CORAA
Log inRun your first audit free
Topic hub · Standards and certification

ISO audits: management system audits explained

An ISO audit checks, with evidence, whether an organisation's management system meets the requirements of an ISO standard and its own procedures. The system might cover quality, the environment, health and safety, information security, business continuity or anti-bribery.

This hub gathers CORAA's guides, checklists and free tools for ISO audits in one place: how to run an internal audit, what a certification audit involves, how to handle nonconformities, and how to prepare. ISO standards are paid documents, so every guide tells you to read the current edition.

Each guide states what its facts rest on and what we could not verify. Standards and laws change, so confirm dates and wording against the primary source before relying on them.

Guides

The essential guides: start here.

Audit Standards · 26 Sept 2026
ISO 9001 Internal Audit Checklist: Clause by Clause, Clauses 4 to 10
An ISO 9001:2015 internal audit checklist for clauses 4 to 10: what to ask, what evidence to look at, and the mistakes that cause findings.
Audit Procedures · 26 Sept 2026
How to Run an ISO Internal Audit Step by Step, Using ISO 19011 Guidance
Run an ISO internal audit from programme to follow-up using ISO 19011:2018 guidance: planning, opening meeting, evidence, findings, report and closure.
Audit Standards · 26 Sept 2026
ISO Certification Audits Explained: Stage 1, Stage 2, Surveillance and Recertification
How an ISO certification audit works: Stage 1, Stage 2, the certification decision, yearly surveillance audits and recertification, in plain English.
Audit Procedures · 27 Sept 2026
ISO Audit Nonconformities: Major vs Minor, Evidence and Corrective Action
What an ISO nonconformity is, how major differs from minor, how to write the finding with evidence, and how to do corrective action that actually closes.
Audit Procedures · 30 Sept 2026
How to Run a Gap Assessment Before ISO Certification
A step-by-step gap assessment before ISO certification: compare what you do with the standard, rate the gaps, build an action plan, then audit internally.
Audit Standards · 26 Sept 2026
ISO/IEC 27001:2022 Internal Audit Guide and Annex A Controls
How to run an ISO/IEC 27001:2022 internal audit: ISMS clauses, the Statement of Applicability and the four Annex A control themes, with evidence to ask for.
All guides on this topic
Free templates and tools

Ready-to-use working papers, no sign-up to look around.

Word template
ISO Internal Audit Programme and Schedule
Plan which processes and clauses are audited, when, by whom, and how auditor independence is protected.
Word template
ISO Internal Audit Checklist — Clauses 4 to 10
A clause-by-clause internal audit checklist that records evidence seen, not only ticks, for ISO management-system audits.
Word template
ISO Internal Audit Report Template
Report scope, conclusions, graded findings, positive points and follow-up in a form management can act on.
Word template
Nonconformity and Corrective Action Register
Track each nonconformity from evidence to correction, root cause, corrective action and a check that it worked.
Word template
ISO Management Review Input Checklist
Gather the inputs and record the outputs for a management review of an ISO management system.
Word template
ISO/IEC 27001 Statement of Applicability Template
List each Annex A control with whether it applies, why, how it is implemented and the evidence.
Word template
Process Audit Checklist Template
Audit one process from start to finish: definition, practice, controls, records, measures and results.
Word template
Environmental Aspects and Impacts Register
List aspects and impacts by activity and condition, score significance and link to controls and objectives.
Word template
HIRA Register — Hazard Identification and Risk Assessment
List hazards by activity, who could be harmed, controls, risk scores and further actions using the hierarchy of controls.
Word template
Gap Analysis Template
Compare current state with a requirement and plan how to close each gap, with risk, owner and date.
Word template
HACCP Audit Checklist — Seven Principles
Audit a food safety plan against the seven HACCP principles and the prerequisite programmes, with evidence seen for each answer.
Word template
CAPA Report Format — Corrective and Preventive Action
Record the problem, immediate correction, root cause, corrective and preventive actions, and the effectiveness check.
Word template
Root Cause Analysis Template — 5 Whys and Fishbone
Take a finding to its cause with a problem statement, five whys, a fishbone worksheet and an action plan.
Free tool
ISO readiness scorecard
Score readiness across clauses 4 to 10 and see the gaps.
Free tool
Fishbone diagram generator
Map possible causes of a nonconformity and download the diagram.
Free tool
5 Whys analysis tool
Take a problem to its root cause with evidence at each step.
Frequently asked questions

ISO audits: in plain words.

An ISO audit is a systematic, independent check of whether an organisation's management system meets the requirements of an ISO standard and the organisation's own procedures. The auditor collects evidence from records, observation and interviews and reports where the system conforms and where it does not.
ISO is the short name of the International Organization for Standardization, which publishes the standards. An "ISO audit" is therefore an audit against an ISO standard such as ISO 9001 for quality or ISO/IEC 27001 for information security.
Three are commonly described: first-party audits, which an organisation does on itself (internal audits); second-party audits, done by a customer on a supplier; and third-party audits, done by an independent certification body for certification. ISO 19011 gives guidance on auditing management systems. Read more: How to run an ISO internal audit.
Internal audits at planned intervals are a requirement of ISO management system standards for any organisation that claims conformity. Seeking certification is voluntary unless a customer, tender or regulator requires it.
In general, Stage 1 reviews whether the system is ready and documented, and Stage 2 checks on site that it is implemented and effective. After certification, the certification body carries out surveillance audits and a recertification audit. The exact programme is set by the certification body. Read more: Certification audits explained.
A nonconformity is a failure to fulfil a requirement. Many certification bodies grade findings as major or minor; the grading rules are set by each body, so check yours. Each nonconformity needs a correction, a root cause and a corrective action that is checked for effectiveness. Read more: Nonconformities and corrective action.
Objective evidence that each requirement is met and the system works in practice: documented information, records, what people actually do, and results against the organisation's own objectives. A tick on a checklist is not evidence; the auditor notes what was seen.
Common ones include ISO 9001 (quality), ISO 14001 (environment), ISO 45001 (health and safety), ISO/IEC 27001 (information security), ISO 22301 (business continuity), ISO 37001 (anti-bribery) and ISO/IEC 42001 (AI management). Many share a common clause structure, so one audit method works across them.
No. Independence and impartiality are core principles of auditing in ISO 19011, so auditors should not audit their own work or an area where they have a conflict of interest.
Run a gap assessment against the standard, fix the gaps, hold an internal audit and a management review, close nonconformities with evidence of effectiveness, and keep records ready. Our readiness scorecard and templates cover each step. Read more: Gap assessment before certification.