Internal Audit under ISO 9001: Checklist of Questions and Process for SMEs

An internal audit under ISO 9001 is a planned, independent check of whether your quality management system meets your own requirements and those of the standard, and whether it is effectively implemented. Clause 9.2 requires internal audits at planned intervals, managed through an audit programme and carried out by people who look at the audited area objectively and impartially. The standard does not set a fixed frequency. It depends on the importance of the processes, on changes and on the results of previous audits.

In this article you will find the internal audit process in six steps, a question checklist for clauses 4 to 10 including the changes in ISO 9001:2026, questions for top management and guidance on how to rate findings. What changes with the new edition in general is covered in our article on ISO 9001:2026.

What clause 9.2 requires

The requirements for internal audits are in clause 9.2. Summarised in our own words, the standard requires the following.

• Audit programme. You plan one or more programmes covering frequency, methods, responsibilities, planning requirements and reporting. In doing so you take into account the importance of the processes, changes affecting the organisation and the results of previous audits.
• Criteria and scope for each audit. For every audit you define what is checked against and what is included.
• Objectivity. Auditors are selected so that objectivity and impartiality are ensured.
• Report. The results go to the relevant management.
• Corrections. Corrections and corrective actions are taken without undue delay.
• Evidence. The programme and the results are evidenced as documented information.

New in ISO 9001:2026. According to analyses by consultants and certification bodies, clause 9.2 of the 2026 edition also requires audit objectives for each audit, not just criteria and scope. Check the exact wording in the standard before adapting your templates. Defining an objective does no harm in any case, for example «check whether complaints are closed on time and effectively».

ISO 9001 does not prescribe how to audit. The recognised guideline for this is ISO 19011. Its fourth edition, ISO 19011:2026, has been available since May 2026. It replaces the 2018 edition and mainly extends the guidance on remote audits.

The internal audit process in six steps

The process is based on ISO 19011 and can be implemented leanly in an SME.

1. Plan the audit programme. Decide which processes or areas will be audited during the year, by whom and when. Processes with high risk, many complaints or major changes are audited more often.
2. Prepare the audit. Record objective, criteria and scope, review documents such as the process description, key figures and the last findings, and select the questions. Agree the date with the audited area.
3. Opening meeting. Briefly confirm objective, procedure and timeframe. Five minutes are enough.
4. Conduct the audit. Ask questions, review evidence and observe processes on site. Audit evidence must be verifiable, for example a document, a record, your own observation or a statement that can be confirmed. A mere claim is not enough.
5. Closing meeting and report. Present and rate the findings, agree on the facts and report to the relevant management.
6. Follow-up. For each nonconformity, clarify the cause, define a corrective action with an owner and a deadline, and check its effectiveness later. The results feed into the management review.

Who may carry out an internal audit?

The standard does not require any specific training, but it does require objectivity, impartiality and the necessary competence. In practice this means nobody audits their own work. Small businesses therefore swap areas, the head of sales audits purchasing and the head of production audits sales. Bringing in external auditors is permitted. The audit remains an internal audit, and responsibility for the audit programme stays within the company.

Question checklist for the internal audit under ISO 9001

The following questions are organised by the clauses of the standard and written in our own words. They do not replace the text of the standard, they help you prepare. For each audit, choose the questions that fit its objective and scope, and always ask for the evidence. Questions marked 2026 relate to the changes in ISO 9001:2026. The climate question has applied since the 2024 amendment and is carried over into the 2026 edition.

Clause 4, context of the organisation

• Which internal and external issues affect our company, and when were they last reviewed?
• Since 2024. Have we assessed whether climate change is a relevant issue for us, and is the assessment recorded with reasons?
• Which interested parties are relevant, and what are their requirements? Do any of them have requirements related to climate change?
• Is the scope of the QM system defined, and is it justified which requirements are not applicable?
• Are the processes described with inputs, outputs, owners and key figures, for example in a process map?

Clause 5, leadership

• How does top management show that it takes responsibility for the QM system?
• 2026. How does top management promote a quality culture and ethical behaviour, and how can this be seen in day-to-day work?
• Is the quality policy up to date, does it fit the strategic direction, and do employees know it?
• Are roles, responsibilities and authorities defined and known?
• Is customer focus a priority in daily work, for example with complaints and delivery dates?

Clause 6, planning

• 2026. Are risks identified, analysed and evaluated, and are there actions for them?
• 2026. Are opportunities determined in their own right and pursued with their own actions, not just as the flip side of a risk?
• How is the effectiveness of the actions on risks and opportunities checked?
• Are the quality objectives measurable, with owners and deadlines, and what is their status?
• 2026. Are changes to the QM system planned, with purpose, consequences, resources and responsibilities? Is it also defined how the change is communicated and how its effectiveness is checked? Check the exact scope of the change against the standard.

Clause 7, support

• Are the necessary resources available, people, infrastructure and work environment?
• Are measuring and test equipment calibrated or verified where required, and is their status visible?
• Is the necessary competence defined for each role, and how is it demonstrated, for example in a training matrix?
• 2026. Do employees know which quality culture and ethical principles apply, and do they know their contribution to the effectiveness of the system?
• Is it defined who communicates what, how, internally and externally?
• Are documents controlled, with version, approval and validity? Is the current version available where it is needed?

Clause 8, operation

• How are customer requirements reviewed before an order is accepted, and how are changes handled?
• If applicable, how is the development of new products or services planned, reviewed and approved?
• How are external providers selected, evaluated and monitored, and are there consequences for poor ratings?
• Does production or service provision run under controlled conditions, with work instructions, suitable equipment and inspections?
• Are identification and, where necessary, traceability ensured? How is customer property handled?
• Who releases products or services, and is the release evidenced?
• How are defective products identified and handled so that they are not delivered by mistake?

Clause 9, performance evaluation

• Which key figures are monitored, how often and by whom, and what happens when they deviate?
• How is customer satisfaction determined, and what conclusions were drawn from it?
• Is there an audit programme, and were the planned audits carried out?
• Has top management carried out the management review with all the required inputs, and have the decisions been implemented?

Clause 10, improvement

• How are nonconformities and complaints recorded, how is the cause determined, and is the effectiveness of corrective actions checked?
• Are corrective actions from previous audits closed and effective?
• How are opportunities for improvement determined and implemented, including ideas from employees?

Questions for top management

The conversation with top management is the part many internal audits skip. With the changes in ISO 9001:2026 it is particularly important, because the leadership requirements on quality culture and ethical behaviour can hardly be checked without this conversation.

• Which quality objectives are the most important for you this year, and what is their status?
• How do employees notice that quality matters to top management?
• How do you deal with mistakes that someone reports themselves?
• Which major changes are coming up, and how is the QM system involved?
• Which risks and opportunities do you see for the company, and which actions are under way?
• Are the resources for the QM system sufficient, and where is something missing?

Rating findings correctly

An audit finding is the result of comparing the evidence with the audit criteria. It shows conformity or nonconformity and can also point to risks, opportunities for improvement or good practice. For internal audits, three categories have proven themselves in practice.

Category	Meaning	Consequence
Nonconformity	a requirement of the standard, an own, legal or customer requirement is not met, supported by evidence	clarify the cause, corrective action with deadline, check effectiveness
Observation	still met, but with a recognisable risk that it soon will not be	monitor, check specifically in the next audit
Opportunity for improvement	met, but it could be simpler, faster or safer	suggestion to the area, voluntary

The distinction between major and minor nonconformities does not come from ISO 9001, but from ISO/IEC 17021-1 for certification bodies. A major nonconformity affects the ability of the system to achieve its intended results, a minor one does not. If you want to use the same language internally, you can.

A note from the ISO 9001 Auditing Practices Group, an expert group of ISO/TC 176 and IAF, is useful internally too. If there is evidence of a nonconformity, it belongs in the report as a nonconformity. Softening it to an observation or a recommendation out of consideration takes the urgency away from the corrective action.

Common mistakes in internal audits

• The same checklist every year. The questions then do not fit current risks and changes, and the answers are given by heart.
• Asking without looking. Without evidence, a finding remains an opinion.
• Findings without actions. Whatever is in the report and not followed up shows up again in the next audit.
• Top management is left out. The changes on leadership, quality culture and ethics affect it directly.
• The report takes longer than the audit. Then the willingness to audit at all declines.

Planning and running internal audits with QuKI

A question checklist is a good start. It does not, however, give you an overview of a whole audit year, and someone still has to follow up the findings.

In QuKI’s audit management you plan the audit programme in an annual view and audit with checklists per standard. The AI reads your process documents and suggests audit questions, each with a confidence score, and you accept, change or reject every suggestion. During the audit you record findings, the AI drafts the audit report as a suggestion, and you approve it. Findings become actions with an owner and a deadline, and the results feed into the management review. You manage complaints and corrective actions in complaint management and the process documents in document control.

Frequently asked questions about the internal audit

How often must an internal audit under ISO 9001 take place?

The standard does not set a fixed frequency, it requires audits at planned intervals. How often a process is audited depends on its importance, on changes and on the results of previous audits. Many SMEs audit every process once a year, but that is common practice, not a requirement.

Is an internal audit mandatory before initial certification?

Yes. In the first stage of the certification audit, the certification body checks whether internal audits and the management review are planned and carried out. Whether all processes must already have been audited internally is not specified by the standard. In practice some certification bodies expect it, so clarify this with your certification body in advance.

May the quality manager audit the whole system?

Only the areas for which they are not responsible themselves. Their own tasks, such as document control or the audit programme itself, are better audited by someone else, internal or external.

Should audits be organised by clause or by process?

The standard does not prescribe a format. While building the system it helps to check clause by clause. After that, a process-based audit is usually more meaningful, because it shows whether the processes work in daily practice.

Are remote audits permitted?

Yes. ISO 19011:2026 significantly extends the guidance on remote audits. The choice of method, the tools used and confidentiality belong in the planning. For walkthroughs in production or the warehouse, an on-site audit is usually more meaningful.

What is the difference between an internal audit and the management review?

The internal audit checks whether the system meets the requirements and is effectively implemented. The management review under clause 9.3 is top management’s evaluation of whether the system as a whole is suitable, adequate and effective. The results of the internal audits are one of its inputs.

Your next step

Would you like to see how the audit programme, AI-suggested audit questions, findings and the audit report fit together in one system? In a QuKI demo we will show you in 30 minutes using your own processes.

The requirements of ISO 9001 are summarised in our own words in this article. The text of the standard is binding, available in Switzerland from SNV. Information on ISO 9001:2026 is based on publications by certification bodies and specialist publishers, information on ISO 19011:2026 on iso.org, as of October 2026.