ISO 9001 internal audit: a question checklist and how to run the audit step by step

Published 27 October 2026.

In many companies the internal audit is a yearly ritual before the certification body visits: a question list copied from last year, a few signatures and a report with “no nonconformities”. Such an audit tells management nothing. Done well, it is the cheapest process review a company can run on its own. It shows where practice has drifted away from what is written down, before a customer or an external auditor notices.

Below we describe what the standard requires, how to run the audit step by step and which questions to ask in each area. You can copy the question list and adapt it to your processes.

What ISO 9001 requires (clause 9.2)

The internal audit requirements are short. The company must:

• conduct audits at planned intervals to check whether the system meets the company's own requirements and those of the standard, and whether it is effectively implemented and maintained,
• have an audit programme that sets the frequency, methods, responsibilities and reporting, taking into account the importance of processes, changes in the company and the results of previous audits,
• define the criteria and scope of each audit,
• select auditors and conduct audits so as to ensure objectivity and impartiality,
• report the results to relevant management,
• take correction and corrective action without undue delay,
• retain documented information as evidence of the audit programme and the audit results.

The standard does not say how many audits to run, how long they should take or what the question list should look like. Guidance on how to audit is in a separate standard, ISO 19011. Its new edition was published in May 2026 and replaced the 2018 edition. It is guidance rather than requirements, and among other things it expands the guidance on remote audits.

The internal audit step by step

1. A yearly audit programme. A list of processes, dates and auditors. Audit more often the processes that matter to the customer, those that have changed and those with complaints or nonconformities last year. You do not have to audit everything at once just before the certification audit.
2. The audit plan. Scope, criteria (clauses of the standard, procedures, customer requirements), date and people. Send the plan to the auditees in advance so they can prepare people, not paperwork.
3. The question list. Start with the list below. Adapt it to the process and add threads from the previous audit, complaints and indicators.
4. The audit on site. Conversations, observation of the work and a review of records. Ask about a specific case from recent weeks, not about how things “should be”.
5. Closing meeting and report. Findings with evidence: strengths, nonconformities and observations. The report goes to the management responsible for the area.
6. Correction and corrective action. The process owner removes the effect, looks for the cause and plans an action with a deadline.
7. Checking effectiveness. After a few weeks, check whether the problem has come back. Closing nonconformities without this step is one of the most common weaknesses in the systems we see.

ISO 9001 internal audit checklist

The questions are grouped by chapter of the standard. The second column suggests what evidence to ask for. The questions on quality culture and on separate actions for risks and opportunities reflect the new emphases of the 2026 edition (clauses 5.1, 6.1 and 7.3).

How to ask so the audit finds something

• Ask about a case, not a rule. “Show me the last order with a non-standard delivery date” tells you more than “Do you review customer requirements?”.
• Follow one order. From the order through purchasing, production and inspection to shipping. Most issues show up where departments hand over work.
• Compare three sources. What the instruction says, what the employee says and what the records show. A gap between them is the most valuable finding of an audit.
• Record evidence precisely. Document number, date, workstation. A finding without evidence will not stand up in the report.
• Record strengths too. An audit that only points out faults teaches people to hide problems.

The most common mistakes

• The same question list every year, unrelated to the risks and results of the process.
• The auditor checks their own area or their manager's work.
• A nonconformity closed with a correction only, without a root cause analysis.
• A report nobody in management reads and that never reaches the management review.
• All audits in one week just before the certification audit.

How we can help

We run internal audits as external auditors, which solves the impartiality problem in smaller teams, or together with your auditors so they learn to run audits along the way. We run audits in the vibe4you OS app: questions, evidence, ratings and the report sit in one place, and corrective actions have an owner and a deadline. If you are preparing for the new edition of the standard, start with the free ISO 9001:2026 gap analysis or see how the ISO Readiness Scan works. More about our work with management systems on the ISO management systems page.

Frequently asked questions

How often must an ISO 9001 internal audit be carried out?

The standard does not set a frequency. It requires audits at planned intervals and a programme that takes into account the importance of processes, changes in the company and the results of previous audits. In practice most companies audit every process at least once a year, and key or problematic processes more often.

Who can be an ISO 9001 internal auditor?

Someone who knows the requirements of the standard and audit techniques and does not audit their own work, so that the audit is objective and impartial. The standard does not require an auditor certificate, but the company must be able to show competence, for example through training and experience. An external auditor can also carry out the audit.

What is the difference between a nonconformity and an observation in an audit report?

A nonconformity is a failure to meet a specific requirement of the standard, a procedure, a customer or the law, supported by evidence. An observation, also called an opportunity for improvement, points to a weakness or risk that is not yet a nonconformity but could become one.

Does ISO 9001:2026 change the rules for internal audits?

According to the published reviews by certification bodies, the requirements for the internal audit itself have not changed significantly. What changes is what is worth auditing: quality culture and ethical behaviour, separate actions for risks and for opportunities, and the planning of changes. A new edition of the ISO 19011 auditing guidelines was also published in May 2026.

Sources: ISO 9001:2015 and ISO 9001:2026 (clauses 5.1, 6.1, 7.3 and 9.2), ISO 19011:2026 Guidelines for auditing management systems, reviews of the changes published by certification bodies (LRQA, DQS). As of October 2026. The question list is a starting point and needs to be adapted to the company's processes.