A clause-by-clause internal audit checklist covering all 10 ISO 9001 sections, the 20 most common findings, and how to write audit observations that actually drive improvement rather than generate paperwork.
An ISO 9001 internal audit must cover all 10 clauses of the standard within each 12-month audit cycle, and must probe actual process execution — not just document existence. The 20 most common ISO 9001 audit findings all involve gaps between what documented procedures say and what auditors observe on the floor; a document-review-only audit cannot detect them. This checklist gives you the questions that find those gaps before your registrar does.
The purpose of an internal audit is to determine whether your quality management system is effectively implemented and maintained. In practice, most internal audits do one of two things: they confirm that documents exist — an administrative exercise that adds no value — or they function as pre-certification rehearsals where auditors find only benign observations.
Neither approach produces the information a quality system needs to improve. An effective internal audit is professionally adversarial — the auditor genuinely tries to find gaps, and the organization genuinely wants to know where they are.
4.1 Understanding the organization and its context
4.2 Interested parties
4.3 Scope
4.4 QMS and its processes
5.1 Leadership and commitment
5.2 Quality policy
6.1 Risks and opportunities
6.2 Quality objectives
7.1.5 Monitoring and measuring resources
7.2 Competence
7.5 Documented information
8.4 Control of externally provided processes
8.5 Production and service provision
8.7 Control of nonconforming outputs
9.1 Monitoring, measurement, analysis
9.2 Internal audit
9.3 Management review
10.2 Nonconformity and corrective action
1. Work instructions not at current revision at point of use
2. Calibration records lapsed for measurement equipment in active use
3. Corrective actions closed without documented effectiveness verification
4. Training records not linked to specific procedure revisions
5. Risk register not reviewed or updated at management review
6. Quality objectives not measurable or not monitored against targets
7. Internal audit program not covering all QMS processes within the cycle
8. Supplier evaluation records incomplete or missing for active suppliers
9. Management review inputs incomplete — required topics not addressed
10. Nonconforming material not segregated from conforming inventory
11. CAPA root cause analysis superficial — "operator error" without systemic analysis
12. Customer requirements not flowed down to relevant production processes
13. Obsolete documents accessible at active workstations
14. Competence requirements not defined for specific quality-affecting roles
15. Process performance metrics collected but not analyzed for trends
16. Interested parties identified as only "the customer"
17. QMS scope not accurately reflecting the actual operation
18. Audit findings not formally reported to top management
19. Internal auditors not independent of the area they are auditing
20. No evidence that previous management review action items were followed up
A finding is not "Clause 7.5 requirement not met."
A finding is: "Work instruction WI-4521-B found at Station 3 is Revision 1.4. Current approved revision is Revision 1.6 effective March 15, 2026. Revision 1.6 includes an updated torque specification in Step 12. Operator was working from the superseded revision at time of audit."
This level of specificity is required for corrective actions to address the actual gap. A vague finding produces a vague corrective action that fails effectiveness verification, and the finding recurs at the next surveillance audit.
Every finding must state: the specific clause, the objective evidence observed, and why that evidence indicates a gap. Opinion is not evidence.
Coplain helps you build the documented information your ISO 9001 audits require and keep it current between surveillance visits. Try free at coplain.com.
Q: How often must an ISO 9001 internal audit be performed?
A: ISO 9001 Clause 9.2 requires that internal audits be conducted at planned intervals. All clauses of the standard and all processes in scope must be covered within the audit cycle — typically 12 months. Higher-risk processes should be audited more frequently than lower-risk processes.
Q: What qualifications must an ISO 9001 internal auditor have?
A: Internal auditors must be competent to conduct audits — trained in the standard and in auditing methodology — and must be independent of the work they are auditing. They do not need third-party certification, but documented evidence of their competence is required.
Q: What is the difference between a major and minor nonconformance?
A: A major nonconformance is a systematic failure or complete absence of a required element — a process with no documentation, a requirement that is never met. A minor nonconformance is an isolated lapse in an otherwise effective system. Most registrars will not issue certification if major nonconformances remain open at the conclusion of the audit.
Q: What happens if the internal audit finds no nonconformances?
A: An audit that finds nothing is almost certainly not an effective audit. If your internal audit consistently produces zero findings, your auditors are not looking deeply enough, or they are not auditing to the standard — they are auditing to your procedures. Findings are the point of the exercise.
Q: How do you document an ISO 9001 internal audit?
A: At minimum, document the audit scope and criteria, the auditees and dates, the evidence reviewed, and the findings. Findings must be documented with enough specificity that corrective actions address the actual gap — clause reference, specific evidence observed, and why it indicates a nonconformance.
Coplain turns any work instruction into a print-ready, audit-proof job aid in minutes.
Try Coplain free →AS9100 Rev D Documentation Checklist: 12 Items Auditors Check First
Most audit failures aren't about process gaps. They're about documentation that doesn't reflect reality. Here's the checklist we wish existed before our first Rev D audit.
6 min readCOMPLIANCEFDA 21 CFR Part 820 Documentation Requirements: What Trips Up Manufacturers
Warning letters. 483 observations. Consent decrees. Most FDA enforcement actions have one thing in common: inadequate documentation. Here's what the agency actually looks for.
10 min readCOMPLIANCEISO 9001:2015 Documentation Guide: What You Actually Need vs What You Think
The 2015 revision eliminated the quality manual requirement and six mandatory procedures. What it added is more demanding. Here's what actually changed — and what your registrar looks for during surveillance.
7 min readRelated Tools & Templates
COPLAIN PLATFORM
See every tool that turns complex work instructions into floor-ready documents.