An ISO 9001 internal audit checks your own quality management system against the requirements in clauses 4 to 10 of ISO 9001:2015 and against your own procedures. For each clause, ask what the company says it does, then ask to see the records that prove it. Clause 9.2 is the one that requires the audit itself.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of ISO 9001:2015 (the ten clause headings and their main sub-clauses). The standard is a paid document, so we have not reproduced its text. Check the current edition and any amendments before you audit, and read the exact wording of each clause you test.
Edition note (17 October 2026). ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 after a transition of about three years. Sources give slightly different end dates (around September 2029), and the International Accreditation Forum and your certification body set the rules, so ask yours. ISO 14001:2026 was published in April 2026 with a similar three-year transition. This guide uses the 2015 clause structure, because we could not verify the 2026 clause numbering. If you audit to a 2026 edition, check each reference against it.
How to use this checklist
ISO 9001:2015 is the international standard for a quality management system (QMS). A QMS is simply the set of rules, roles and records a company uses to make sure its product or service meets customer needs.
Clauses 1 to 3 cover scope, references and terms. They are not audited. Clauses 4 to 10 hold the requirements. The questions below are prompts, not an official list. Adapt them to the scope and processes of the company you audit.
For method (planning, interviews, reporting), see our guide on how to run an ISO internal audit step by step.
Clause 4: Context of the organisation
This clause asks the company to understand its situation before it builds a system.
- Has the company listed the outside and inside issues that affect its quality results?
- Has it identified interested parties (customers, regulators, suppliers) and what they expect?
- Is the scope of the QMS written down, and does it match what the company really does?
- Are the processes of the QMS identified, with inputs, outputs and owners?
Evidence: a context analysis, a scope statement, a process map. Common finding: the scope excludes a requirement without a reason.
Clause 5: Leadership
- Can top management show it takes part in the QMS, and not only signs the policy?
- Is the quality policy written, communicated and understood by staff?
- Are roles, responsibilities and authorities assigned and known?
- Is customer focus visible in decisions?
Evidence: the signed policy, management meeting minutes, staff interviews. Ask a shop-floor or desk-level employee what the quality policy means for their job.
Clause 6: Planning
- Has the company identified risks and opportunities, and planned actions for them?
- Are quality objectives set at relevant functions, measurable and monitored?
- When the company changes the system, is the change planned (clause 6.3)?
Evidence: a risk register, objective tracking sheets, change records. Common finding: objectives exist but nobody reviews progress.
Clause 7: Support
This clause covers what the system needs to run.
- Resources: people, buildings, equipment, and the work environment.
- Monitoring and measuring equipment: is it calibrated or verified, with records?
- Competence: do people have the education, training or experience for their role?
- Awareness and communication: do staff know the policy, their objectives and the effect of not following the system?
- Documented information: are documents controlled, current, and available where used?
Evidence: training records, calibration certificates, document lists with versions. Common finding: out-of-date copies of a procedure at the point of use.
Clause 8: Operation
This is the largest clause. It covers how the company delivers its product or service.
| Sub-clause | What to test |
|---|---|
| 8.1 Operational planning and control | Are processes planned and controlled? |
| 8.2 Requirements for products and services | Is customer communication handled and are requirements reviewed before accepting an order? |
| 8.3 Design and development | If the company designs anything: inputs, reviews, verification, validation, changes |
| 8.4 External providers | Are suppliers evaluated, selected and monitored? |
| 8.5 Production and service provision | Controlled conditions, identification and traceability, customer property, preservation, post-delivery activities |
| 8.6 Release of products and services | Is release authorised and recorded? |
| 8.7 Nonconforming outputs | Are faulty outputs identified and stopped from reaching the customer? |
Evidence: order review records, supplier evaluations, inspection records, release records. Sample a few orders from start to finish. This is called a trace, and it tests several sub-clauses at once.
If the company has no design activity, check that the exclusion of 8.3 is justified in the scope.
Clause 9: Performance evaluation
- 9.1: Is the company monitoring and measuring what it said it would? How does it track customer satisfaction?
- 9.2: Is there an internal audit programme, are auditors objective, are results reported, and is action taken without undue delay?
- 9.3: Does management review the QMS at planned intervals, covering the inputs the standard lists, and record decisions?
Evidence: customer feedback records, the audit programme and reports, management review minutes. Common finding: management review happens, but it does not cover all the required inputs.
Clause 10: Improvement
- Does the company react to a nonconformity, find its cause, and fix the cause?
- Does it check that the corrective action worked?
- Is there evidence of continual improvement of the system?
Evidence: the corrective action log. Look for closed items with no effectiveness check. See ISO audit nonconformities: major vs minor, evidence and corrective action.
Mistakes internal auditors make
- Auditing the document, not the process. Go and watch the work.
- Auditing your own work. Clause 9.2 expects objectivity and impartiality.
- Only asking the quality manager. Speak to the people who do the work.
- Writing vague findings. State the requirement, the evidence and the gap.
Frequently Asked Questions
Which clause of ISO 9001 requires an internal audit?
Clause 9.2. It requires the company to run internal audits at planned intervals, define the criteria and scope of each audit, select objective and impartial auditors, report the results to relevant management and keep records.
Do I have to audit every clause every year?
The standard does not give a fixed cycle. It asks for an audit programme that takes account of the importance of processes, changes affecting the company and results of earlier audits. Many companies cover all clauses within a year, but check what your own programme says.
Can the quality manager audit the quality department?
Not if that creates a conflict. Auditors must be objective and impartial, so they should not audit their own work.
Is a checklist enough to run the audit?
No. A checklist is a memory aid. The real work is sampling records, watching the process and talking to staff. Note evidence in your own words.
What is the difference between ISO 9001 certification and an internal audit?
An internal audit is done by or for the company itself. A certification audit is done by an outside certification body. See our guide to ISO certification audits.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error