Why it matters: Every ISO management system standard requires you to audit yourself at planned intervals. A good internal audit finds problems while they are cheap to fix and gives leadership real visibility. This checklist works for ISO 9001, 27001, 14001, 45001, 22301 and 37001, and follows the ISO 19011 auditing guidelines.
1. Plan the audit
- Define the scope — which processes, sites and clauses you are auditing.
- Set the objectives — conformity to the standard, effectiveness, improvement.
- Select auditors and conduct audits to ensure objectivity and the impartiality of the audit process
- Prepare an audit plan and schedule and notify the auditees.
- Review the relevant documents, previous audit results and open actions.
2. Prepare your checklist
- List the requirements of the standard clause by clause.
- Add process-specific questions ("show me how you…", "where is this recorded?").
- Note the evidence you expect to see for each point.
- Leave space for observations, findings and references.
3. Conduct the audit
- Hold a short opening meeting to confirm scope, time frame required, number of sites, addresses and other logistics.
- Gather objective evidence — interview people, observe work, sample records.
- Follow the process, not just the paperwork — does it work in practice?
- Record what you see factually; separate fact from opinion.
- Classify findings: conformity, nonconformity (major/minor), or opportunity for improvement.
4. Report the results
- Hold a closing meeting and summarise findings with the auditees.
- Establish buy-in with the auditee on the findings before you leave.
- Write a clear audit report: scope, findings, evidence, conclusions.
- State each nonconformity against the specific clause and evidence.
- Agree who owns each corrective action and by when.
5. Follow up and close out
- Ensure each nonconformity gets a root-cause analysis, not just a quick fix.
- Verify corrective actions were implemented and effectively closed, with no repeat of the issue.
- Close findings with evidence; feed themes into management review.
- Use trends to improve the system, not just to pass the next audit.
Common internal audit mistakes to avoid
- Auditing only documents and never observing the actual work.
- Auditors checking their own processes (no independence).
- Writing vague findings that can't be acted on.
- Closing nonconformities without fixing the root cause.
- Treating the audit as a tick-box exercise the week before certification.
Want the editable template? Irvin can provide a ready-to-use internal audit checklist tailored to your standard, and train your team to audit confidently. Request the template or ask about internal auditor training.
Frequently asked questions
At planned intervals so the whole system is covered over the cycle — commonly once or twice a year, with higher-risk areas audited more frequently. The standard requires a programme, not a single annual event.
Anyone competent and independent of the area being audited. Many organisations train several internal auditors so they can audit each other's areas. Irvin runs internal auditor training for all six standards.
Internal audits are performed by your own trained people to check and improve the system. External (certification) audits are performed by an accredited certification body to grant or maintain your certificate.