ISO 9001 Audit Checklist: A Clause-by-Clause Guide for 2026

If you are preparing for a certification audit, a surveillance visit, or your own internal review, a good ISO 9001 audit checklist is the difference between a calm week and a scramble. This guide gives you one, organized the way the standard is actually organized, clause 4 through clause 10, with the questions auditors tend to ask and the evidence worth having ready before anyone walks in.

There is also a date on the calendar you should know about. ISO 9001:2026, the sixth edition of the standard, is scheduled for publication on 16 September 2026. Until it is published, ISO 9001:2015 with its 2024 climate change amendment remains the only version you can be certified against, so the checklist below is built on 2015. We have flagged what changes in 2026 as we go, and there is a full section on the revision further down.

Key Takeaways

• ISO 9001:2015, including Amendment 1:2024, is still the only certifiable version until ISO 9001:2026 publishes on 16 September 2026. Certified organizations are expected to get a three-year transition window, likely to around September 2029, pending confirmation from the International Accreditation Forum.
• Structure your checklist around clauses 4 to 10, not around older headings like "management responsibility" or "product realization." Those belong to the 2008 edition and have not been part of the standard since 2015. Auditors work from the current clause structure, and so should you.
• Auditors are looking for evidence, not documents. A written procedure that nobody follows is a finding. A process your team can demonstrate, with records that show it running, is a pass.
• ISO 9001 is widely adopted and the bar is well understood. The ISO Survey 2024 counted 1,474,118 valid ISO 9001 certificates worldwide, and BSI reports that 66% of certified businesses see improved products and services, 65% see increased customer trust, and 60% see a reduction in errors.

Table of Contents

1. What is an ISO 9001 audit checklist?
2. Which version of the standard are you auditing against?
3. The ISO 9001 audit checklist, clause by clause
4. ISO 9001 internal audit checklist
5. How to run an ISO 9001 audit, step by step
6. Questions auditors actually ask
7. What changes in ISO 9001:2026
8. Steps to achieving certification
9. Maintaining your certification
10. The seven quality management principles
11. FAQs

What Is an ISO 9001 Audit Checklist?

An ISO 9001 audit checklist is a structured list of the requirements in the standard, turned into things you can actually check. For each requirement it sets out what the auditor will look for, what they are likely to ask, and what evidence answers the question.

It does two jobs at once. For an auditor, it keeps the audit consistent and makes sure nothing in the standard gets skipped. For the organization being audited, it is a rehearsal: work down it honestly a few weeks out and you will find your own gaps before someone else does.

The useful ones share a few traits. They follow the clause structure of the standard rather than inventing their own categories, so findings map cleanly to a clause number. They ask for evidence rather than for documents. And they leave room to record what you actually saw, not just a tick.

Why you need one

• Consistency. Two auditors working from the same checklist should reach comparable conclusions about the same process.
• Coverage. ISO 9001 has a lot of small, easy-to-miss requirements. Clause 7.1.6 on organizational knowledge is a classic one to forget.
• Traceability. When a finding is raised against a specific clause, the corrective action has a clear target.
• Communication. A checklist shared in advance tells your team what to expect, which makes audit interviews far less tense.
• Time. Preparation is almost always cheaper than remediation.

Where to get one

You can build a checklist from the standard itself, use the free one published by ISO’s own Auditing Practices Group, or start from a template and adapt it. Whale publishes an ISO 9001 checklist template you can run as a live, assignable checklist rather than a static document, which matters if you want the completed runs to become audit evidence in their own right.

Which Version of the Standard Are You Auditing Against?

Worth settling before anything else, because it is a live question in 2026.

ISO 9001:2015 is the current published edition. In February 2024, ISO published Amendment 1:2024, which added a requirement to consider whether climate change is relevant to your organization’s context. That amendment took effect immediately with no transition period, so it is already being audited. If your last audit was before 2024 and nobody asked you about climate change, expect the question this time.

ISO 9001:2026 publishes on 16 September 2026. The Final Draft International Standard has been approved and ISO/TC 176/SC 2 has confirmed the publication date. It does not become certifiable until that date. A three-year transition window is expected, taking existing certificates to roughly September 2029, though the International Accreditation Forum has to confirm the detail.

So for any audit happening now, audit against 2015 plus Amendment 1:2024. The clause structure does not change in 2026, which means a well-built 2015 checklist will carry over with additions rather than needing a rebuild. The full breakdown of what changes is below.

The ISO 9001 Audit Checklist, Clause by Clause

Clauses 1, 2 and 3 of ISO 9001 cover scope, normative references and terminology. They are informational and not auditable. Clauses 4 through 10 carry the requirements, and those are what follows.

Clause 4: Context of the Organization

Where the auditor establishes whether you understand the environment you operate in and have scoped your quality management system sensibly.

What the auditor is checking	Questions to expect	Evidence to have ready
4.1 You have identified internal and external issues relevant to your QMS, including whether climate change is relevant to you	What external factors affect your ability to deliver quality? Have you assessed whether climate change is a relevant issue?	Context analysis, SWOT or PESTLE work, business plan, strategy documents, board minutes, climate relevance assessment
4.2 You know who your interested parties are and what they require	Who are your interested parties beyond customers? Which of their requirements does your QMS address?	Interested party register, regulatory requirements list, customer and supplier requirement summaries
4.3 The scope of your QMS is defined, documented and justified	What is in scope and what is out? Why is anything excluded?	Documented scope statement, justification for any non-applicable requirements
4.4 Your processes, their inputs, outputs, sequence and interactions are determined and managed	Can you show me how your processes connect? Who owns each one?	Process map, process interaction diagram, process owner list, process performance indicators

Clause 5: Leadership

The clause where a QMS that exists only on paper tends to come apart. Auditors will talk to senior people, not just the quality manager.

What the auditor is checking	Questions to expect	Evidence to have ready
5.1 Top management is demonstrably involved and accountable, with a genuine customer focus	How does leadership demonstrate commitment to the QMS? How are customer requirements communicated to leadership?	Management review minutes, resourcing decisions, leadership communications, evidence of leaders participating in QMS activity
5.2 A quality policy exists, is appropriate, is communicated and is understood	How do you ensure employees understand the quality policy? Where is it available?	Quality policy document, communication records, induction materials, staff interviews
5.3 Roles, responsibilities and authorities are assigned and communicated	Who is responsible for QMS conformity? Who reports on performance to top management?	Org chart, role descriptions, responsibility matrix, appointment records

Clause 6: Planning

What the auditor is checking	Questions to expect	Evidence to have ready
6.1 Risks and opportunities relating to the QMS are identified with actions planned and evaluated	How do you identify risks to quality? What did you do about the last significant one? How do you know the action worked?	Risk register, opportunity log, risk treatment plans, effectiveness reviews
6.2 Quality objectives are measurable, consistent with policy, monitored and resourced	What are your quality objectives? How are they measured? Who is accountable for each?	Objectives register with targets and owners, performance data, progress reviews
6.3 Changes to the QMS are planned rather than improvised	Tell me about a recent change to the system. How was it planned, resourced and verified?	Change records, change plans, impact assessments, post-change reviews

Clause 7: Support

The largest clause, and the one where documentation and training records get examined closely.

What the auditor is checking	Questions to expect	Evidence to have ready
7.1.1 to 7.1.4 Adequate people, infrastructure and working environment	Do you have enough people to run these processes? How do you maintain equipment and facilities?	Staffing plans, maintenance schedules and records, facility assessments, workplace condition monitoring
7.1.5 Monitoring and measuring resources are suitable, calibrated and traceable	How do you know this gauge is accurate? Where is its calibration record?	Calibration certificates, calibration schedule, traceability records, out-of-calibration handling procedure
7.1.6 Organizational knowledge is determined and maintained	How do you capture knowledge when an experienced person leaves?	Documented procedures, knowledge base, handover records, cross-training evidence
7.2 People are competent for the work they do, with competence based on evidence	How do you determine competence for this role? Show me the training record for this person	Competence matrix, role requirements, training records, qualification certificates, assessment results
7.3 People are aware of the policy, objectives, their contribution, and the implications of not conforming	What does the quality policy mean for your job? What happens if you skip this step?	Awareness training records, induction content, toolbox talks, staff interviews
7.4 Internal and external communication relevant to the QMS is planned	How is quality information communicated internally? Who talks to customers about quality issues?	Communication plan, meeting schedules, notice board content, internal comms records
7.5 Documented information is created, updated, controlled, versioned and available where needed	How do you know this is the current version? How do you prevent people using superseded documents? Who approved this?	Document register, version history, approval records, access controls, retention schedule

Clause 7.5 is where a lot of organizations lose points, and it is rarely because the documents do not exist. It is because nobody can prove which version is current, or an out-of-date copy is still in use on the floor.

Documentation that carries its own version history, named approver and review date makes this clause straightforward. If your procedures live in scattered files and shared drives, SOP software is usually the practical fix.

Clause 8: Operation

The longest clause in the standard and the one closest to the actual work. Expect the auditor to spend real time here, often on the floor rather than in a meeting room.

What the auditor is checking	Questions to expect	Evidence to have ready
8.1 Operational processes are planned and controlled against defined criteria	What are the acceptance criteria for this output? How do you know the process stayed in control?	Production plans, work instructions, control plans, process monitoring records
8.2 Customer requirements are determined, reviewed before commitment, and changes are handled	How do you confirm you can meet a customer requirement before accepting the order? What happens when requirements change mid-order?	Contract review records, quotations, order confirmations, change notifications, customer enquiry handling
8.3 Design and development is planned, controlled, verified and validated, where applicable	Walk me through your design process for this product. Where are the review and verification records?	Design plans, design inputs and outputs, review minutes, verification and validation results, design change records
8.4 Externally provided processes, products and services are controlled, with suppliers evaluated	How do you select and evaluate suppliers? What happens when one underperforms?	Approved supplier list, evaluation criteria and scores, supplier performance data, incoming inspection records
8.5 Production and service provision is controlled, with identification, traceability, preservation and post-delivery activities managed	Can you trace this finished item back to its inputs? How is customer-supplied property protected?	Traceability records, batch records, labeling, storage and handling procedures, warranty and service records
8.6 Release of products and services happens only after requirements are verified	Who authorizes release? What if verification is incomplete?	Release authorization records, inspection records, sign-offs
8.7 Nonconforming outputs are identified and controlled	Show me a recent nonconformance. What did you do with the product? Who decided?	Nonconformance reports, quarantine records, disposition decisions, concession records

Clause 9: Performance Evaluation

What the auditor is checking	Questions to expect	Evidence to have ready
9.1.1 to 9.1.3 You monitor, measure, analyze and evaluate the right things, including customer satisfaction	What do you measure and why those things? What did the data tell you? What did you change as a result?	KPI dashboards, trend analysis, customer satisfaction surveys, complaint data, analysis outputs
9.2 Internal audits happen on a planned program, by objective auditors, with results reported	Show me your audit program. Who audits their own area? How are findings escalated?	Audit program, audit plans, audit reports, auditor competence records, finding logs
9.3 Management review happens at planned intervals and covers every required input	When was the last management review? Which of the required inputs were considered? What decisions came out of it?	Management review agenda and minutes, input data packs, decisions and action items with owners

Management review is one of the most common places findings get raised, usually because the meeting happened but the minutes do not show that every required input was considered. Working from a standing agenda built on the clause 9.3 input list solves most of it. If you want to see how measurement and reporting fit into a broader system, our guide to quality management system software covers the tooling side.

Clause 10: Improvement

What the auditor is checking	Questions to expect	Evidence to have ready
10.1 Improvement opportunities are identified and acted on	Where do improvement ideas come from? Show me one that was implemented	Improvement register, suggestion records, project outcomes
10.2 Nonconformities get root cause analysis, corrective action, and verification that the action worked	What was the root cause here, not the symptom? How did you confirm it will not recur? Did you check whether it exists elsewhere?	Corrective action records, root cause analysis (5 whys, fishbone, whatever you use), effectiveness verification, extent-of-problem checks
10.3 The QMS is continually improved based on evaluation results	How has the QMS itself improved over the last year?	Trend data over time, system changes, management review decisions leading to change

The recurring failure in clause 10.2 is stopping at the symptom. "Operator retrained" is not a root cause, and an auditor will say so. They will also ask whether you checked for the same problem elsewhere, which is the step most organizations skip.

ISO 9001 Internal Audit Checklist

Internal audits are a requirement in their own right under clause 9.2, and they are also your best preparation for an external one. They work differently enough to be worth treating separately.

How do internal audits differ from certification audits?

An internal audit is run by or on behalf of your own organization, against your own QMS and the requirements of the standard. A certification audit is run by an accredited certification body and determines whether you get or keep a certificate. The internal audit is where you want to find problems, because there is no consequence beyond fixing them.

Internal audits also tend to go deeper on narrower ground. A certification auditor sampling your whole system in three days cannot examine every process. An internal program spread across the year can.

Who can run an audit?

Clause 9.2 requires objectivity and impartiality, which in practice means auditors do not audit their own work. It does not require an external consultant or a formal qualification. Plenty of organizations train internal staff as auditors and rotate them across departments, which has the useful side effect of spreading understanding of the QMS.

What the standard does expect is that you can demonstrate the auditor was competent for what they audited. Keep training records, and keep them current.

Building an internal audit program

• Cover everything over the cycle, not everything every time. Your program should reach every process and every clause across a defined period, usually a year, weighted so that higher-risk or historically weaker areas get audited more often.
• Set frequency by risk, not by habit. Many organizations audit quarterly. Some audit continuously in small slices. Both are fine, as long as the program is planned and documented.
• Define criteria and scope for each audit up front. "Audit of purchasing, against clause 8.4 and procedure PUR-01" is auditable. "General audit of purchasing" is not.
• Report to the people who can act. Findings that stop at the quality department do not get fixed. Clause 9.2 expects results to be reported to relevant management.
• Feed the results into management review. Internal audit results are a required input under clause 9.3.

What an internal auditor should record

For each finding: the clause or requirement it relates to, what was actually observed, the evidence seen, the classification (major nonconformity, minor nonconformity, observation or opportunity for improvement), and the agreed action with an owner and a date. Then, and this is the part that gets skipped, the verification that the action worked.

Running internal audits as assignable checklists rather than paper forms makes the timestamped completion record itself part of your evidence, which saves reconstructing who did what after the fact.

How to Run an ISO 9001 Audit, Step by Step

1. Plan and notify. Define scope, criteria and dates. Tell the areas being audited who is coming and what will be examined. Surprise audits have their place but they are not the norm for management system audits.
2. Review documentation first. Work through the documented information before you talk to anyone. It tells you what should be happening, which is what you will then test against reality.
3. Interview people at every level. Talk to operators as well as managers. Ask open questions about how work is actually done rather than reading procedures aloud and asking for confirmation.
4. Observe the work. Watch processes running. This is where you find out whether the documented procedure matches practice, and it is where most real findings come from.
5. Sample records. Pick records at random rather than accepting a prepared file. Follow a single job all the way through, from order to delivery, if you can.
6. Record findings against clauses. Write down what you observed and the evidence for it, then classify it. Note what is working well too. It is not padding, it tells management what to protect.
7. Hold a closing meeting. Present findings to the audited area and management before you leave, so there are no surprises in the report.
8. Agree actions and follow up. Assign owners and dates, then verify the actions worked. An audit without verified follow-up has not finished.

Questions Auditors Actually Ask

Beyond the clause-specific questions above, a few come up in almost every audit:

• How do you ensure your quality policy is understood by the people doing the work?
• What happens when a customer requirement changes after you have accepted the order?
• Can you show me evidence that your processes have improved, not just been maintained?
• How do you handle customer complaints, and what happened to the last one?
• How often do you run internal audits, and what did the last one find?
• Who decides whether a nonconforming product can be released, and on what basis?
• How do you know the people doing this work are competent?
• What would happen to this process if the person who normally runs it were away for a month?

That last one is worth sitting with. It is not in the standard, but auditors ask it constantly, and the answer reveals immediately whether your documentation is real or decorative.

What Changes in ISO 9001 in 2026?

ISO 9001:2026 is scheduled for publication on 16 September 2026. The Final Draft International Standard was approved with strong international support, and ISO/TC 176/SC 2 has confirmed the date.

The most useful thing to know is what does not change. The clause structure stays as it is, clauses 1 through 10 in the harmonized structure. The process approach, risk-based thinking and the core requirements all carry over. This is a refinement of the 2015 edition rather than the kind of restructure that happened between 2008 and 2015, so a functioning 2015 system is the foundation for transition, not something to rebuild.

What is changing:

• Quality culture and ethical behavior. New expectations appear under Clause 5.1, where leadership is expected to promote a culture of quality and ethical behavior through its values and practices, and under Clause 7.3, where awareness requirements extend to employees understanding those concepts. Expect this to become an interview question rather than a document to produce.
• Risks and opportunities separated. Clause 6.1 in the 2015 edition treats them together, which many organizations found confusing and which often led to opportunities being treated as an afterthought. The 2026 edition separates them, with distinct consideration of actions for each.
• Reinforced requirements on managing change. Requirements around planning changes to the QMS are strengthened, with more expectation that you verify and review the results of a change rather than just planning it.
• Climate change folded into the main text. Amendment 1:2024 already added climate change consideration to clauses 4.1 and 4.2. The 2026 edition integrates it into the standard proper rather than leaving it as an amendment.
• Clause 3 now displays selected terms. ISO 9000 remains the normative reference for terminology, but the 2026 edition sets out a limited number of terms and definitions directly. A new fifth edition of ISO 9000 is being published alongside it.
• Annex A substantially expanded to help with interpreting the requirements.

What this means for your checklist right now. Keep auditing against 2015 plus Amendment 1:2024, because that is the only certifiable version until September. Then, as your transition approaches, the additions to make are mostly in clauses 5.1, 6.1, 7.3 and the change-management requirements. You will not need to reorganize the checklist itself.

On transition timing: a three-year window is expected, taking certificates to roughly September 2029, subject to formal confirmation from the International Accreditation Forum. Certification bodies will need time to train auditors and update their accreditation, so the practical window for transition audits opens somewhat after publication rather than immediately.

Steps to Achieving ISO 9001 Certification

If you are working toward first certification rather than maintaining an existing one:

1. Get leadership genuinely committed. Not a signature on a policy. Visible involvement, allocated resources, and a named accountable person.
2. Run a gap analysis. Compare what you do now against the clause requirements. The checklist above works for this.
3. Define your QMS scope. What products, services, sites and processes are covered.
4. Build the system and document it. Processes, procedures, and the documented information the standard requires.
5. Communicate internally. People need to understand what is changing and why before it lands on them.
6. Assign roles and responsibilities. Process owners, document approvers, internal auditors.
7. Run internal audits. Find your own problems first. This is also a clause 9.2 requirement you will need evidence of.
8. Hold a management review. Another requirement, and another thing the certification auditor will ask to see.
9. Fix what the internal audits found. With verified corrective actions, not just plans.
10. Book your Stage 1 audit. A documentation and readiness review by your certification body.
11. Complete the Stage 2 audit. The full assessment of your system in operation.
12. Maintain it. Certification is a three-year cycle with annual surveillance audits.

Key requirements for making ISO 9001 work in practice

Certification and a working quality system are not automatically the same thing. The organizations that get real value from the standard tend to have these in place:

• A clear understanding of their own context and what makes their situation specific
• Top management that treats quality as their responsibility rather than the quality department’s
• Sustained focus on what customers actually need, tested rather than assumed
• Enough resource allocated to quality management to make it viable
• Competence built deliberately through training and assessment, with records to show it
• Quality planning that connects objectives to the work people do daily
• Products and services designed with quality considered from the start
• A complaint handling process that resolves the cause, not just the complaint
• Corrective action that gets to root causes
• Improvement treated as continuous rather than as an annual project

Maintaining Your Certification

Certification is the start of a cycle rather than the end of a project. To keep it, you need to keep doing the things that earned it: monitoring performance, running internal audits on your program, holding management reviews, acting on risks and opportunities, and resourcing the system properly.

The practical failure mode is drift. Procedures written during the certification push slowly stop matching how work is done, nobody updates them, and the gap only surfaces at the next surveillance audit. Setting review dates and owners on documented information, so that someone is prompted to revisit each procedure on a schedule, prevents most of it.

Surveillance audits typically happen annually, with a full recertification audit every three years. Internal audits should be more frequent than that.

The Seven Quality Management Principles

ISO 9001 is built on seven quality management principles, defined in ISO 9000. Auditors do not audit them directly, but they explain why the requirements exist, which is useful when you are deciding how far to go on something the standard leaves open:

1. Customer focus. Meeting and anticipating customer needs.
2. Leadership. Direction and conditions set from the top.
3. Engagement of people. Competent, empowered, involved people at every level.
4. Process approach. Managing activities as interrelated processes rather than in isolation.
5. Improvement. A permanent objective, not a periodic exercise.
6. Evidence-based decision making. Decisions grounded in data and analysis.
7. Relationship management. Managing relationships with suppliers and other interested parties.

Keeping Your QMS Documentation Audit Ready with Whale

Most of what an ISO 9001 auditor asks for is documentation and evidence that the documentation is being used. That is the part organizations tend to struggle with, and it is squarely what Whale is built for.

• Version history and named approvals. Every change to a procedure lands in a timeline with an author and a timestamp, and published changes carry a named, dated sign-off. That answers clause 7.5 directly.
• Owners and review intervals. Assign a subject matter expert to each procedure and set a review date. When the date arrives, Whale creates a review assignment, so documentation does not quietly go stale between audits.
• Training records tied to the documentation. Training flows and quizzes build against the same procedures your team works from, so competence evidence for clause 7.2 comes from the same place as the procedure itself. Our guide to employee training and onboarding covers this side in more depth.
• Runnable checklists. Turn a procedure into an assignable checklist your team completes in real time, with timestamps and photo evidence. Each completed run is a record.
• Access control and audit trail. Board, library and role level permissions with a full audit trail.

If you are managing quality documentation across a growing team, our process compliance and operations page covers how this fits together, and you can start with the ISO 9001 checklist template directly.

For wider compliance programs spanning multiple frameworks, compliance management software covers the dedicated tools in that category.

Bottom Line

An ISO 9001 audit is manageable when you have prepared against the right version of the standard, in the right structure, with evidence rather than documents. Work down the clause tables above a few weeks before your audit, fix what you find, and the audit itself becomes a conversation rather than an examination.

The one thing to add to your plan this year is the 2026 revision. It publishes on 16 September 2026, it does not change the structure you are already working in, and the additions are concentrated in a handful of clauses. Knowing that now is considerably easier than discovering it during a transition audit.

FAQs About the ISO 9001 Audit Checklist