An ISO 9001 internal audit is a planned, independent check of whether your quality management system works as described and meets the standard’s requirements. An ISO 9001 internal audit checklist is how that check gets done: it turns your audit criteria — the standard, your own documented processes, and legal and customer requirements — into process-by-process questions, each answered with objective evidence. According to the ISO 9001 Auditing Practices Group (2016), the internal audit acts as a feedback mechanism for top management, and can give top management and other interested parties assurance that the system meets the requirements of ISO 9001.
An ISO 9001 internal audit is a planned, independent check of whether your quality management system works as described and meets the standard’s requirements. An ISO 9001 internal audit checklist is how that check gets done: it turns your audit criteria into process-by-process questions, each answered with objective evidence. According to the ISO 9001 Auditing Practices Group (2016), the internal audit acts as a feedback mechanism for top management, and can give top management and other interested parties assurance that the system meets the requirements of ISO 9001.
Who this guide is for
- The newly appointed internal auditor or quality officer who must run an audit from plan to report without missing anything.
- The quality manager who owns the audit program and needs it to find real issues, as part of ISO 9001 certification readiness.
- The owner or general manager asking whether in-house staff can audit properly, and what outside help makes the system sustainable.
- The HR or training lead arranging in-house internal auditor training (iç tetkik eğitimi) to build a pool of competent auditors.
What ISO 9001 requires, and what is good practice
ISO 9001 requires internal audits at planned intervals. It requires defined audit criteria and scope, objectivity, recorded results, reporting to relevant management, and action on nonconformities. It does not set one audit frequency for every organization.
How you audit is guidance rather than requirement. ISO (undated) describes ISO 19011 as guidelines for auditing management systems, including quality management systems, covering the principles of auditing, managing audit programs and conducting audits. ISO/TC 176 (2026) states that the 2026 version addresses the growing impacts of technology, digitization and virtual environments, with increased focus on risk analysis and mitigation.
Check which edition your criteria name. ISO (undated) records ISO 9001:2015 as withdrawn and replaced by ISO 9001:2026.
From the audit program to the audit plan
The audit program
ASQ (undated) describes an audit program as the arrangements made to complete all of the individual audits needed to achieve a specific purpose. In practice that is your annual view: which processes, how often, in what order. Weight it by the importance of each process, previous audit results, process changes, known nonconformities, and risks and opportunities. CQI | IRCA (2022) notes that many people responsible for meeting the internal audit requirements of ISO 9001:2015 have little previous experience to draw on when setting up and running an internal audit programme.
The audit plan
Each audit then needs its own plan. State the purpose, the scope, the criteria, the date and duration, the processes to be audited, the audit team, the departments and people involved, and the audit methods. Share the plan with those departments in advance.
Audit criteria
Criteria are what you measure against. They normally come from the ISO 9001 requirements, your quality management system documentation, your own process rules, applicable legal and regulatory requirements, and customer and contract requirements. Auditing the standard alone is not enough. Audit your own rules too.
How to build an ISO 9001 internal audit checklist
Build the checklist per process, not per clause. The ISO 9001 Auditing Practices Group (2016) is explicit that auditors have to understand that auditing a quality management system is auditing an organization’s processes and their interactions. Clause-by-clause lists tend to miss the handovers between processes, which is where problems usually sit.
Published guidance to build an internal audit checklist on
Example questions for purchasing
- Are purchasing activities defined, and who approves them?
- Are supplier selection criteria set, and are they applied?
- Is supplier performance evaluated, and what happens when it drops?
- Is the conformity of purchased products and services checked on receipt?
- Are purchasing records retained and retrievable?
Do not settle for yes or no answers. Each question needs the practice behind it and the evidence that shows it.
Conformance and performance questions
ASQ (2016) describes auditing an organization for compliance with ISO standards as having two parts: conformance audits and performance audits. Ask both. Is the procedure followed, and is the process achieving the objectives set for it?
On-site and remote methods
Choose the method while you plan. The ISO 9001 Auditing Practices Group (2020) notes that remote auditing is one of the audit methods described in ISO 19011:2018 Annex A1. For a remote session, agree in advance which records will be shown on screen, and by whom.
Conducting the audit, reporting and following up
Objective evidence and nonconformity wording
Collect evidence by reviewing documents and records, interviewing people, and observing the work. A finding stands on evidence, never on the auditor’s assumption. A nonconformity report should name the process or department, the requirement not met, the objective evidence, a clear statement of the gap, and the reference to the standard or internal rule. Classify findings as nonconformity, observation or opportunity for improvement, using your own defined scheme.
Correction and corrective action
These are not the same thing. Correction fixes the case in front of you. Corrective action removes the cause, so the problem does not return. Keep the sequence: describe the nonconformity, correct and contain it, find the root cause, decide the action, carry it out, then verify its effectiveness. The audit results and open actions then feed the management review.
Auditor competence and internal auditor training
ISO 9001 asks for competent auditors, not for one named certificate. An internal auditor needs working knowledge of the standard, audit technique, the ability to judge objective evidence, clear reporting and interview skills. Impartiality matters: as far as possible, nobody audits their own work. In-house internal auditor training is a practical way to build a group of auditors who can cover each other’s areas.
Common mistakes
- Auditing only before an external audit, instead of at planned intervals.
- Setting the program without regard to process importance and risk.
- Reusing one generic checklist for every process.
- Relying on personal opinion instead of objective evidence.
- Letting auditors audit their own work.
- Closing corrective actions with no root cause analysis and no effectiveness check.
What to check before you order internal audit support or training
- Get the scope in writing: current-state analysis, system support, audit preparation, training, or a combination.
- Check that the proposal names which processes are audited, and in what sequence.
- Ask which edition of ISO 9001, and which edition of ISO 19011, the work is based on.
- Ask for checklists tailored to your organization rather than a generic file.
- Require that your own people take part, so the system stays yours after the project ends.
- Confirm who will be competent to run the next audit cycle without outside help.
- Treat any promise of a certificate, a pass or a fixed certification date as a warning sign. No consultant can give one.
- Keep the roles straight: you implement, a certification body audits and certifies, the consultant prepares and trains.
Working with Kalite Pusulası
Kalite Pusulası is a quality management consultancy and training firm. We neither certify nor accredit. Your organization implements the system. A certification body audits and certifies the management system. For laboratories, inspection bodies and certification bodies, the accreditation body accredits; in Türkiye that body is TÜRKAK. Our part is preparation and training.
We work within the scopes of ISO 9001, ISO 13485, ISO/IEC 17025, ISO/IEC 17020, ISO/IEC 17065 and FSC. The services are a current-state analysis and a roadmap; setting up or improving the system with your team; internal audit, management review and audit preparation; and training tailored to your organization, on site or online, after which participants receive a certificate of attendance. Establish. Improve. Make it sustainable.
If you want your internal audits to tell management something useful, ask us for a current-state analysis and a proposal for internal audit support, tailored to your organization. If auditor competence comes first, ask to see the internal auditor training (iç tetkik eğitimi) program, on site or online.
Sources
- ISO — ISO 19011:2026, Guidelines for auditing management systems
- ISO/TC 176 (2026) — ISO 19011:2026 Released
- ISO 9001 Auditing Practices Group (2016) — Guidance on: Internal audit
- ISO 9001 Auditing Practices Group (2016) — Guidance on: Processes
- ISO 9001 Auditing Practices Group — Guidance on ISO 19011:2018
- ISO 9001 Auditing Practices Group (2020) — Guidance on: Remote Audits
- ISO — ISO 9001:2015, Quality management systems — Requirements
- ASQ (2016) — Auditing Strategy for ISO 9001:2015
- ASQ — ISO 19011: Guidelines for Auditing Management Systems
- CQI | IRCA (2022) — Effective management of an internal audit programme
Frequently asked questions
How often should an ISO 9001 internal audit be done?
At planned intervals. The standard sets no single frequency for every organization, so you decide it in the audit program. ASQ (undated) describes an audit program as the arrangements made to complete all of the individual audits needed to achieve a specific purpose. Weight frequency by process importance, changes, risks and previous audit results.
Who can carry out an ISO 9001 internal audit?
Anyone with the required competence and the necessary impartiality. That can be your own trained staff or an auditor appointed from outside. As far as possible, nobody audits their own work. Competence means knowledge of the standard, audit technique, judgment of objective evidence, and clear reporting.
What is the difference between an internal audit and a certification audit?
An internal audit is run by or for the organization to evaluate its own quality management system. According to the ISO 9001 Auditing Practices Group (2016), it acts as a feedback mechanism for top management. A certification audit is carried out by an independent certification body, which audits and certifies the management system.
Is ISO 9001 internal auditor training mandatory?
ISO 9001 requires competent internal auditors rather than one named certificate. Training is a practical way to build that competence, especially where staff are running an audit program for the first time. Kalite Pusulası delivers internal auditor training tailored to your organization, on site or online; participants receive a certificate of attendance.