This guide addresses that problem directly. It covers what ISO 9001 Clause 9.2 actually requires, how to build a checklist that maps to every certifiable clause group, how to conduct the audit properly, and what to do when nonconformances surface.
TLDR
- Clause 9.2 mandates planned, documented internal audits at defined intervals — not ad hoc reviews
- A complete checklist must address all ISO 9001 "shall" requirements across Sections 4 through 10
- Auditors must be independent of the process they're auditing — auditing your own work is not permitted
- Every nonconformance requires documented root cause analysis, a corrective action plan, and verified follow-up per Clause 10.2
What Is an ISO 9001 Internal Audit and Why It Matters
An ISO 9001 internal audit is a first-party, systematic self-assessment of your Quality Management System. It is conducted by your organization — or a consultant working on your behalf — to evaluate whether your QMS conforms to both ISO 9001:2015 requirements and your own documented processes.
Unlike a third-party certification audit — where registrars such as DNV, BSI, or LRQA evaluate your system against external requirements — the internal audit is entirely in your hands. It is your opportunity to find and fix problems before they do.
Core Purposes
The audit serves four practical functions:
- Confirms that documented procedures are actually followed on the floor, not just on paper
- Surfaces nonconformances before they become findings in a certification or surveillance audit
- Evaluates whether risk controls are functioning as intended
- Provides top management with objective evidence that the QMS is — or isn't — working as designed
Internal audits are not punitive — the purpose is improvement, not blame. Organizations that use the internal audit as a genuine diagnostic tool get real value out of it; those that treat it as a compliance checkbox typically do not.
Auditing Principles per ISO 19011:2018
ISO 19011:2018 defines seven principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. The two with the most practical day-to-day impact are independence (auditors must not audit their own work) and evidence-based approach (conclusions must be supported by verifiable objective evidence, not impressions or assumptions).
ISO 9001 Clause 9.2: What the Standard Actually Requires
ISO 9001:2015 Clause 9.2 breaks internal audit requirements into two sub-clauses.
Clause 9.2.1 requires audits at planned intervals to determine whether the QMS:
- Conforms to the organization's own requirements and ISO 9001 requirements
- Is effectively implemented and maintained
Clause 9.2.2 requires the organization to plan, establish, implement, and maintain an audit program that addresses:
- Audit frequency, methods, responsibilities, and planning requirements
- Audit criteria and scope for each individual audit
- Auditor selection that ensures objectivity and impartiality
- Reporting of results to relevant management
- Documented corrective action without undue delay
- Retained documented information as evidence
Setting Audit Frequency
The standard does not prescribe a fixed frequency — it requires audits at intervals that reflect:
- The importance of the process to quality outcomes
- Changes affecting the organization (new equipment, new contracts, restructuring)
- Results of previous audits — processes with a history of nonconformances warrant more frequent attention
Customer-facing processes, production controls, supplier management, and any recently changed processes should be scheduled more often than stable back-office functions.
Deciding how often to audit is only half the equation — you also need to determine who conducts those audits.
Auditor Qualification and Independence
Auditors must be competent — meaning trained in auditing techniques and knowledgeable about ISO 9001 requirements — and must not audit their own work. This independence requirement often creates a practical challenge for small manufacturers and owner-operated businesses with limited quality staff.
The most workable solution is cross-functional auditing: a production supervisor audits the purchasing process; the purchasing manager audits calibration. Roles rotate to maintain independence without requiring a dedicated audit team.
Synergistic Systems covers this challenge in its ISO 9001 internal auditor training (Step 5 of its 10-step implementation methodology). Client staff trained in that session are equipped to conduct ongoing audits independently — before and after the system-wide audit Synergistic Systems facilitates at Step 8.
What Your ISO 9001 Internal Audit Checklist Should Cover
A complete checklist must address every certifiable ("shall") requirement across Clauses 4 through 10. Missing entire clause groups is one of the most common and damaging gaps — it leaves the organization exposed during certification or surveillance audits.
Clauses 4–6: Context, Leadership, and Planning
These foundational clauses establish the framework everything else depends on.
- Has the organization identified internal and external issues affecting quality? (Clause 4.1)
- Are relevant interested parties and their requirements documented and reviewed? (Clause 4.2)
- Is the QMS scope defined and documented with justification for any exclusions? (Clause 4.3)
- Does top management demonstrate visible commitment to the QMS — not just sign the policy? (Clause 5.1)
- Is the quality policy communicated, understood, and accessible to personnel? (Clause 5.2)
- Have risks and opportunities been identified, assessed, and addressed with defined actions? (Clause 6.1)
- Are quality objectives documented, measurable, communicated, and tracked over time? (Clause 6.2)
Clause 7: Support — Resources, Competence, and Documentation
- Are personnel competence requirements defined, and are training records current?
- Is infrastructure (equipment, facilities, environment) adequate for process requirements?
- Is monitoring and measurement equipment calibrated, with calibration records retained?
- Are documents and records controlled — including version management and access permissions?
- Is the quality policy accessible to all relevant personnel, including new hires?
Clause 8: Operations
Clause 8 is typically the most extensive section, particularly for manufacturing organizations.
- Are operational planning controls established and consistently followed?
- Are external provider (supplier) selection, evaluation, and performance monitoring processes documented and active?
- Are design inputs, outputs, reviews, verification, validation, and change records maintained? (Applies to organizations with design and development in scope)
- Are products and services released in a controlled manner with conformity records?
- Are nonconforming outputs identified, segregated, recorded, and dispositioned per documented procedure?
For manufacturers — machine shops, fabricators, foundries, injection molders, contract manufacturers — Clause 8 questions should go deeper into production process controls, material traceability, in-process inspection records, and equipment qualification. A service organization's Clause 8 checklist will look substantially different.
Clauses 9–10: Performance Evaluation and Improvement
- Are process KPIs monitored, measured, and analyzed at defined intervals?
- Is customer satisfaction being assessed and tracked — through surveys, complaints, or other methods?
- Are management reviews conducted at planned intervals with documented inputs and outputs?
- Are nonconformity and corrective action processes active, with root cause analysis performed and effectiveness verified?
- Is there documented evidence of continual improvement activity (not just statements of intent)?
How to Build an Effective ISO 9001 Internal Audit Checklist
A generic template applied identically to every organization will produce generic results. An effective checklist is tailored to the organization's specific scope, processes, industry, and risk profile.
Structure and Question Design
The single most important structural choice: phrase questions to invite evidence, not yes/no answers.
- ❌ "Do you have a training procedure?" → Yes/No answer, no insight
- ✅ "How do you verify that a new operator is competent before working independently?" → Requires explanation and evidence
ASQ guidance on successful internal audits reinforces this: audit questions should be open-ended and non-rhetorical. Every question should also map to a specific clause reference so findings can be traced directly back to standard requirements.
Pre-Audit Document Review
Before walking onto the floor, auditors should review:
- Previous audit findings and open corrective actions
- Customer complaints received since the last audit
- Quality objectives performance data
- Process KPI trends and any missed targets
- Recent process changes or significant customer changes
Areas of past nonconformance, declining metrics, or recent changes should generate targeted checklist questions for the current audit — not boilerplate questions carried over from the prior year.
Linking Questions to Objective Evidence
For each process area, specify what evidence the auditor should look for:
| Process Area | Evidence to Seek |
|---|---|
| Competence / Training | Training records, competency matrices, job descriptions |
| Calibration | Calibration logs, equipment status labels, external calibration certificates |
| Supplier Management | Approved supplier list, evaluation records, supplier performance data |
| Nonconforming Output | NCR log, disposition records, segregation practices |
| Management Review | Signed meeting minutes with required inputs and outputs |
| Internal Audit | Audit schedule, completed checklists, finding records |
This prevents audits from becoming interview-only conversations. If there are no records, that absence is itself a finding.
Modular Design for Complex Organizations
Organizations with multiple sites or distinct process functions benefit from a modular checklist structure: a master checklist covering QMS-level requirements (Clauses 4–6, 9–10) combined with process-specific modules for individual departments or functions. This structure lets you add, update, or extend modules as the organization's scope evolves — without reworking the entire checklist from scratch.
How to Conduct an ISO 9001 Internal Audit: Step by Step
Step 1 — Audit Planning
Define scope, objectives, and criteria before anything else. Build an audit schedule that covers all QMS processes over the audit cycle. Assign auditors independent of each area, communicate the schedule to stakeholders, and distribute the checklist in advance so auditees can prepare their evidence.
Step 2 — Pre-Audit Preparation
Auditors review all relevant documented information for the assigned process:
- Flowcharts and process maps
- Previous audit reports
- KPI data and performance trends
- Customer complaints and nonconformance records
- Applicable ISO 9001 clauses
Highlight areas of concern and map each one to specific checklist questions. Thorough preparation here determines how much ground the audit actually covers.
Step 3 — Conducting the Audit
Collect evidence through three channels:
- Interviews — ask process owners and operators open-ended questions
- Observation — watch activities and inspect conditions firsthand
- Records review — verify that documents and records reflect what was described in interviews
Use the checklist as a guide, not a rigid script. Follow audit trails when evidence raises new questions — that's often where the most significant findings emerge. Take detailed, objective notes throughout.
Step 4 — Documenting Findings
Record all findings — conformances, nonconformances, and observations. Every nonconformance must document three things:
- The specific requirement that was not met (with clause reference)
- A description of the nonconformance
- The objective evidence supporting the finding
Hold a closing meeting with area management to review key findings before the formal report is issued. No surprises in the written report.
Step 5 — Audit Report and Follow-Up
The lead auditor issues a formal report summarizing what was audited, findings (positive and negative), and required corrective actions with assigned owners and deadlines. This report goes to top management, where leadership uses it to assess overall QMS performance and direct resources — feeding directly into the management review process.
Schedule follow-up verification to confirm corrective actions are implemented and effective before findings are closed. DNV identifies failure to follow up on identified nonconformities as one of the most critical mistakes organizations make during ISO audits.
How to Handle Nonconformances and Corrective Actions
A nonconformance is a failure to meet a requirement — either an ISO 9001 requirement or an internally documented process requirement. Finding one is not a failure; leaving it unaddressed is.
Root Cause Analysis
Document the nonconformance immediately with evidence. Then determine why it occurred — not just what happened. Two tools commonly used in ISO environments:
- 5-Whys — ask "why" iteratively until you reach the systemic cause, not the symptom
- 8D problem solving — a structured, eight-discipline methodology for complex or recurring issues
ISO 9001 Clause 10.2 does not prescribe which tool to use, but it does require that the root cause be identified and addressed to prevent recurrence.
Corrective Action Requirements
Per Clause 10.2, the corrective action process must:
- Identify and document the root cause
- Develop a corrective action plan that addresses the root cause (not just the immediate instance)
- Assign a responsible owner with a defined completion deadline
- Document all activity as retained information
A corrective action that only fixes the visible symptom — without addressing the root cause — will see the same nonconformance reappear at the next audit or customer review.
Follow-Up Verification
ISO 9001 requires that the effectiveness of corrective actions be verified. A follow-up review or targeted re-audit must confirm that the root cause has been eliminated and the nonconformance has not recurred. Unverified or unclosed corrective actions are a consistent finding in certification and surveillance audits.
Synergistic Systems' cloud-based QMS intranet supports this entire workflow — from initial nonconformance recording through root cause documentation, action assignment, and closure verification — giving auditors a clear, complete evidence trail at every stage.
Frequently Asked Questions
What are the internal audit requirements for ISO 9001?
ISO 9001 Clause 9.2 requires organizations to conduct internal audits at planned intervals to verify that the QMS conforms to both their own requirements and the standard's requirements. Audit results must be documented, auditors must be independent of the area they audit, and records must be retained as evidence of conformity.
What is the ISO 9001 internal audit checklist?
The ISO 9001 internal audit checklist is a structured tool that maps audit questions to the certifiable ("shall") requirements of ISO 9001:2015, Sections 4–10. It guides auditors through all QMS areas systematically and ensures consistent, documented evidence collection across every process.
What are the key principles of internal auditing?
ISO 19011:2018 Clause 4 defines seven auditing principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. Following these principles ensures audit conclusions are objective, well-supported, and useful for driving improvement.
Who can perform an ISO 9001 internal audit?
Internal auditors must be competent (trained in auditing and knowledgeable about ISO 9001) and independent of the process they audit. They don't need to come from the quality department — cross-functional auditing, where staff audit outside their own area, is common practice and fully acceptable under the standard.
How often should ISO 9001 internal audits be conducted?
ISO 9001 sets no fixed frequency. Audit scheduling is based on process importance, prior audit results, and organizational changes. Most organizations complete a full QMS audit cycle annually, auditing higher-risk or recently changed processes more often within that cycle.
What happens if a nonconformance is found during an ISO 9001 internal audit?
The nonconformance must be documented with objective evidence, investigated for root cause, and resolved through a formal corrective action process per Clause 10.2. A follow-up review then confirms the corrective action was effective before the finding is closed.
