ISO 9001 internal audit checklist

Has the organisation identified the internal and external issues that affect its purpose, strategy and ability to deliver conforming products and services, and does it monitor and review them?

Evidence: Context analysis (SWOT, PESTLE or similar) with a review date; management review minutes showing the issues were revisited

Has the organisation decided whether climate change is a relevant issue for its quality management system, and recorded the reasoning either way?

Evidence: Context analysis naming climate change and the conclusion reached; link to risks and opportunities where it is relevant

Are the interested parties relevant to the quality management system identified, with their requirements, including any climate-related requirements, and are these kept under review?

Evidence: Interested parties register with requirements and review date; customer and regulator requirements traced into the system

Is the scope documented, stating the products, services and sites covered, and is every requirement treated as not applicable justified on the basis that it does not affect conformity or customer satisfaction?

Evidence: Scope statement; justification for any exclusion (for example design and development); certificate scope matches

Are the processes of the quality management system defined, with their inputs, outputs, sequence, criteria, resources, responsibilities, risks and performance measures?

Evidence: Process map or turtle diagrams; process owners named; KPIs for each process

Does the organisation keep the documented information needed to support the operation of its processes, and retain enough to be confident they run as planned?

Evidence: Procedures and work instructions for key processes; sample of records showing the processes run as described

Can top management show that they take accountability for the effectiveness of the system, integrate it into business processes and promote the process approach and risk-based thinking?

Evidence: Interview with top management; business plans and budgets that reference quality objectives; management review attendance

Does top management make the resources available, communicate why effective quality management matters, and support other managers and staff to contribute?

Evidence: Resourcing decisions; town halls, briefings or messages on quality; staff interviews

Does top management make sure customer and applicable legal requirements are determined and met, that risks to conformity and customer satisfaction are addressed, and that customer satisfaction stays a focus?

Evidence: Customer satisfaction results reviewed by top management; complaint trends; decisions taken on them

Is there a quality policy appropriate to the organisation's purpose and context that provides a framework for objectives and commits to meeting requirements and to continual improvement?

Evidence: Signed, dated quality policy; comparison with strategy and context

Is the policy available as documented information, communicated and understood within the organisation, and available to interested parties where appropriate?

Evidence: Policy on notice boards, intranet or website; staff can explain what it means for their job

Are roles, responsibilities and authorities for the system assigned and communicated, including who reports on system performance to top management and who keeps the system intact when changes are made?

Evidence: Organisation chart; job descriptions; appointment letters; RACI matrix

Has the organisation determined the risks and opportunities arising from its context and interested parties that need to be addressed to achieve the intended results and prevent undesired effects?

Evidence: Risk and opportunity register linked to 4.1 and 4.2; ratings and owners

Are actions planned for the risks and opportunities, proportionate to their potential effect on conformity, built into the processes, and is their effectiveness evaluated?

Evidence: Action plans with owners and dates; evidence actions were completed and reviewed

Are quality objectives set at relevant functions and levels, measurable, consistent with the policy, monitored, communicated and updated?

Evidence: Objectives register with targets and current results; departmental objectives

For each objective, is it clear what will be done, with what resources, by whom, by when, and how results will be evaluated?

Evidence: Objective action plans; progress reports; management review minutes

When changes to the system are needed, are they carried out in a planned way, considering their purpose and consequences, the integrity of the system, resources and the reallocation of responsibilities?

Evidence: Change records for recent restructures, new sites or new processes; change plans approved before implementation

Has the organisation determined and provided the resources needed for the system, considering what its existing internal resources can do and what has to be obtained from external providers?

Evidence: Budget; resource planning; management review outputs on resources

Are enough people available to run the system and its processes effectively?

Evidence: Manpower plans; vacancy records; overtime levels in key processes

Is the infrastructure needed for conforming products and services (buildings, equipment, software, transport, IT) determined, provided and maintained?

Evidence: Asset list; planned maintenance schedule and completion records; breakdown log

Are the working conditions needed for conforming outputs (physical, social and psychological factors such as temperature, cleanliness, workload and stress) determined and maintained?

Evidence: Site observation; environmental monitoring records where relevant; housekeeping inspections

Where monitoring or measurement is used to verify conformity, are the resources suitable for the purpose and maintained, with records kept as evidence of fitness for purpose?

Evidence: Register of measuring equipment; checks and verification records

Where traceability is required, is measuring equipment calibrated or verified against traceable standards, identified with its status, and protected from adjustments that would invalidate results? Is the validity of previous results assessed when equipment is found out of tolerance?

Evidence: Calibration certificates traceable to national standards; status labels; out-of-tolerance investigations

Has the organisation determined the knowledge needed to operate its processes, kept it available, and considered how to acquire additional knowledge when needs and trends change?

Evidence: Lessons learned records; technical libraries; handover and succession arrangements

Are competence requirements defined for roles that affect quality, are people competent on the basis of education, training or experience, and is the effectiveness of training or other actions evaluated?

Evidence: Competence matrix; training records; training effectiveness evaluations; certificates

Are people aware of the quality policy, relevant objectives, their contribution to the system and the consequences of not following its requirements?

Evidence: Staff interviews at several levels; induction content; toolbox talks

Are internal and external communications relevant to the system planned, stating what is communicated, when, with whom, how and by whom?

Evidence: Communication plan or matrix; meeting minutes; customer communication records

Does the system include the documented information the standard requires and the documented information the organisation has decided it needs?

Evidence: Master list of documents and records; mapping to clause requirements

Are documents identified (title, date, author or reference), in an appropriate format, and reviewed and approved for suitability before issue?

Evidence: Document control procedure; approval signatures or workflow history; revision status

Is documented information available where needed, protected, controlled for distribution, access, storage, changes and retention, and are obsolete versions prevented from use? Are documents of external origin identified and controlled?

Evidence: Spot checks of documents at point of use; access rights; retention schedule; external documents register

Are the processes needed to provide products and services planned, with requirements, acceptance criteria, resources and controls defined, and are outsourced processes controlled?

Evidence: Quality plans; production or service plans; control plans; records of planned changes

Are there arrangements for communicating with customers on product and service information, enquiries, contracts, orders and changes, feedback and complaints, handling of customer property, and contingency actions?

Evidence: Enquiry and order records; complaint log; customer correspondence

When determining the requirements for products and services, does the organisation include applicable legal and regulatory requirements and those it considers necessary, and can it meet the claims it makes?

Evidence: Product specifications; legal requirements for products; marketing claims checked against capability

Before committing to supply, are customer requirements reviewed, including delivery and post-delivery, implied requirements, legal requirements and differences from earlier quotes, with the review result retained?

Evidence: Contract or order review records; signed-off tenders; resolved differences

When requirements change, is the documented information amended and are the relevant people made aware of the change?

Evidence: Contract amendments; change notices circulated to operations

Where design and development applies, is there a process for it that suits the products and services? If design is excluded, is the exclusion still valid?

Evidence: Design procedure; scope justification if excluded

Does design planning define stages, reviews, verification and validation activities, responsibilities, resources, interfaces, customer and user involvement, and the records needed?

Evidence: Design plans; project schedules; design team lists

Are design inputs complete and unambiguous, covering functional and performance requirements, previous similar designs, legal requirements, standards and potential consequences of failure?

Evidence: Design input documents; resolution of conflicting inputs

Are design reviews, verification and validation carried out as planned, with problems identified and actions taken and recorded?

Evidence: Design review minutes; verification test reports; validation records

Do design outputs meet the input requirements, cover the needs of later processes, include monitoring and acceptance criteria, and specify what is essential for safe and proper use?

Evidence: Drawings, specifications and acceptance criteria; output approval

Are changes made during or after design identified, reviewed and controlled, with records of the change, the reviews, the authorisation and the action taken to prevent adverse effects?

Evidence: Design change requests and approvals; impact assessments

Are criteria set for evaluating, selecting, monitoring and re-evaluating external providers based on their ability to supply as required, and are the results and any actions recorded?

Evidence: Approved supplier list; supplier evaluation and re-evaluation records; performance scorecards

Are the controls applied to external providers and their outputs defined according to the potential effect on conformity, including outsourced processes that remain within the system?

Evidence: Incoming inspection records; supplier audits; service level agreements for outsourced processes

Do purchase orders and contracts tell external providers what is required: the products and services, approval and release, competence, interactions, control and monitoring, and any verification at their premises?

Evidence: Sample purchase orders and subcontracts; specifications attached

Is production and service provision carried out under controlled conditions: available specifications, suitable equipment and monitoring, competent people, validated special processes, and actions to prevent human error?

Evidence: Site observation; work instructions at point of use; process validation records; inspection records

Are outputs identified with their inspection and test status throughout, and is unique identification controlled where traceability is required?

Evidence: Labels and status tags on site; batch or serial records; a traceability test from finished item back to raw material

Is property belonging to customers or external providers (materials, tools, premises, data, intellectual property) identified, protected and safeguarded, and is loss or damage reported to the owner?

Evidence: Register of customer property; records of reported loss or damage

Are outputs preserved during production and service provision so they still conform, covering handling, packaging, storage, transport and protection?

Evidence: Warehouse and storage observation; shelf-life control; packaging specifications

Are post-delivery requirements (warranty, maintenance, support, recycling or disposal) determined and met, considering legal requirements, risks, product life and customer feedback?

Evidence: Warranty records; service reports; maintenance contracts

Are unplanned changes to production or service provision reviewed and controlled, with records of the review, who authorised the change and the actions taken?

Evidence: Production change records; deviation approvals

Are products and services released only after planned checks show requirements are met, or with approval from a relevant authority or the customer, and is the person authorising release traceable?

Evidence: Final inspection records with acceptance criteria and signature; concessions approved by the customer

Are nonconforming outputs identified and controlled to prevent unintended use or delivery, dealt with by correction, segregation, return, informing the customer or concession, and is conformity re-verified after correction?

Evidence: Nonconformance reports; quarantine area; concession records; rework re-inspection

Has the organisation decided what needs to be monitored and measured, the methods, when it is done and when results are analysed, and does it retain the results?

Evidence: KPI list per process; monitoring schedule; performance reports

Does the organisation monitor how customers perceive the degree to which their needs and expectations are met, and act on the results?

Evidence: Customer surveys; feedback analysis; complaint trends; meeting notes with key accounts

Are monitoring data analysed to evaluate conformity, customer satisfaction, system performance, the effectiveness of planning and of actions on risks, external provider performance, and the need for improvement?

Evidence: Trend analyses; dashboards; data packs prepared for management review

Are internal audits carried out at planned intervals to check that the system conforms to the organisation's own requirements and the standard, and is effectively implemented and maintained?

Evidence: Audit reports covering the full scope over the cycle

Does the audit programme take account of process importance, changes and previous results; are criteria and scope defined for each audit; are auditors objective and impartial; and are results reported and acted on without undue delay?

Evidence: Audit programme; auditor competence and independence; audit plans; follow-up of findings

Does top management review the system at planned intervals for its continuing suitability, adequacy, effectiveness and alignment with strategy?

Evidence: Management review schedule and minutes; attendance

Does the review consider previous actions, changes in issues, customer satisfaction, objectives, process performance, nonconformities, monitoring results, audit results, external provider performance, resources, risk actions and improvement opportunities?

Evidence: Management review agenda and data pack checked against each required input

Do the outputs record decisions on improvement opportunities, changes to the system and resource needs, and is evidence of the results retained?

Evidence: Minutes with decisions, owners and dates; follow-up at the next review

Does the organisation select and act on opportunities to improve products, services, results and customer satisfaction, including correcting, preventing or reducing undesired effects?

Evidence: Improvement projects; suggestion schemes; before and after results

When a nonconformity occurs, including from complaints, does the organisation react, find the root cause, check whether similar nonconformities exist or could occur, take action, review its effectiveness and update risks and the system where needed?

Evidence: Corrective action records with root cause analysis (5 Whys, fishbone); effectiveness checks; risk register updates

Is documented information retained on the nature of each nonconformity, the actions taken and the results of corrective action?

Evidence: Nonconformity and corrective action log; closed reports

Does the organisation continually improve the suitability, adequacy and effectiveness of the system, using analysis results and management review outputs to find needs and opportunities?

Evidence: Improvement trends year on year; management review decisions implemented