> Free ISO 9001 internal audit checklist with more than 40 audit questions for clauses 4 to 10 – tick them off online or download a print-ready PDF.

Source: [https://docxpert.io/en/checklists/iso-9001-internal-audit-checklist](https://docxpert.io/en/checklists/iso-9001-internal-audit-checklist)

# ISO 9001 Internal Audit Checklist (Free PDF)

Save as PDF

Print-ready version with tick boxes.

[Get the PDF](https://docxpert.io/en/checklists/iso-9001-internal-audit-checklist#download)

## How to use this checklist

The questions follow the structure of ISO 9001:2015. They do not replace the standard, but they help you not to miss anything important during the audit. For every question, look for **objective evidence** – an approved document, a record or an interview with the people responsible. A “yes” without evidence is not a yes in an audit.

1.  1
    
    Define the scope
    
    Choose the processes and clauses that your [audit programme](https://docxpert.io/en/guides/iso-9001-internal-audit) schedules for this audit. Not every audit needs to cover every clause.
    
2.  2
    
    Review evidence in advance
    
    Read the controlled documents of the area and the results of the last audit, so you ask the right questions in the interview.
    
3.  3
    
    Ask questions and check evidence
    
    Note what you saw for each question. Write deviations as findings with requirement, evidence and observation.
    
4.  4
    
    Turn results into actions
    
    Every nonconformity becomes a corrective action with root cause analysis and an effectiveness check – for example in [CAPA management](https://docxpert.io/en/features/capa-management).
    

## Audit questions by clause

### Clause 4 – Context of the organization

-   Have internal and external issues relevant to the purpose and strategic direction been determined (4.1), and are they reviewed regularly?
-   Have interested parties and their relevant requirements been determined (4.2)?
-   Is the scope of the QMS available as documented information, including justified exclusions (4.3)?
-   Are QMS processes defined with inputs, outputs, sequence, owners, criteria and resources (4.4)?
-   Are risks and opportunities considered for each process, and are processes changed where needed?

### Clause 5 – Leadership

-   Can top management demonstrate accountability for the effectiveness of the QMS (5.1)?
-   Is the quality policy established, available as documented information and known to employees (5.2)?
-   Have responsibilities and authorities for relevant roles been assigned and communicated (5.3)?
-   Is customer focus visible, for example through analysis of customer satisfaction and complaints?

### Clause 6 – Planning

-   Have risks and opportunities been determined, and are actions planned and evaluated (6.1)?
-   Are measurable quality objectives established and documented for relevant functions and levels (6.2)?
-   For each objective, is it defined what will be done, who is responsible, by when and how results are evaluated?
-   Are changes to the QMS carried out in a planned manner (6.3)?

### Clause 7 – Support

-   Have the necessary resources, infrastructure and process environment been determined and provided (7.1)?
-   Are monitoring and measuring resources suitable, calibrated or verified, and is this evidenced (7.1.5)?
-   Is organizational knowledge determined, maintained and available (7.1.6)?
-   Is required competence defined per activity, with evidence of education, training or experience (7.2)?
-   Is the effectiveness of training actions evaluated (7.2 c)? See [training effectiveness](https://docxpert.io/en/guides/training-effectiveness).
-   Are employees aware of the quality policy, relevant objectives and the implications of not conforming (7.3)?
-   Is it defined what, when, with whom and how to communicate internally and externally (7.4)?
-   Are documents reviewed for adequacy before release and clearly identified (7.5.2)?
-   Are current documents available at the point of use, and are obsolete versions protected against unintended use (7.5.3)?
-   Are retention periods and disposition of records defined?

### Clause 8 – Operation

-   Are planning and control of operational processes defined, including acceptance criteria (8.1)?
-   Are product and service requirements reviewed before committing to the customer (8.2.3)?
-   If applicable: are design stages, reviews, verification and validation planned and evidenced (8.3)?
-   Are external providers selected, evaluated and re-evaluated against defined criteria (8.4)?
-   Is production and service provision carried out under controlled conditions, including identification and traceability (8.5)?
-   Is property belonging to customers or external providers identified and protected (8.5.3)?
-   Are products released only after successful verification, with the releasing person recorded (8.6)?
-   Are nonconforming outputs identified, controlled and documented (8.7)?

### Clause 9 – Performance evaluation

-   Is it defined what is monitored and measured, with which methods and when results are analysed (9.1.1)?
-   Is customer satisfaction monitored and evaluated (9.1.2)?
-   Is there an audit programme with frequency, methods, responsibilities and reporting (9.2)?
-   Are auditors objective and impartial (they do not audit their own work)?
-   Does the [management review](https://docxpert.io/en/guides/management-review) take place at planned intervals and cover all inputs of 9.3.2?
-   Are the outputs of the management review documented with decisions and actions (9.3.3)?

### Clause 10 – Improvement

-   When a nonconformity occurs, is it addressed, its cause determined and corrective action taken (10.2)?
-   Is the effectiveness of corrective actions reviewed and documented?
-   Are risks and opportunities updated after a nonconformity where necessary?
-   Is there evidence of continual improvement of suitability, adequacy and effectiveness (10.3)?

## How to write audit findings

A good finding is immediately understandable to the audited department. It states the requirement, the evidence reviewed and the deviation – without judgement and without prescribing the solution.

| Element | Example |
| --- | --- |
| Requirement | ISO 9001, 7.5.3: current documents must be available at the point of use. |
| Evidence | Final inspection workstation, line 2, on 12 September. |
| Observation | Inspection instruction PA-021 version 3 was posted; version 4 has been valid since 1 August. |
| Grading | Minor nonconformity – single case, low impact, but a systemic cause is possible. |

Tip

Outdated printouts are one of the most common findings. With [controlled copies](https://docxpert.io/en/features/controlled-copies) and a QR code, anyone can check in seconds whether a printout is still valid.

## Download the checklist as PDF

Print-ready with tick boxes – ideal for your next audit or team meeting. Free; we also email you the link.

## Frequently asked questions

How often must an ISO 9001 internal audit take place?

The standard does not prescribe a fixed interval. It requires planned intervals based on the importance of processes, changes and previous results. In practice, every process is audited at least once within the three-year certification cycle, and important processes every year.

Can I adapt the checklist to my company?

Yes, you should. Add company-specific questions, for example about customer requirements or critical process steps. Do not remove questions without a reason – requirements that do not apply should be justified in the scope.

Can I use the checklist for supplier audits?

As a framework, yes. For supplier audits you typically add questions about your specific quality requirements, inspection certificates and traceability.

## Read next

[ISO 9001 internal auditAudit programme, planning, execution and reporting under clause 9.2.Learn more](https://docxpert.io/en/guides/iso-9001-internal-audit) [Certification readiness checklistReady for stage 1 and stage 2? The key evidence at a glance.Learn more](https://docxpert.io/en/checklists/iso-9001-certification-readiness) [CAPA processFrom report to effectiveness check: the CAPA process in nine steps.Learn more](https://docxpert.io/en/guides/capa-process) [ISO 9001Quality management: document control, competence, audits and improvement in one platform.Learn more](https://docxpert.io/en/standards/iso-9001)

## Try docxpert free for 14 days

Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards.

[Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)