Clause 9.2 of ISO 9001:2026 asks for two things: an audit programme, and audits that actually test whether the quality management system conforms and works. This free ISO 9001 internal audit checklist covers the second part, one audit at a time, for quality managers, internal auditors and process owners. It takes a single audit from its slot in the programme through planning, process-based fieldwork, graded findings, the report and corrective action under clause 10.2. It produces the records the standard asks you to keep: the plan, the evidence behind each finding, the report to management, the corrective action trail and the input to management review.
Clause 9.2 of ISO 9001:2026 requires internal audits at planned intervals that tell you whether the quality management system conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained. Clause 9.2.2, the internal audit programme, sets out how those audits are planned: their frequency, methods, responsibilities, planning and reporting, shaped by how important each process is and what earlier audits found.
The standard does not say how often each process must be audited, how long an audit should take or what it must cover. The ISO 9001 Auditing Practices Group, drawn from ISO/TC 176 and the accreditation community, expects a risk-based programme instead: processes with a history of problems, or where failure would hurt customers, get audited more often. For how to audit, the current guidance is ISO 19011:2026. It is guidance, not a requirement, so a certification auditor cannot raise a nonconformity against it.
Three different jobs get called “the ISO audit”. This checklist does the middle one.
Answers: which processes get audited, when, by whom and how deeply.
Cadence: set once a year, adjusted after every audit.
Output: the audit schedule, auditor pool and the risk reasoning behind it.
Answers: does this process conform, and does it work?
Cadence: each slot in the programme, plus unscheduled audits after a failure.
Output: a plan, evidence, graded findings, a report and verified corrective action.
Answers: can the certificate be issued or kept?
Cadence: set by the certification body’s own cycle.
Output: the certification decision. Out of scope here, although its auditors will sample your internal audit records.
Five phases take one audit from its programme slot to a filed report. A sixth switches on only when the audit raises a nonconformity, and stays open until the fix is verified.
The first task asks two scope questions. Their answers switch on the external-provider sampling task in Phase 3 and the transition gap task in Phase 4.
The external-provider task appears only when Phase 1 records that the process relies on outsourced processes, products or services.
The transition gap task appears only when Phase 1 records that the organisation is still certified to ISO 9001:2015.
Shown only when Phase 4 records at least one nonconformity. The auditor, not the process owner, completes the verification task.
The table maps each requirement that governs an internal audit to its clause in ISO 9001:2026 and to the phase that produces the evidence. Your own audit procedure and your certification body’s rules decide the detail, so treat the table as a starting point, not legal or certification advice.
| Requirement | ISO 9001:2026 | What the audit has to show | Evidenced in |
|---|---|---|---|
| Audits at planned intervals | 9.2 | Conformity to your requirements and the standard; effective implementation | Phases 1 and 5 |
| Internal audit programme | 9.2.2 | Frequency, methods, responsibilities, planning and reporting, weighted by process importance and earlier results | Phases 1 and 5 |
| Criteria and scope for each audit | 9.2 | Defined before fieldwork and in the plan | Phases 1 and 2 |
| Objectivity and impartiality | 9.2 | Auditor independent of the process | Phase 1 |
| Auditor competence | 7.2 | Training and experience on record | Phase 1 |
| Results reported to relevant management | 9.2 | Report issued to the people who own the process | Phase 5 |
| Documented information | 9.2, 10.2 | Programme records, audit results, nonconformities and actions | Phases 5 and 6 |
| Input to management review | 9.3.2 | Audit results and nonconformity and corrective action status | Phase 5 |
| Nonconformity and corrective action | 10.2 | Containment, root cause, action and effectiveness review | Phase 6 |
ISO 9001 itself does not grade nonconformities. “Major” and “minor” come from ISO/IEC 17021-1, the standard certification bodies work to: a major nonconformity affects the capability of the management system to achieve its intended results, and a minor one does not. Most internal audit procedures borrow them. Write yours down and apply them consistently.
ISO published ISO 9001:2026 on 16 September 2026, replacing the 2015 edition, and this checklist uses its clause numbers. Certificates to ISO 9001:2015 stay valid through the transition. Under the requirements published the same day by Global Accreditation Cooperation Incorporated (Global ACI), new accredited certifications may only be issued to the 2026 edition from 31 March 2028, and organisations certified to ISO 9001:2015 have until 30 September 2029 to transition. The structure is familiar, but some numbering moved: corrective action, split into 10.2.1 and 10.2.2 in the 2015 edition, is a single clause 10.2 in 2026. The 2026 edition also incorporates the 2024 climate change amendment, and its new Annex A explains the requirements without adding any.
Give each process its own recurring schedule, quarterly for a problem process and annually for a stable one, and each audit opens on time, assigned to its auditor. A data set of processes, owners and risk ratings fills Phase 1.
Sampled record references go into form fields, and photos and documents attach to the task they support. The activity trail shows who completed each step and when, so an external auditor can see the audit was planned, independent and reported.
Conditional logic opens Phase 6 only when a nonconformity is raised. Enforced step order stops the verification task from being ticked before the action is in place, and dynamic due dates run from the closing meeting. When a standard is revised, template versioning keeps each completed audit on the criteria it was run against.
CheckFlow is not a certification body and cannot certify you to ISO 9001, and it is not a document control system for your QMS. It runs the audit work and keeps the evidence trail. For implementing an ISO management system from gap analysis to certification, use the broader ISO Compliance Checklist. CheckFlow’s compliance checklist software shows how recurring audits, approvals and evidence fit across the rest of your compliance calendar.
On a factory floor, internal audits run alongside daily inspections and changeovers. CheckFlow for manufacturing covers those shop-floor checklists, so audit findings and the processes they test sit in one place.
Anyone competent who can audit objectively and impartially, as clause 9.2 requires. In practice auditors do not audit their own work or a process they manage. Competence falls under clause 7.2, so keep each auditor’s training and experience on record. Small organisations often swap auditors between departments or buy in an external auditor for the processes the quality manager runs. The programme and the follow-up still belong to you.
ISO 9001 does not say so. It requires audits at planned intervals and a programme that reflects how important each process is and what earlier audits found. Many organisations cover the whole QMS once a year because it is simple to defend. A risk-based programme may audit a problem process quarterly and a stable one less often. Either way, record the reasoning.
A correction fixes the problem you found: relabelling the batch, recalibrating the gauge, completing the missing record. A corrective action removes the cause so it does not happen again, and clause 10.2 expects you to review whether it worked. Audit findings that close on a correction alone tend to come back at the next audit.
No. ISO 19011 is guidance on auditing management systems, not a requirement. The ISO 9001 Auditing Practices Group confirms that an auditor cannot raise a nonconformity against it. It is still worth reading: it covers the principles of auditing, managing an audit programme, conducting audits and auditor competence. The current edition is ISO 19011:2026, published in May 2026.
An internal audit is your own check, run to your programme and criteria, and its job is to find problems. The certification audit is carried out by an accredited certification body to decide whether you can hold the certificate. Its auditors will sample your internal audit records, and a programme that never finds anything is itself a warning sign.
Audit against the 2026 edition now, because that is where the requirements are heading. ISO lists the main changes as quality culture and ethical behaviour, separate treatment of risks and opportunities, and stronger management of change, so plan audits that test those. If you are still certified to ISO 9001:2015, you have until 30 September 2029 to transition, at a surveillance or recertification audit or a separate transition audit. Until then, log gaps against the new edition for the transition plan rather than as nonconformities. Your certification body will confirm your own timing.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
