes to operate.

7.1 Resources

Check whether resources are adequate for:

• People
• Infrastructure
• Work environment
• Monitoring and measurement
• Organizational knowledge

Ask:

“What resource limitation currently creates the greatest risk to this process?”

This question can uncover issues that a traditional checklist might miss.

7.1.5 Monitoring and Measuring Resources

For equipment used to verify product or service conformity, examine:

• Calibration status
• Verification records
• Identification
• Traceability where required
• Equipment condition
• Protection from damage
• Actions taken when equipment is found unsuitable

Example

A company uses digital torque wrenches for critical assembly.

The calibration label is current.

That alone does not close the audit trail.

The auditor should ask:

• Is the correct wrench being used?
• Is the range appropriate?
• Is the equipment protected?
• What happens if calibration fails?
• Are affected products evaluated?
• Are records maintained?

This turns a simple equipment check into an effectiveness audit.

7.2 Competence

Questions:

• What competence is required for each important role?
• How are competence needs identified?
• How are employees trained or otherwise qualified?
• How is competence evaluated?
• What happens when an employee is not yet competent?

Evidence may include:

• Training records
• Qualification matrices
• Certifications
• Skills assessments
• Supervisor evaluations
• Job descriptions
• Practical demonstrations

Training Example

An employee completed a two-hour training course on inspection equipment.

The record shows attendance.

But can the employee correctly use the equipment?

The auditor should observe the employee performing the task or review other evidence that demonstrates competence.

This is why internal auditor training should teach evidence evaluation, not merely clause memorization.

7.3 Awareness

Employees should understand relevant aspects of the QMS, including:

• Quality policy
• Relevant quality objectives
• Contribution to QMS effectiveness
• Benefits of improved performance
• Consequences of not following requirements

Ask employees questions in normal language.

Avoid turning the audit into an examination.

Instead of:

“What is clause 7.3?”

ask:

“What could happen to the customer if this step is skipped?”

That produces more meaningful evidence.

7.4 Communication

Audit:

• What needs to be communicated?
• When?
• To whom?
• By whom?
• How is communication controlled?

Sample:

• Customer changes
• Engineering changes
• Quality alerts
• Supplier issues
• Production instructions
• Inspection requirements
• Safety or regulatory information where applicable

7.5 Documented Information

The auditor should examine whether required documented information is:

• Available when needed
• Suitable for use
• Properly controlled
• Protected from unintended changes
• Retained when required
• Available at the correct point of use

Do not assume every document needs to be printed.

Modern QMS environments may use:

• ERP systems
• Cloud platforms
• Document-management systems
• Electronic work instructions
• Digital inspection systems
• Controlled databases
• Mobile applications

The audit should evaluate the control, not whether the organization uses paper.

ISO’s Auditing Practices Group specifically recognizes the importance of auditing digital processes and following process evidence through electronic systems.

Clause 8: Operation

For most organizations, operational auditing provides some of the richest evidence.

8.1 Operational Planning and Control

Ask:

• How is work planned?
• What requirements must be met?
• What acceptance criteria apply?
• What records demonstrate completion?
• How are process changes controlled?
• How are outsourced processes controlled?

Follow an actual transaction wherever possible.

For example:

Customer order → planning → material → production → inspection → release → shipment

This single audit trail may provide evidence for numerous QMS requirements.

8.2 Customer Communication

Check how the organization manages:

• Product/service information
• Inquiries
• Quotes
• Orders
• Changes
• Complaints
• Customer feedback
• Contingency communications where relevant

A useful sample could include three recent customer complaints.

Trace each complaint from receipt through:

Complaint → investigation → response → correction → root-cause analysis → corrective action → effectiveness review

This can expose weaknesses that would remain hidden during a document-only audit.

8.2 and 8.3: Review, Design, and Development

Where design and development applies, audit:

• Inputs
• Outputs
• Reviews
• Verification
• Validation
• Changes
• Responsibilities
• Interfaces
• Customer requirements
• Applicable statutory or regulatory requirements

Example

An engineering company develops a new industrial control panel.

The auditor may select one recently completed project and trace:

1. Customer requirements
2. Design inputs
3. Design calculations
4. Review records
5. Design verification
6. Validation
7. Change history
8. Final approval

This is much stronger than checking whether a design procedure exists.

8.4 Control of External Providers

This area is especially important in organizations with significant outsourcing.

Audit:

• Supplier selection
• Approval
• Evaluation
• Re-evaluation
• Supplier performance
• Purchase requirements
• Verification of purchased products/services
• Supplier corrective actions
• Critical supplier controls

Useful evidence includes:

• Approved supplier lists
• Supplier scorecards
• Purchase orders
• Supplier audit reports
• Certificates
• Incoming inspection records
• Supplier complaints
• Performance trends

Supplier Example

A company has an approved supplier with a 97% on-time delivery rate but a 14% incoming defect rate.

If the organization continues to classify the supplier as “excellent” without action, the auditor should investigate how supplier performance is evaluated and whether the evaluation criteria actually reflect quality risk.

8.5 Production and Service Provision

Audit whether production or service activities occur under controlled conditions.

Possible evidence:

• Work instructions
• Process parameters
• Inspection requirements
• Competent personnel
• Equipment
• Monitoring records
• Product identification
• Traceability
• Release records

Shop-Floor Audit Example

Instead of sitting in a conference room, the auditor walks to the production line.

The auditor selects one active work order and asks:

“Show me the current drawing.”

Then:

“How do you know this revision is current?”

Then:

“What inspection is required?”

Then:

“Show me the inspection record.”

Then:

“What happens if the part fails inspection?”

This is a vertical audit trail.

It follows one real transaction through multiple controls.

8.6 Release of Products and Services

Check:

• Who is authorized to release output?
• What acceptance criteria apply?
• What records demonstrate acceptance?
• Are incomplete inspections prevented from being released?
• Can the organization identify who authorized release?

For software or services, the evidence may be digital rather than physical.

8.7 Control of Nonconforming Outputs

This is one of the most important operational audit areas.

Audit whether nonconforming outputs are:

• Identified
• Controlled
• Prevented from unintended use or delivery
• Corrected where appropriate
• Re-verified where required
• Properly documented
• Evaluated for customer impact

Examples include:

• Rejected material
• Failed inspections
• Incorrect shipment
• Service errors
• Incorrect documents
• Software defects
• Customer complaints
• Damaged products

The ISO 9001 Auditing Practices Group notes that when a nonconformity exists, the auditor should look at how the organization controls the output and feeds information back into corrective action.

Clause 9: Performance Evaluation

Clause 9 moves the audit toward performance.

A QMS should not only have controls.

It should produce information that management can use.

9.1 Monitoring, Measurement, Analysis, and Evaluation

Ask:

• What does the organization measure?
• Why are these indicators important?
• Who reviews them?
• What trends are visible?
• What happens when performance declines?
• Are customer satisfaction indicators evaluated?
• Are process results analyzed?

Possible evidence:

• KPI dashboards
• Customer surveys
• Complaint trends
• Defect rates
• Delivery performance
• Supplier performance
• Scrap reports
• Rework data
• Service-level performance

Example

A company reports:

On-time delivery = 96%

That number looks positive.

But the auditor discovers that the metric excludes orders that were canceled after the promised date.

The issue may not automatically be a nonconformity, but it raises an important audit question:

“Does the measurement method provide reliable information about the actual performance that management needs to understand?”

That is the level at which internal auditing adds value.

Clause 9.2: Internal Audit

The organization should maintain an effective audit programme.

The auditor should examine:

• Audit programme
• Audit frequency
• Audit criteria
• Audit scope
• Auditor competence
• Auditor independence
• Audit plans
• Audit checklists or work papers
• Evidence collected
• Audit reports
• Findings
• Corrective actions
• Follow-up
• Effectiveness verification

Internal Audit Programme Questions

Ask:

1. How are audits scheduled?
2. Why was this frequency selected?
3. How are high-risk processes identified?
4. Are previous findings considered?
5. Are significant changes considered?
6. Are auditors competent?
7. Are auditors independent from their own work?
8. Are audit results communicated?
9. Are findings corrected?
10. Is corrective action effectiveness verified?

The audit programme itself should be treated as a process.

ISO’s Auditing Practices Group emphasizes process-based and risk-based thinking as central to effective QMS auditing.

Clause 9.3: Management Review

An internal audit should determine whether management review is actually useful.

Check whether management considers relevant information such as:

• Audit results
• Customer feedback
• Process performance
• Product/service conformity
• Nonconformities
• Corrective actions
• Monitoring and measurement
• Supplier performance
• Resource adequacy
• Risks and opportunities
• Improvement opportunities

Then examine outputs.

Are management decisions producing action?

For example, if management repeatedly identifies supplier problems but no supplier-development action is approved, the auditor should follow that trail.

Clause 10: Improvement

The final major area concerns nonconformity, corrective action, and continual improvement.

10.1 General Improvement

Ask:

• How does the organization identify improvement opportunities?
• What data is used?
• How are improvements prioritized?
• Are improvement projects evaluated for effectiveness?

Improvement can include:

• Reducing defects
• Simplifying processes
• Improving delivery
• Reducing customer complaints
• Automating controls
• Improving supplier performance
• Reducing waste
• Improving employee competence

10.2 Nonconformity and Corrective Action

A nonconformity ISO 9001 finding should be based on evidence that a requirement has not been fulfilled.

A good audit finding normally identifies three things:

1. The requirement
2. The objective evidence
3. The statement of nonconformity

The ISO 9001 Auditing Practices Group explains that a properly documented nonconformity should contain the audit evidence, the requirement against which the nonconformity was identified, and the statement of nonconformity. It also stresses that without evidence there is no basis for documenting a nonconformity.

Example of a Weak Finding

“The purchasing process is not effective.”

This is too vague.

Better Finding

“The supplier monitoring process requires supplier performance to be evaluated periodically. For supplier ABC, the required performance evaluation was not completed for the review period ending June 30, 2026. The auditor reviewed the supplier evaluation records and found no completed evaluation for the specified period.”

This finding gives the organization something it can investigate.

Audit Findings Classification

Organizations often use terms such as:

• Major nonconformity
• Minor nonconformity
• Observation
• Opportunity for improvement
• Conformity

However, auditors should be careful about treating these labels as universal ISO 9001 requirements.

The exact classification system may depend on the organization’s audit procedure, certification-body rules, customer requirements, or audit context.

The most important question is whether the evidence supports the conclusion.

A Practical Classification Approach

The organization should define these categories clearly in its own audit procedure.

The ISO 9001 APG guidance specifically warns against using softer labels to avoid documenting an actual nonconformity when evidence demonstrates that a requirement has not been fulfilled.

Corrective Action Audit

A corrective action audit is not complete simply because the responsible department has submitted an action plan.

The auditor should determine:

Was the problem corrected?

Then:

Was the cause addressed?

Then:

Did the action prevent recurrence?

A useful follow-up sequence is:

Step 1: Correction

What was done to address the immediate problem?

Step 2: Cause Analysis

Why did the problem occur?

Step 3: Corrective Action

What action addresses the cause?

Step 4: Implementation

Was the action actually completed?

Step 5: Effectiveness

Did the action work?

Example

Problem:

Five customer orders were shipped with incorrect documentation.

Correction:

The documents were replaced.

Cause investigation:

Employees were using an obsolete template.

Corrective action:

The company revised document controls and implemented controlled electronic templates.

Effectiveness verification:

Three months later, the auditor samples 30 shipments and finds no recurrence.

That is substantially stronger than simply writing:

“Training completed.”

Building a Process-Based Audit Trail

A useful auditor can start anywhere in a process and follow evidence forward or backward.

Forward Audit Trail

Customer requirement → quotation → order → planning → production → inspection → shipment

Backward Audit Trail

Customer complaint → shipment → inspection → production record → material → supplier

The backward approach is especially useful when investigating failures.

Example

A customer reports that 8 out of 100 components failed during installation.

The auditor may trace:

Complaint → affected lot → final inspection → production parameters → operator → equipment → raw material → supplier

This approach can reveal whether the problem is:

• Customer-use related
• Inspection related
• Production related
• Equipment related
• Material related
• Supplier related

The checklist provides structure, but the audit trail provides understanding.

Practical Department-Level Checklist

The following condensed checklist can be used when planning department audits.

Questions Auditors Should Ask on the Shop Floor

A strong auditor does not need to ask dozens of questions.

A few well-selected questions can produce significant evidence.

Try:

• “Show me the current work instruction.”
• “How do you know this is the latest revision?”
• “What happens when the product fails inspection?”
• “Who can release this product?”
• “What happens if this machine is unavailable?”
• “Where do you record this inspection?”
• “What customer requirement is important for this step?”
• “What happens when the process goes outside its normal limits?”
• “How was this employee qualified?”
• “Show me an example of a recent problem and what happened afterward.”

Then follow the evidence.

Do not immediately move to the next checklist question.

How to Audit Remote and Digital Processes

Modern U.S. organizations may have employees, suppliers, customers, and processes distributed across multiple locations.

Internal audits may therefore include:

• Video interviews
• Screen sharing
• ERP records
• Electronic work instructions
• Cloud QMS platforms
• Digital approvals
• Remote observation
• Electronic inspection records
• Workflow histories

However, remote auditing should not become a document-screening exercise.

The auditor still needs to establish objective evidence.

For a digital purchasing process, for example, the auditor might screen-share an actual purchase order and trace:

Purchase request → approval → supplier → purchase order → receipt → inspection → invoice

ISO’s APG guidance on digital processes specifically recommends considering inputs, outputs, interactions, methods, criteria, monitoring, resources, responsibilities, risks, and improvement when auditing processes that may be embedded in software or automated systems.

Auditing QMS Processes That Use AI

This topic is increasingly relevant in 2026.

Organizations may now use AI for:

• Customer service
• Document generation
• Inspection support
• Data analysis
• Forecasting
• Engineering assistance
• Software development
• Supplier analysis
• Quality reporting

The existence of AI does not remove the need for process controls.

An auditor should ask:

• What is the AI system being used for?
• Who is responsible for its output?
• What information does it use?
• What controls exist over incorrect output?
• Are users competent to review AI-generated results?
• Is human verification required?
• What happens when the AI output is wrong?
• Is the system changed or updated in a controlled manner?
• Are relevant records retained?

The ISO 9001 APG published specific guidance on auditing QMSs that use AI in June 2026, showing that AI-enabled processes are now a recognized auditing consideration.

How to Make the Checklist Risk-Based

A simple risk-rating method can help prioritize audit time.

For example:

The organization can establish its own scoring method.

A high-risk process might receive:

• More frequent audits
• Longer audit duration
• Larger samples
• More experienced auditors
• Deeper process tracing

A low-risk stable process may require less audit time.

The important point is that the method should be defined, understood, and consistently applied.

Internal Audit Checklist: Questions by Process

For practical use, the following master questions can be adapted to almost any process:

Process Purpose

• What is the purpose of this process?
• What inputs does it receive?
• What outputs does it produce?
• Who are the customers of the process?
• What criteria define successful performance?

Responsibilities

• Who owns the process?
• Who performs the activities?
• Who has approval authority?
• What happens when the responsible person is unavailable?

Resources

• Are people competent?
• Is equipment adequate?
• Is information available?
• Is infrastructure suitable?

Controls

• What procedures or controls are used?
• What acceptance criteria apply?
• What records are generated?
• How are changes controlled?

Performance

• What is measured?
• What are the targets?
• What trends are visible?
• What happens when performance falls below target?

Risk

• What could go wrong?
• What controls prevent it?
• How do you know the controls work?

Improvement

• What problems have occurred recently?
• What corrective actions were taken?
• Were those actions effective?
• What improvement opportunities have been identified?

These questions can form the backbone of a process-based internal audit.

What the Auditor Should Never Do

An internal auditor should avoid:

• Auditing only documents
• Searching for faults to justify the audit
• Giving management consultancy during evidence collection
• Accepting unsupported explanations
• Writing findings without evidence
• Turning personal preferences into requirements
• Treating every observation as a nonconformity
• Ignoring good practices
• Conducting interviews in an intimidating manner
• Auditing only the quality department
• Closing corrective actions without effectiveness evidence

The ISO 9001 APG describes the auditor’s focus as determining conformity using objective evidence and encourages auditors to look for facts rather than simply faults.

A Simple Auditor’s Working Sheet

A practical audit worksheet can use this structure:

The auditor should record enough information that another competent person can understand why the conclusion was reached.

What Comes Next in the Audit Process

Once the checklist has been completed, the auditor needs to convert the evidence into a clear audit report.

That report should not be a long collection of disconnected notes.

It should tell management:

• What was audited
• What evidence was examined
• What was conforming
• What was not conforming
• What risks were identified
• What corrective actions are needed
• What improvements may add value
• What requires follow-up

The next stage therefore moves from auditing to reporting and corrective action management.

A well-designed audit report template should connect every finding to evidence, a requirement, an accountable owner, a due date, and follow-up verification.

That connection is essential because the purpose of internal auditing is not to produce findings.

The purpose is to provide reliable information that helps the organization control processes, correct problems, prevent recurrence, and improve the QMS.

Key Auditor Action Checklist

Before closing an internal audit, the auditor should confirm:

• Audit scope was covered.
• Audit objectives were addressed.
• Relevant requirements were evaluated.
• Actual processes were observed where appropriate.
• Objective evidence was collected.
• Samples were selected deliberately.
• Employees were interviewed respectfully.
• Process interactions were considered.
• Previous findings were followed up.
• Risks and opportunities were considered.
• Customer requirements were considered.
• Supplier controls were evaluated where relevant.
• Process performance was reviewed.
• Nonconforming outputs were examined.
• Corrective actions were checked for effectiveness.
• Findings were supported by evidence.
• Conclusions were based on audit criteria rather than personal preference.
• Results were communicated to appropriate management.

A checklist becomes powerful when it helps the auditor follow the evidence instead of merely checking boxes.

How to Prepare an Effective Internal Audit Report

An internal audit is not finished when the auditor completes the checklist.

The evidence collected during the audit must be converted into a clear report that management and process owners can understand and act upon.

The current ISO 19011:2026 guidance specifically includes audit-programme management, conducting audits, audit reporting, competence, evidence-based auditing, and risk-based auditing.

A useful audit report should answer five basic questions:

1. What was audited?
2. What evidence was examined?
3. What was found?
4. What requires action?
5. What happens next?

The report should be factual, concise, and traceable.

Recommended Audit Report Structure

A practical report can contain:

ISO’s Auditing Practices Group notes that audit-report content and format can vary according to the organization, audit objective, scope, and audit context.

That means a small company does not need a 30-page report for every internal audit.

A two- or three-page report can be highly effective if it contains sufficient evidence and clear conclusions.

Free ISO 9001 Internal Audit Report Template

The following structure can be copied into Word, Excel, or a QMS platform.

Audit Information

Audit Number: IA-2026-___

Audit Date: __________

Auditor: __________

Process Owner: __________

Department/Process: __________

Location: __________

Audit Scope: __________

Audit Criteria: __________

Audit Objective: __________

Audit Summary

Overall conclusion:

Key strengths identified:

Findings identified:

Improvement opportunities:

Follow-up required:

Finding Register

Auditor Conclusion

Based on the audit activities performed, the sampled evidence indicates that the audited process __________________________.

The conclusion should be supported by the evidence actually reviewed.

How to Write a Strong Nonconformity

One of the most important skills for an internal auditor is writing a finding that another person can understand without asking the auditor to explain it verbally.

The ISO 9001 Auditing Practices Group identifies three essential elements of a well-documented nonconformity:

1. Audit evidence
2. Requirement
3. Statement of nonconformity

It also emphasizes that the finding should be precise because the statement of nonconformity drives correction, cause analysis, and corrective action.

Weak Finding

“Employees are not following purchasing procedures.”

This creates several questions:

• Which employees?
• Which procedure?
• What requirement?
• What evidence?
• How many cases?
• What exactly was not followed?

Stronger Finding

“The purchasing procedure requires supplier performance to be evaluated at defined intervals. During the audit, supplier ABC was selected for sampling. The required performance evaluation for the applicable review period was not available in the supplier record. This demonstrates that the defined supplier-performance evaluation requirement was not fulfilled.”

Now the organization can investigate the problem.

The Three-Part Finding Formula

Use:

Requirement + Evidence + Nonconformity

For example:

Requirement: Approved suppliers are to be periodically evaluated.

Evidence: Three supplier records were reviewed; the required evaluation was missing for Supplier ABC for the applicable period.

Nonconformity: The defined supplier-evaluation requirement was not implemented for the sampled supplier.

This method greatly reduces vague findings.

Major vs. Minor Nonconformity

Many organizations use major and minor classifications, particularly when aligning internal auditing with certification-audit practices.

However, organizations should define their classification method clearly.

The important principle is that classification should reflect the significance and extent of the problem rather than the auditor’s personal opinion.

Possible Major Nonconformity Indicators

A major issue may involve:

• A systemic failure
• Complete absence of a required process
• A significant breakdown affecting QMS effectiveness
• Repeated failure with evidence of inadequate control
• A condition that seriously affects the organization’s ability to meet requirements
• A failure that has widespread impact

Possible Minor Nonconformity Indicators

A minor issue may involve:

• An isolated failure
• A limited lapse in implementation
• A localized record problem
• A limited failure that does not indicate a systemic breakdown

The actual classification should always follow the organization’s defined audit method and applicable certification requirements.

Do not classify an issue as “minor” simply because the auditor wants to make the report look better.

The ISO 9001 APG specifically cautions against using softer labels to avoid documenting an actual nonconformity.

Observation vs. Opportunity for Improvement

An auditor may identify a situation that does not demonstrate nonconformity but could be improved.

For example:

The process meets the defined requirement, but performance data is displayed only monthly, making it difficult for supervisors to identify daily trends.

If no requirement has been violated, the auditor should not automatically raise a nonconformity.

Depending on the organization’s audit procedure, this could be recorded as:

• Observation
• Opportunity for improvement
• Improvement note

The terminology should be defined internally.

The key rule is simple:

Do not create requirements that do not exist.

An auditor cannot say:

“ISO requires this spreadsheet.”

unless an applicable requirement actually says so.

Corrective Action: What Happens After the Finding?

The audit finding is only the beginning.

A useful corrective-action process should address:

Correction → Cause → Corrective Action → Implementation → Effectiveness

Correction

The correction addresses the immediate problem.

Example:

A missing inspection record is completed where the activity can be legitimately reconstructed and verified.

Cause Analysis

The organization asks why the problem happened.

Possible tools include:

• 5 Whys
• Fishbone/Ishikawa analysis
• Fault-tree analysis
• Process mapping
• Pareto analysis
• Trend analysis
• Barrier analysis

The organization should select a method appropriate to the problem.

Corrective Action

Corrective action addresses the cause so the problem does not recur.

For example:

If an obsolete inspection form was used because employees could download old versions from a shared folder, merely retraining employees may not address the real cause.

A stronger action might involve:

• Removing uncontrolled forms
• Controlling access
• Establishing a single approved source
• Updating the document-control process
• Verifying implementation

Effectiveness Verification

This is where many organizations fail.

A corrective action is not necessarily effective because it was completed.

The auditor should ask:

“How do we know the problem will not happen again?”

ISO APG guidance recommends checking objective evidence for correction, cause analysis, corrective action, implementation, and effectiveness before closing a finding.

Corrective Action Example

Problem

Eight customer shipments contained incorrect certificates.

Immediate Correction

Correct certificates were issued to affected customers.

Cause Analysis

The organization found that employees were selecting certificates from an uncontrolled shared folder.

Corrective Action

The company:

• Removed uncontrolled templates.
• Created one controlled certificate template.
• Restricted editing access.
• Updated the document-control process.
• Trained affected employees.

Effectiveness Check

After 90 days, the auditor reviewed 40 shipments.

No incorrect certificates were identified.

The organization now has evidence that the action was effective.

This is far stronger than:

“Employees were retrained.”

How to Verify Corrective Action Effectiveness

The follow-up audit should be proportional to the finding.

For a Simple Record Error

The auditor may review subsequent records.

For a Process Failure

The auditor may interview employees and sample transactions.

For a Serious Systemic Issue

The auditor may need to perform:

• A focused follow-up audit
• Additional sampling
• On-site observation
• Trend analysis
• Review of multiple departments
• Management review of the issue

The verification method should answer:

“Has the corrective action actually achieved its intended result?”

The Free ISO 9001 Internal Audit Checklist Template

The following is a practical master template that can be adapted to an organization’s QMS.

Audit Header

Audit Checklist

C = Conforming
NC = Nonconforming
OFI = Opportunity for Improvement

Organizations should customize these abbreviations and classifications according to their documented audit procedure.

ISO 9001 Audit Programme: How to Build One

An audit programme ISO 9001 should be more than a calendar containing department names.

It should explain why audits are scheduled at particular times and with particular levels of attention.

A practical annual programme might look like this:

This is only an example.

The actual programme should be based on the organization’s size, processes, risks, changes, previous results, customer requirements, and certification arrangements.

ISO 19011:2026 specifically provides guidance on establishing, implementing, monitoring, reviewing, and improving an audit programme.

Internal Audit Frequency: How Often Should You Audit?

There is no universal rule saying that every ISO 9001 process must be audited exactly once per year.

The appropriate frequency should reflect the organization’s circumstances and applicable requirements.

Consider auditing a process more frequently when:

• It has repeated findings.
• Customer complaints are increasing.
• Performance is declining.
• Major changes have occurred.
• New technology has been introduced.
• New employees perform critical activities.
• Suppliers have become unstable.
• Regulatory expectations have changed.
• The process is strategically important.
• Previous audits identified significant weaknesses.

A stable, low-risk process may require less attention than a process with repeated failures.

Audit frequency should be justified, not arbitrary.

Internal Auditor Training

Competent auditors are essential.

A person who understands ISO clauses but cannot interview employees, evaluate evidence, or write a clear finding is not yet an effective auditor.

A practical internal auditor training programme should cover:

ISO Requirements

Auditors should understand:

• Applicable ISO 9001 requirements
• Organization-specific QMS requirements
• Customer requirements
• Applicable regulatory requirements

Auditing Techniques

Training should include:

• Audit planning
• Interviewing
• Sampling
• Observation
• Evidence evaluation
• Process auditing
• Risk-based auditing
• Remote auditing
• Report writing

Finding Writing

Auditors should practice:

• Identifying requirements
• Recording objective evidence
• Writing concise findings
• Distinguishing conformity from nonconformity
• Evaluating corrective action

Auditor Behavior

Auditors should learn to:

• Remain impartial
• Listen carefully
• Avoid arguing
• Ask neutral questions
• Avoid leading questions
• Respect confidentiality
• Separate facts from assumptions

ISO 19011:2026 includes guidance for evaluating the competence of people involved in auditing, including audit-programme managers, auditors, and audit teams.

How to Evaluate Internal Auditor Competence

Do not evaluate auditors only by whether they completed a training course.

Consider several sources of evidence:

• Training completed
• Audit participation
• Witnessed audits
• Finding-writing exercises
• Feedback from audit clients
• Knowledge evaluations
• Practical demonstrations
• Experience in relevant processes
• Periodic competence reviews

For example, an auditor may have completed a two-day course five years ago.

That does not automatically prove current competence.

The organization should consider whether the auditor has maintained relevant knowledge and practical experience.

Internal Audit KPIs

Organizations can measure whether their internal audit process is itself effective.

Useful indicators include:

Audit Completion Rate

Completed audits ÷ planned audits × 100

Example:

18 completed audits ÷ 20 planned audits × 100 = 90%

Corrective Action On-Time Closure

Actions closed on time ÷ actions due × 100

Repeat Finding Rate

Repeat findings ÷ total findings × 100

A high repeat-finding rate may indicate that corrective actions are not addressing causes effectively.

Finding Aging

Track how long findings remain open.

Audit Effectiveness

Consider whether audits are identifying meaningful process issues before customers or external auditors do.

Avoid setting a target such as:

“Each auditor must find at least five nonconformities.”

That can create the wrong behavior.

The goal is not to maximize findings.

The goal is to obtain reliable information and improve the QMS.

What Does a Good Internal Audit Look Like?

Imagine a U.S. manufacturing company with 150 employees.

Customer complaints increased by 18% over six months.

A weak audit programme might perform its normal annual audit and find that all procedures are available.

A stronger programme responds to the performance signal.

The quality manager schedules a focused audit covering:

Customer complaints → production → inspection → supplier controls

The auditor samples 20 customer complaints.

The audit finds that most complaints involve one product family.

The auditor traces the complaints to production records.

A pattern appears.

A particular supplier’s raw material has higher variation.

The audit then follows the supplier-control process.

The supplier was still rated “approved,” but recent performance data had not been included in the supplier evaluation.

The internal audit has now identified a meaningful system issue.

The company can:

• Correct affected material
• Investigate the supplier
• Update supplier controls
• Review potentially affected products
• Take corrective action
• Monitor future performance

This is the value of internal auditing.

The audit did not simply find a missing form.

It connected customer feedback, process performance, supplier control, and corrective action.

A Practical 90-Day Internal Audit Improvement Plan

If an organization’s internal audits are currently weak, the following 90-day plan can help.

Days 1–30: Stabilize

Review:

• Existing audit procedure
• Audit programme
• Auditor competence
• Previous findings
• Open corrective actions
• Current checklists
• Reporting format

Identify the biggest weaknesses.

Days 31–60: Improve

Update:

• Audit questions
• Sampling methods
• Process-based auditing
• Finding-writing method
• Corrective-action follow-up
• Auditor training
• Audit report format

Run at least one pilot audit using the improved approach.

Days 61–90: Verify

Evaluate:

• Quality of audit evidence
• Finding clarity
• Corrective-action quality
• Repeat findings
• Auditor performance
• Process-owner feedback

Then adjust the audit programme.

This creates a feedback loop:

Audit → Findings → Corrective Action → Effectiveness → Programme Improvement

ISO 9001:2026 Transition and Your Internal Audit Programme

The biggest 2026 consideration is the transition from ISO 9001:2015 to ISO 9001:2026.

ISO announced that ISO 9001:2026 was published on September 16, 2026. ISO’s transition information says organizations certified to ISO 9001:2015 have until September 30, 2029, to complete the transition. Transition may occur during a scheduled surveillance or recertification audit or through a separate transition audit.

This does not mean organizations should wait until 2029.

A better approach is to integrate transition activities into the existing QMS.

Step 1: Obtain the Current Standard

Use the official ISO publication rather than relying solely on summaries or unofficial checklists.

Step 2: Perform a Gap Assessment

Compare:

Current QMS → ISO 9001:2026 requirements

Identify:

• New requirements
• Changed wording
• Clarifications
• Existing controls that already satisfy the intent
• Areas requiring improvement

Step 3: Update the Audit Checklist

Do not simply replace “2015” with “2026.”

Review each question.

Ask:

“Does this question still test the correct requirement and the effectiveness of the process?”

Step 4: Train Auditors

Auditors need to understand what changed and how those changes affect evidence collection.

Step 5: Update the Audit Programme

Transition-related audits can be incorporated into normal process audits.

Step 6: Verify Implementation

Do not stop at document revision.

Sample actual processes.

Step 7: Coordinate With the Certification Body

Certification bodies may provide specific transition instructions, timing, and audit arrangements.

The organization should follow its certification body’s current requirements.

ISO itself advises certified organizations to work with their certification bodies regarding the transition process.

ISO 9001:2026 and ISO 19011:2026: An Important Combination

There is another significant 2026 development for auditors.

ISO 19011:2026 was published in May 2026 and replaced ISO 19011:2018. ISO describes it as guidance for auditing management systems, including audit principles, audit-programme management, conducting audits, and auditor competence.

The new edition also gives greater attention to:

• Technology
• Digitization
• Virtual environments
• Risk analysis
• Risk mitigation

ISO’s technical committee explains that the revision was intended to address the changing operating environment and strengthen the connection between effective auditing and effective management systems.

For internal audit teams, this means 2026 is not simply a year to update clause numbers.

It is a good opportunity to modernize the entire audit approach.

Internal Audits in Digital and AI-Enabled Organizations

Quality systems increasingly depend on software.

A process may now be controlled through:

• ERP systems
• MES systems
• CRM platforms
• Cloud QMS software
• Automated workflows
• AI-assisted tools
• Digital inspection systems
• Electronic approvals

Auditors should therefore understand enough about the technology to follow evidence.

For example, suppose an AI system recommends whether a supplier should receive additional monitoring.

The auditor should not simply ask whether AI is being used.

The auditor should examine:

• Defined purpose
• Inputs
• Outputs
• Human review
• Approval authority
• Data quality
• Change control
• Error handling
• Records
• Performance monitoring

ISO’s Auditing Practices Group added specific guidance on auditing a QMS that uses AI in June 2026.

The basic auditing principle remains the same:

Follow the process and verify objective evidence.

The Most Common ISO 9001 Internal Audit Mistakes

Even experienced organizations can make these mistakes.

1. Treating the Checklist as the Audit

The checklist is a tool.

It is not the audit itself.

2. Auditing Only the Quality Department

Quality belongs to the entire organization.

3. Checking Documents Instead of Implementation

A perfect procedure does not prove that employees follow it.

4. Asking Only Closed Questions

“Yes/no” questions often produce limited evidence.

5. Writing Vague Findings

A finding should be specific enough for another person to understand the issue.

6. Confusing Correction With Corrective Action

Fixing the immediate problem does not necessarily remove its cause.

7. Closing Findings Too Quickly

Completion is not the same as effectiveness.

8. Ignoring Positive Evidence

Audits should provide a balanced picture.

9. Creating Personal Requirements

Auditors should audit against defined criteria, not personal preferences.

10. Failing to Follow Trends

Repeated small issues may reveal a larger system problem.

25 High-Value Questions Every Internal Auditor Should Know

These questions can be adapted across almost any process:

1. What is the purpose of this process?
2. What are its inputs?
3. What are its outputs?
4. Who is the process customer?
5. What requirements apply?
6. What can go wrong?
7. What controls prevent those problems?
8. How do you know the controls work?
9. What records demonstrate conformity?
10. What performance indicators are monitored?
11. What happens when performance declines?
12. Who is responsible for the process?
13. How is competence established?
14. How are changes controlled?
15. How are customer requirements communicated?
16. How are suppliers controlled?
17. What happens when an output is nonconforming?
18. What problems occurred recently?
19. What corrective actions were taken?
20. How was effectiveness verified?
21. What changes have occurred recently?
22. What risks have changed?
23. What has the organization learned from previous audits?
24. What improvement has recently been implemented?
25. What would you change about this process if you could?

The last question can produce surprisingly valuable information.

Employees often know where processes struggle because they work with them every day.

ISO 9001 Internal Audit Checklist: Final Master Checklist

Before closing the audit, review the following.

Planning

• Audit programme established
• Audit objective defined
• Scope defined
• Criteria defined
• Auditor competence confirmed
• Auditor independence considered
• Previous findings reviewed
• Process risks considered
• Relevant changes identified

Audit Execution

• Opening discussion completed
• Process owner interviewed
• Employees interviewed
• Process observed
• Records sampled
• Customer requirements considered
• Supplier controls reviewed where relevant
• Process performance evaluated
• Risk controls evaluated
• Nonconformities investigated
• Positive practices recorded
• Audit trail followed where necessary

Findings

• Evidence recorded
• Requirement identified
• Finding statement clear
• Finding classification justified
• Finding discussed with process owner
• No personal preferences presented as requirements

Reporting

• Audit conclusion prepared
• Findings documented
• Report reviewed
• Responsible managers identified
• Corrective-action deadlines established
• Report distributed to appropriate recipients

Follow-Up

• Correction reviewed
• Cause analysis reviewed
• Corrective action reviewed
• Implementation verified
• Effectiveness verified
• Finding formally closed
• Repeat issues evaluated
• Lessons incorporated into future audit planning

Frequently Asked Questions

What is an ISO 9001 internal audit checklist?

An ISO 9001 internal audit checklist is a structured tool used to guide an internal audit against applicable QMS requirements. It normally contains audit questions, evidence fields, findings, and follow-up information. A good checklist supports process-based and risk-based auditing rather than simply reproducing ISO clauses.

How often should ISO 9001 internal audits be conducted?

ISO 9001 does not create a universal rule requiring every process to be audited at exactly the same frequency. Organizations should establish an audit programme that considers process importance, changes, previous audit results, risks, and other relevant factors. High-risk or poorly performing processes may need more frequent or deeper audits.

Can an employee audit their own department?

An auditor should maintain objectivity and impartiality. Auditing one’s own work can create a conflict of interest, so organizations should generally use qualified personnel who are sufficiently independent of the activity being audited. Smaller companies may use cross-functional auditors or other suitable arrangements.

What is objective evidence in an ISO audit?

Objective evidence is verifiable information used to support an audit conclusion. It can include records, observations, measurements, interviews, system data, documents, photographs, inspection results, or other evidence relevant to the audit criteria.

What is the difference between correction and corrective action?

Correction addresses the immediate detected problem. Corrective action addresses the cause of the nonconformity to prevent recurrence. For example, replacing an incorrect document is a correction; changing the document-control system so obsolete documents cannot be used may be part of corrective action.

What should an ISO 9001 audit report contain?

A useful report normally identifies the audit objective, scope, criteria, auditor, processes examined, evidence, conclusions, findings, corrective actions, and follow-up requirements. The format can be scaled to the size and complexity of the organization.

Is an internal audit required for ISO 9001 certification?

Yes. Organizations operating an ISO 9001 QMS are expected to conduct internal audits as part of evaluating whether the QMS conforms to applicable requirements and is effectively implemented and maintained.

What is the best ISO 9001 audit checklist?

There is no single checklist that is best for every organization. The most effective checklist is one customized to the organization’s processes, risks, customer requirements, regulatory requirements, procedures, performance indicators, and previous audit results.

Should an internal audit checklist contain every ISO clause?

It can, but that does not necessarily make it effective. A process-based checklist may be more useful because one business process can involve several ISO requirements. The checklist should help the auditor evaluate how requirements work together in actual operations.

Can internal audits be performed remotely?

Yes, where appropriate. Remote auditing can use interviews, screen sharing, electronic records, video observation, and digital systems. However, the audit method must still allow sufficient objective evidence to be collected and evaluated.

What changed in ISO 9001 in 2026?

ISO 9001:2026 was published on September 16, 2026. ISO describes the revision as building on the established framework while improving clarity and usability, with changes involving areas such as leadership, quality culture, accountability, risks and opportunities, and a new Annex A. Organizations certified to ISO 9001:2015 have until September 30, 2029, to complete their transition under the published transition arrangements.

Is ISO 19011:2026 relevant to ISO 9001 internal auditors?

Yes. ISO 19011:2026 provides guidance for auditing management systems, including audit principles, audit-programme management, conducting audits, and auditor competence. It does not itself provide certification requirements, but it is a useful framework for designing and improving internal auditing practices.

Actionable Takeaways for Quality Professionals

If you want to improve your internal audit system, start with these ten actions:

1. Stop treating the checklist as the audit.
2. Audit real processes and transactions.
3. Use risk and performance to prioritize audit time.
4. Ask open questions and follow the evidence.
5. Sample actual records instead of relying only on explanations.
6. Write findings using requirement, evidence, and nonconformity.
7. Separate correction from corrective action.
8. Verify effectiveness before closing findings.
9. Use audit trends to improve the audit programme.
10. Update your QMS and audit programme for ISO 9001:2026 rather than waiting for the transition deadline.

Final Conclusion

An ISO 9001 internal audit should never become a routine exercise where an auditor walks through a checklist, asks employees a few questions, collects signatures, and files the report.

A good audit does something much more valuable.

It shows whether the organization’s processes are actually working.

It connects requirements with real operations, evidence with performance, findings with causes, and corrective actions with measurable improvement.

That is why the best internal auditors do not spend the entire audit asking, “Where is the document?”

They ask:

“Show me how the process works.”

Then they follow the evidence.

For quality professionals, engineers, managers, auditors, and organizations preparing for the ISO 9001:2026 transition, this approach is especially important. The standard has moved into a new edition, and ISO’s current auditing guidance has also been updated through ISO 19011:2026. The transition therefore presents an opportunity to improve not only documents and checklists, but the entire way an organization evaluates QMS effectiveness.

The most effective internal audit programme is one that helps management see problems early, understand process risks, make better decisions, strengthen customer satisfaction, and prevent recurring failures.

Use the checklist as a guide. Use evidence as your foundation. Use risk to determine where to look deeper. And use every audit as an opportunity to make the QMS stronger.

Authoritative References and Further Reading

• ISO 9001:2026 — Quality management systems — Requirements
• ISO — ISO 9001:2026: What businesses need to know
• ISO/TC 176 — ISO 9001:2026 release and transition guidance
• ISO 19011:2026 — Guidelines for auditing management systems
• ISO 19011:2026 Online Browsing Platform
• ISO 9001 Auditing Practices Group
• ISO APG — Documenting Nonconformities
• ISO APG — Reviewing and Closing Nonconformities
• ISO APG — Audit Reports

Note: ISO 9001 and ISO 19011 are copyrighted standards. The checklist above is an original practical auditing aid and should be used together with the applicable official standards, your organization’s QMS requirements, customer requirements, applicable laws/regulations, and your certification body’s transition instructions. The ISO 9001 Auditing Practices Group itself notes that its papers are guidance rather than definitive requirements or mandatory audit criteria.

Final 2026 Transition Reminder

If your organization is currently certified to ISO 9001:2015, do not simply replace the title on your old checklist and call the transition complete.

A better sequence is:

Understand → Gap assess → Update processes → Train auditors → Update checklist → Audit → Correct → Verify → Transition

ISO has stated that organizations certified to ISO 9001:2015 have until September 30, 2029 to complete the transition, but starting early gives organizations substantially more time to identify gaps and make changes in a controlled manner.

The strongest organizations will use the transition to improve how they manage quality—not simply to obtain another certificate.