Retail audit checklist template
ISO 9001 Internal Audit Checklist
Run a practical internal QMS audit against the current published ISO 9001 requirements, following real processes from context and leadership through operations, performance evaluation, corrective action, and continual improvement.
Current-standard note: this template is based on ISO 9001:2015 with Amendment 1:2024. ISO is developing the next edition and currently expects it to replace the 2015 edition in September 2026, so confirm the published standard status before using the checklist for certification preparation.
Can the process show that customer requirements are reviewed, translated into controlled work, verified before release, and supported by retained evidence?
Process Owner | Correct current issue | Investigate cause | Assign action | Verify effectiveness
Select an answer to preview the workflow.
About this checklist
What an ISO 9001 internal audit should help you verify
Verify that the quality management system is implemented in real processes, produces reliable evidence, controls customer and supplier requirements, monitors performance, detects nonconformity, drives corrective action, and supports continual improvement.
When
Planned internal audits, certification preparation, surveillance follow-up, major changes, and recurring quality issues
Use it as part of the internal audit programme, before external audits, after major process or organizational changes, and when repeated quality or customer issues suggest deeper QMS weaknesses.
Who
Internal auditors, quality teams, process owners, leadership, operations, procurement, and support functions
Use competent auditors who can remain objective for the area reviewed. Process owners and relevant teams should provide records, interviews, observations, and follow-up evidence.
Outcome
Objective evidence of QMS conformity, system weaknesses, and accountable corrective action
Create a consistent audit record across clauses 4 to 10, with process evidence, findings, classification, owners, deadlines, effectiveness verification, and management visibility.
Complete ISO 9001 internal audit checklist
60 checks covering ISO 9001 clauses 4 to 10 through a process-based internal audit
Use the clause references as audit criteria, then adapt the questions to your QMS scope, processes, products, services, customer requirements, statutory and regulatory obligations, documented information, and internal procedures. This template paraphrases the audit intent and does not reproduce the ISO standard.
Section 1Audit setup, QMS scope, process map, criteria, sampling, and previous findings
- Confirm the audit date, site, department, process, auditor, auditee, QMS scope, applicable products or services, and organizational boundaries included in the internal audit.
- Verify the audit criteria reference the current published ISO 9001 requirements applicable to the organization, including ISO 9001:2015 and Amendment 1:2024 while that edition remains current.
- Map the audited process to its inputs, outputs, sequence, interactions, owners, controls, records, performance measures, risks, suppliers, and customers or downstream users.
- Review previous internal and external audit findings, customer complaints, process defects, nonconforming outputs, supplier issues, missed objectives, and open corrective actions before sampling.
- Define the audit sampling approach across shifts, locations, records, products or services, employees, suppliers, changes, and recent problem areas based on process risk and performance.
- Confirm auditor competence, objectivity, audit plan, interview approach, evidence requirements, finding classification, reporting method, and follow-up responsibilities.
Section 3Clause 5: leadership, customer focus, quality policy, roles, responsibilities, and accountability
- Verify top management demonstrates accountability for QMS effectiveness and integrates quality requirements into relevant business processes and decisions.
- Confirm leadership promotes customer focus by ensuring customer, statutory, regulatory, and other applicable product or service requirements are understood and consistently addressed.
- Check leadership reviews risks and opportunities that can affect product or service conformity and customer satisfaction and supports actions where performance is weak.
- Verify the quality policy is appropriate to organizational purpose and context, supports strategic direction, provides a basis for quality objectives, and is communicated and available as intended.
- Interview sampled employees and confirm they understand the quality policy at a practical level and can explain how their work contributes to product, service, process, or customer quality.
- Confirm QMS roles, process ownership, authorities, escalation, reporting, conformity responsibilities, and responsibility for promoting customer focus are clearly assigned and understood.
Section 5Clause 7: resources, people, infrastructure, environment, monitoring resources, knowledge, competence, awareness, communication, and documents
- Verify sufficient people, infrastructure, technology, work environment, external services, and other resources are available to operate and improve the QMS and deliver conforming outputs.
- Confirm monitoring and measuring resources are suitable for their intended purpose, maintained, calibrated or verified where required, identified, protected, and traceable when measurement traceability is necessary.
- Check organizational knowledge needed for process operation and product or service conformity is maintained, available, updated, and protected against loss when key people, technology, or requirements change.
- Verify competence requirements are defined for quality-affecting roles and that sampled employees have evidence of education, training, skills, experience, or evaluated effectiveness of actions taken.
- Confirm employees are aware of the quality policy, relevant objectives, their contribution to QMS effectiveness, benefits of improved performance, and consequences of not following QMS requirements.
- Verify internal and external communications and documented information are controlled for approval, review, version, access, distribution, storage, protection, retention, retrieval, change, and prevention of unintended obsolete use.
Section 7Clause 8B: production and service provision, identification, customer property, preservation, release, changes, and nonconforming outputs
- Verify production or service activities are performed under controlled conditions with current instructions, suitable resources, competent people, monitoring, acceptance criteria, and required records.
- Confirm identification and traceability controls are adequate where status, batch, order, serial, service case, customer, process stage, or other traceability is required for conformity.
- Check customer or external-provider property is identified, protected, verified as appropriate, and reported when lost, damaged, unsuitable, or otherwise compromised.
- Verify outputs are preserved through handling, storage, packaging, transport, delivery, and post-delivery activities so conformity is maintained through the required lifecycle stage.
- Confirm release of products and services occurs only after planned verification is complete and records identify acceptance evidence and the person authorizing release.
- Verify nonconforming outputs are identified, controlled, corrected or otherwise dispositioned appropriately, reverified after correction where required, and retained records describe the nonconformity, actions, concessions, and authority.
Section 9Clauses 9.2 and 9.3: internal audit programme, audit evidence, management review, and leadership decisions
- Verify the internal audit programme covers the QMS requirements, organization-defined requirements, key processes, sites, relevant shifts, prior findings, changes, and performance risk over the planned cycle.
- Confirm audit frequency, scope, methods, responsibilities, planning, and reporting consider process importance, organizational changes, previous audit results, customer impact, and known performance issues.
- Check internal auditors are competent and sufficiently objective for the areas they audit and that audit evidence supports each finding without relying on unsupported opinion.
- Verify internal-audit corrections and corrective actions are completed without undue delay, assigned to responsible owners, and followed through to objective verification and closure.
- Confirm management review occurs at planned intervals and considers required QMS inputs such as previous actions, context changes, customer and process performance, objectives, audits, nonconformities, supplier performance, resources, risks, and opportunities.
- Verify management-review outputs include decisions and actions for improvement, QMS changes, resource needs, priorities, owners, timelines, and follow-up rather than remaining as untracked discussion.
Section 2Clause 4: organizational context, interested parties, QMS scope, and process management
- Verify the organization has identified internal and external issues relevant to its purpose, strategic direction, and ability to achieve intended QMS results.
- Confirm the organization has determined whether climate change is a relevant issue to its QMS context and can explain the conclusion with appropriate evidence.
- Check relevant interested parties and their applicable requirements are identified, monitored, and translated into QMS or process requirements where necessary.
- Verify the documented QMS scope matches actual sites, activities, products, services, organizational boundaries, and justified applicability of ISO 9001 requirements.
- Confirm QMS processes, interactions, criteria, methods, responsibilities, resources, risks, opportunities, monitoring, records, and planned improvements are defined and operating.
- Sample one core process end to end and verify actual practice, interfaces, controls, performance evidence, and retained records align with the organization's defined QMS process approach.
Section 4Clause 6: risks and opportunities, quality objectives, planning, and change management
- Verify QMS risks and opportunities are identified from context, interested-party requirements, process performance, customer needs, compliance obligations, and operational changes.
- Check planned actions to address significant risks and opportunities are proportionate, integrated into QMS processes, assigned to owners, and evaluated for effectiveness.
- Confirm quality objectives are established at relevant functions and levels and are measurable or otherwise objectively evaluable, monitored, communicated, and updated when needed.
- Verify each sampled quality objective has a target, owner, required resources, action plan, timing, measurement method, current result, and evidence of review or intervention when off track.
- Check planned QMS changes consider purpose, potential consequences, system integrity, resource availability, and changes to responsibilities or authorities before implementation.
- Review recent changes to products, services, suppliers, systems, facilities, processes, staffing, or customer requirements and verify the QMS impact was assessed and controlled.
Section 6Clause 8A: operational planning, customer requirements, design and development, and external providers
- Verify operational processes are planned and controlled with defined requirements, acceptance criteria, resources, process controls, documented information, and actions for risks and opportunities.
- Confirm customer and applicable statutory or regulatory requirements for products and services are identified, reviewed before commitment, clarified when incomplete, and updated when requirements change.
- Check changes to customer requirements are communicated to relevant functions and that affected documents, systems, orders, specifications, or operational controls are updated.
- Where design and development is applicable, verify planning, inputs, controls, reviews, verification or validation as appropriate, outputs, changes, responsibilities, and retained evidence are controlled.
- Confirm externally provided processes, products, and services are evaluated and controlled based on their effect on conformity, including supplier selection, monitoring, re-evaluation, requirements, and verification.
- Sample a supplier or outsourced process and trace requirements from purchase or service specification through receiving or acceptance, performance monitoring, nonconformity handling, and supplier follow-up.
Section 8Clause 9.1: monitoring, measurement, analysis, evaluation, customer satisfaction, and QMS performance
- Verify the organization has defined what QMS and process performance must be monitored or measured, the methods used, timing, responsibilities, evaluation criteria, and records retained.
- Confirm customer perception or satisfaction is monitored using suitable methods and that negative trends, complaints, returns, service failures, or other feedback lead to review and action.
- Check process and quality data are analyzed for conformity of products and services, customer satisfaction, QMS performance, planning effectiveness, risk actions, supplier performance, and improvement needs.
- Verify sampled performance metrics can be traced from source data to calculation, target, analysis, reporting, owner review, and resulting action when performance is outside expectation.
- Confirm trend analysis considers recurrence, variation, systemic weaknesses, changes, and emerging issues rather than reviewing isolated monthly values only.
- Check management and process owners use performance results to make decisions about resources, controls, supplier management, objectives, corrective actions, and improvement.
Section 10Clause 10: improvement, nonconformity, corrective action, and audit sign-off
- Verify improvement opportunities are identified from customer needs, process performance, audit results, data analysis, risks, complaints, defects, supplier issues, and management review.
- Confirm significant nonconformities trigger immediate correction or containment, evaluation of consequences, investigation of cause where needed, and review for similar potential issues elsewhere.
- Check corrective actions address verified causes, are proportionate to the effects of the nonconformity, have named owners and deadlines, and result in necessary updates to risks, controls, or the QMS.
- Verify corrective-action effectiveness is reviewed using objective evidence after sufficient time or process cycles and that ineffective actions are reopened, extended, or revised.
- Confirm the organization demonstrates continual improvement in the suitability, adequacy, and effectiveness of the QMS through measurable changes, learning, stronger controls, or improved results.
- Record final audit findings, clause or process reference, evidence, classification, immediate correction, corrective-action owner, due date, overall internal-audit result, follow-up date, auditor, auditee, management-system owner, and sign-off.
Take it with you
Use the complete checklist during your next ISO 9001 internal audit
Download the printable version, or continue below to see how the same audit can run with clause mapping, live evidence, findings, corrective actions, deadlines, verification, approvals, and reporting in Taqtics.How to use it
Audit the QMS as a connected process system, not a clause-by-clause paperwork exercise
Start with scope and process risk, follow real work and evidence, trace customer and supplier requirements through operations, test performance data and management decisions, and keep findings open until corrective-action effectiveness is verified.
Plan around processes and risk
Define scope, criteria, process interactions, previous findings, performance issues, sampling, evidence, and auditor responsibilities.
Follow actual work
Interview people, observe execution, sample records, trace customer and supplier requirements, verify controls, and compare practice with QMS requirements.
Record evidence-based findings
Link findings to the applicable requirement and process, describe objective evidence, classify consistently, and assign correction and corrective action.
Verify closure and improve
Confirm causes are addressed, actions work, recurring issues are reduced, and audit results feed management review and continual improvement.
Live interactive demo
See how an ISO 9001 internal audit works in Taqtics
Audit a representative QMS control, record a nonconformity, attach objective evidence, assign the process owner, and preview corrective-action verification.
Capture clause or process reference, requirement, evidence, status, finding, owner, due date, and audit history together.
Route nonconformities to process owners with correction, root cause, action, deadline, escalation, and effectiveness verification.
Track findings by clause, process, site, repeat issue, overdue action, audit score, closure speed, and management-system trend.
Illustrative website demo. Responses are not stored or submitted.
Why digitize it
A clearer way to run ISO 9001 internal audits across processes and locations
Taqtics connects audit schedules, clause and process criteria, live evidence, scoring, nonconformities, corrective actions, verification, approvals, reports, and dashboards in one QMS audit workflow.
Standardize audit criteria
Use consistent process and clause questions, evidence requirements, finding categories, critical rules, sampling guidance, and approval logic.
Capture objective evidence
Record photos, comments, records, measurements, customer or supplier evidence, process observations, timestamps, and findings during the audit.
Turn findings into corrective action
Assign process owners, deadlines, root-cause work, escalations, implementation proof, and effectiveness verification without separate spreadsheets.
Compare QMS performance
Track findings by clause, process and site, repeated issues, overdue actions, closure speed, audit scores, and management-system trends.
Frequently asked questions
ISO 9001 internal audit checklist FAQs
Which version of ISO 9001 does this checklist use?
This template is based on the current published ISO 9001:2015 requirements together with Amendment 1:2024. ISO is developing a replacement edition expected in September 2026, so confirm the published standard status before certification or recertification use.
Which clauses should an ISO 9001 internal audit cover?
The auditable QMS requirements are primarily in clauses 4 through 10, covering context, leadership, planning, support, operation, performance evaluation, and improvement. Your audit programme should cover all applicable requirements and the organization's own QMS requirements over its planned cycle.
Does every internal audit need to cover every ISO 9001 clause?
Not necessarily in one audit. The internal audit programme can be process-based and risk-based, but it should provide planned coverage of the full applicable QMS scope and requirements over the audit cycle, considering process importance, changes, previous results, and performance.
What evidence should an ISO 9001 internal auditor collect?
Use interviews, observation, current documented information, process records, customer and supplier evidence, monitoring data, release evidence, nonconformity records, audit reports, corrective-action evidence, and management-review outputs as appropriate to the process being audited.
What is a good ISO 9001 audit finding?
A strong finding states the applicable requirement or process criterion, the objective evidence observed, and the specific gap. It avoids unsupported opinion and gives the process owner enough clarity to understand the issue and investigate the cause.
Does this checklist replace ISO 9001 itself?
No. This is an audit template that paraphrases audit intent and practical evidence checks. Use the current official ISO 9001 publication and your organization's QMS requirements as the formal audit criteria.
Schedule ISO 9001 internal audits, capture objective evidence, assign nonconformities, verify corrective actions, and compare QMS performance across every location.
Run ISO 9001 internal audits with traceable evidence and accountable corrective action
Standardize QMS audit execution, identify systemic gaps faster, route findings to the right process owner, verify effectiveness, and see recurring quality issues across processes and sites.
Printable PDF | Free Taqtics trial | No credit card required