QUALITY INTL CERTIFICATIONSISO Internal Audit Checklist — Free Template & Guide
An internal audit checklist turns the standard's clause areas into questions, evidence and findings. Plan audits in ISO 19011 style, keep auditors independent of the area audited, and sample evidence from records, interviews and observation. Cover all clause areas in a full cycle before recertification, then write findings as conformity, nonconformity or observation.
A copyable ISO internal audit checklist with clause-area questions for 9001.
What Internal Audit Requires
Internal audit is a requirement of the management system itself, not a courtesy for the certification body. Three elements make it valid. Planning follows ISO 19011-style practice: a defined audit programme, agreed dates, and auditors prepared with criteria and checklists. Independence keeps findings honest — auditors must not audit the function they work in. Evidence sampling makes conclusions defensible — records examined, people interviewed, processes observed.
A checklist is the tool that binds the three together. It converts each clause area of the standard into questions an auditor can actually ask, and pairs them with the evidence that answers them. Without one, audits drift into conversation; with one, they produce traceable findings.
Checklists also protect the auditor. A finding challenged in the closing meeting survives when the checklist shows the question asked, the evidence sampled and the answer found. The same finding, recalled from memory, collapses — and with it the corrective action that should have followed.
Many UAE organisations train a small internal auditor pool through internal auditor courses — QIC (Quality International Certifications), a UAE certification and inspection company since 1998, is among the providers delivering ISO training of this kind. Trained or not, every auditor needs the question bank below.
The ISO 9001 Question Bank — Copy and Adapt
The tables below cover the seven ISO 9001 clause areas: context, leadership, planning, support, operation, performance evaluation and improvement. Copy them into your audit template and add questions specific to your processes. Add an evidence column beside the questions — the record to request, the person to interview, the process to observe — and the table becomes the working audit file, not just a prompt list.
| Clause area | Sample audit questions |
|---|---|
| Context | What internal and external issues affect the QMS? Which interested parties and their requirements have been identified? Is the scope of the QMS defined and documented? |
| Leadership | How is top management accountable for the system? Is the quality policy communicated and understood? Are roles, responsibilities and authorities assigned and known? |
| Planning | How are risks and opportunities identified and acted on? Are quality objectives set, measurable and tracked? How are changes to the system planned? |
| Clause area | Sample audit questions |
|---|---|
| Support | How is competence defined and demonstrated? Are training and awareness records maintained? Are resources and infrastructure adequate for the processes? |
| Operation | How are operational processes planned and controlled? How are customer requirements reviewed before commitment? How is supplier performance controlled? |
| Clause area | Sample audit questions |
|---|---|
| Performance evaluation | Is monitoring and measurement carried out as planned? Are internal audits and management reviews completed on schedule? How are results analysed and evaluated? |
| Improvement | Are nonconformities corrected and their causes addressed? Are corrective actions verified as effective? Where has demonstrable improvement occurred? |
Work the tables in whatever order matches the audit plan, but complete all seven clause areas before the cycle closes. Where a question does not apply to your scope, mark it "not applicable" with a reason rather than deleting it, so the coverage record stays complete for the certification body to sample.
Adapting the Checklist for 14001 and 45001
The structure survives the standard change; the questions shift. For ISO 14001, add environmental questions to each area: which environmental aspects and impacts have been identified, how they are controlled, and how environmental performance is monitored alongside quality objectives.
For ISO 45001, add the occupational health and safety equivalents: how hazards are identified and assessed, how risks are controlled, and how incidents and near misses are reported and learned from. Leadership and planning questions acquire an OH&S dimension — management accountability and safety objectives sit beside quality ones.
An integrated management system can be audited with one combined checklist, with the shared clause areas asked once and the discipline-specific questions listed under each. That keeps a single audit efficient across ISO 9001, 14001 and 45001, and matches how most UAE IMS organisations actually run their programmes.
Collecting Evidence and Writing Findings
Evidence comes from three sources: records, interviews and observation. A checklist question is only answered when at least one of them supports it — a maintenance record, an operator explaining the procedure, a process running as documented. Note on the checklist which evidence answered which question, because that note is your audit trail.
Findings fall into three categories. Conformity: the requirement is met and evidence shows it. Nonconformity: a requirement is not met, and objective evidence proves it. Observation: something worth attention that breaches no specific requirement — a trend, a risk, a near-miss of a requirement.
| Finding type | Meaning | Typical action |
|---|---|---|
| Conformity | Requirement met, evidenced | Record and move on |
| Nonconformity | Requirement not met, evidenced | Correction plus corrective action |
| Observation | No breach, but worth attention | Consider improvement |
A well-written nonconformity has three parts: the requirement, the evidence, and the gap between them. "Training records were not maintained" is an opinion; "the standard requires documented evidence of competence, and no training records were available for the inspection team" is a finding. Write it so a reader who was not present can verify it, and so the auditee knows exactly what to correct.
Scheduling the Audit Programme
The programme, not the individual audit, is what certification bodies check. The requirement is that internal audits run at planned intervals and cover the full management system within the cycle — completing every clause area before recertification, not just the comfortable ones.
Spread the cycle across the certification period. A Dubai facility might audit operation and support in one quarter, planning and leadership in the next, and reserve performance evaluation and improvement for the run-up to the surveillance audit. What matters is coverage, evidence and follow-through: findings closed before external auditors sample them.
Give the programme an owner. In UAE SMEs the internal audit programme often lives in one person's inbox, and their departure silently ends the cycle. A named programme owner, a dated annual schedule and audit records filed where the next auditor can find them cost nothing and prevent the classic surveillance finding.
Scheduling failures are the classic UAE SME finding — audits happen before certification and then stall. A dated audit programme, with named auditors and clause areas, is the cheapest defence against that.
Checklist
Before each internal audit, confirm:
- The audit programme covers every clause area within the cycle.
- Auditors are independent of the areas they audit.
- The checklist pairs each question with the evidence that answers it.
- 14001 and 45001 questions are added for integrated systems.
- Findings are written as conformity, nonconformity or observation.
- Every nonconformity names the requirement, the evidence and the gap.
- Findings from the previous audit were closed and verified.
- Records of the audit are retained for the certification body to sample.
Frequently Asked Questions
What should an ISO internal audit checklist include?
The clause areas of your standard turned into questions, each paired with the evidence that answers it — records, interviews or observation. For ISO 9001 that means context, leadership, planning, support, operation, performance evaluation and improvement, plus process-specific questions you add yourself. The tables above are a copyable starting point.
Who can perform internal audits for ISO?
Someone competent, trained and independent of the area being audited. Competence comes from knowing the standard and audit technique, typically built through an internal auditor course; independence means not auditing your own function. External consultants can perform internal audits, but many UAE organisations prefer a trained internal pool.
How often must internal audits be done?
At planned intervals defined by your audit programme, with the full management system covered within the cycle — all clause areas audited before recertification. The standard does not prescribe a fixed frequency; the programme you set and actually follow is what certification auditors verify. Stalled programmes between surveillance audits are a common finding.
What is the difference between internal audit and certification audit?
An internal audit is performed by or for the organisation itself, sampling the system against the standard to find and fix gaps. A certification audit is performed by an external certification body to decide whether the certificate is granted, maintained or renewed. Internal audits feed the certification audit: completed cycles and closed findings are exactly what external auditors check.
How do I write a nonconformity correctly?
Name the requirement, describe the objective evidence, and state the gap between them — in words a reader who was not present could verify. "No training records were available for the inspection team, and the standard requires documented evidence of competence" works; "training is weak" does not. Then track correction and corrective action until verified effective.