ISO 9001 Internal Audit Checklist: What Clause 9.2 Requires and What the Certification Auditor Checks

Updated 30 September 2026. This article has been revised: it now gives the clause reference for each requirement in both ISO 9001:2015 and ISO 9001:2026, draws on the ISO 9001 Auditing Practices Group guidance on internal audits, and corrects an earlier attribution of the effectiveness review to 10.2.2 (correct: 10.2.1 d).

Most internal audit checklists online are project-management advice with a clause number glued on. This one starts from two questions: what does ISO 9001 clause 9.2 actually require — and what does a certification auditor look at when assessing your internal audits? For the second there is a primary source almost nobody cites: the guidance on internal audits from the Auditing Practices Group of ISO/TC 176 and the IAF [4].

A checklist to hold your own programme against closes the article.

What 9.2 requires — in both editions

9.2.1 sets out the purpose: internal audits provide information on whether the QMS conforms to the organization’s own requirements and to ISO 9001, and whether it is effectively implemented and maintained [1]. 9.2.2 sets out how. ISO 9001:2026 keeps the substance, but the structure follows the Harmonized Structure, which shifts the letters [2]:

Duty	ISO 9001:2015 [1]	ISO 9001:2026 (DIS) [2]	Evidence that holds up
Audit programme covering frequency, methods, responsibilities, planning and reporting	9.2.2 a)	9.2.2, first paragraph	Programme with a rationale, not just a list of dates
Programme considers importance of processes, changes, results of previous audits	9.2.2 a)	9.2.2, second paragraph	Traceable derivation of frequency per process
Per audit: define criteria and scope	9.2.2 b)	9.2.2 a) — plus audit objectives	Audit plan with objective, criteria, scope
Select auditors to ensure objectivity and impartiality	9.2.2 c)	9.2.2 b)	Auditor assignment with no self-auditing
Report results to relevant management	9.2.2 d)	9.2.2 c)	Distribution, report, input to management review
Correction and corrective action without undue delay	9.2.2 e)	9.2.2 d)	Actions with due date and status
Documented information as evidence of programme implementation and results	9.2.2 f)	9.2.2, closing sentence	Retained programmes, plans, reports

The only substantive addition is the audit objective. What an audit is meant to establish — say, “effectiveness of incoming inspection after the supplier change” — was in many audit plans anyway; now it is a requirement. The 2026 statements were checked against the draft ISO/DIS 9001:2025 [2]; the Global ACI summary of key changes does not list 9.2 [5].

Everything else — sampling technique, interview style, checklist format, software — is good practice, not a requirement. Knowing the difference helps when an external auditor asks how you know 9.2 is met.

What the certification auditor looks at

The Auditing Practices Group is a joint working group of ISO/TC 176 and the International Accreditation Forum. Its guidance on internal audits describes what certification auditors should evaluate in the internal audit process [4]:

• the competence needed for and applied to the audit,
• objectivity and impartiality of the process,
• the risk-based thinking applied in planning,
• the degree of management involvement,
• the use of ISO 19011 as guidance — noting explicitly that ISO 9001 does not require it,
• and how the organization uses the results to evaluate the effectiveness of its QMS and find improvements.

One recommendation to external auditors is worth knowing: to examine internal audits towards the end of the certification audit, so they can compare their own findings with those of the internal audit [4]. If the external auditor finds in three days what your internal audit missed in a year, that is the real finding.

The paper carries a disclaimer that it has not been through an endorsement process at ISO, ISO/TC 176 or the IAF; it is interpretation, not requirement [4]. As a description of what gets looked at, it is still the most reliable freely available source.

The audit programme: risk, not calendar

ISO 9001 fixes neither the frequency nor the duration nor the scope of internal audits; the APG guidance says so explicitly and expects the organization to derive them from risk [4]. Among the areas it says deserve particular attention are [4]:

• processes critical to product quality, complex processes and those that need validation,
• processes that need qualified personnel or close monitoring of process parameters,
• monitoring and measuring activities that need frequent calibration or verification,
• activities across multiple locations or that are labour intensive,
• processes where problems have occurred or are at risk of occurring.

The guidance then asks whether the organization actually uses this information to set audit frequency, and whether past audit results feed into planning [4]. ISO 19011 gives audit programme risks and opportunities a clause of their own, 5.3 [3].

Assessment: a programme that audits every process once a year is not wrong — but it does not answer the question about risk-based derivation. A simple “rationale for frequency” column per process, referencing findings, changes or customer complaints, does. How to build a programme systematically is covered in the audit programme planning guide.

Independence and competence

Auditors must not audit their own work; ISO 9001 requires objectivity and impartiality without qualification [1][2]. The pattern that keeps turning up in small quality teams: whoever runs the CAPA process also audits it. That is rarely deliberate — usually it is the only trained person with time.

Assessment: where it cannot be avoided, the compensating measure belongs in the file — a second review of the report by someone else, or a swap audit with a sister site. A documented handling of the conflict is defensible; an ignored one is not.

On competence, the APG guidance expects evidence that the organization has defined competence requirements for internal auditors, uses trained auditors, monitors their performance and puts people with knowledge of the audited area on its teams [4]. Knowing the standard is not enough. ISO 19011 covers auditor competence and evaluation in clause 7 [3]; the principles, including independence as its own subclause 4.6, are in clause 4. More on the ISO 19011 page.

Preparing the individual audit

• Define objective, criteria and scope. What question should this audit answer, against which requirements (clauses, internal procedures, customer and legal requirements), covering which areas, sites and periods? Audit objectives are an explicit requirement in ISO 9001:2026 [2].
• Turn criteria into working documents. A question catalogue that produces evidence rather than yes/no answers is a discipline of its own — the audit question catalogue guide describes the process-based method.
• Sampling and time budget by risk. Not evenly spread, but more time where programme planning sees the risk.

ISO 19011 covers preparing audit activities in clause 6.3 [3].

During the audit: evidence, not impressions

ISO 19011 covers collecting and verifying information in 6.4.7 and generating audit findings in 6.4.8 [3]. The working rule behind it: a single statement in an interview is not objective evidence. When a process owner says “we always do it this way”, you need a record, an observation or a second, independent confirmation before it turns into a finding in either direction.

Every finding belongs to a specific criterion. That is not a formality: only with a clause reference can findings be analysed over several years — which is exactly what the management review needs, since 9.3.2 asks for trends in audit results. How the chain from audit to review works is described in from audit to management review.

Findings and follow-up

• Grade with restraint. Rating everything a major nonconformity to look thorough devalues the grading.
• Cause, not symptom. “Corrective action defined” is not the same as “cause determined”. ISO 9001 10.2.1 b) requires the causes to be determined [1]; methods include 5 Whys and, for complex cases, the 8D report.
• Review effectiveness. 10.2.1 d) requires the effectiveness of corrective actions taken to be reviewed [1]. An audit is not done when the action shows “complete”, but when, after a defined period, there is evidence the nonconformity has not recurred. The mechanics are covered in audit findings and CAPA.

Evaluating the programme itself

ISO 9001 clause 9.2 does not explicitly require the audit programme to be reviewed. ISO 19011 recommends it in 5.7 [3], and the APG guidance explains why it pays off: the external auditor is meant to form a judgement on whether the programme is effective and whether internal audits lead to tangible improvements [4].

Assessment: three questions are enough for an annual review. Did the programme cover what was planned? Do the same findings keep recurring despite actions? Did the internal audit find anything the external auditor could no longer find afterwards?

Timeline for a single audit

Assessment, not a requirement of the standard:

When	What
4 weeks before	objective, criteria, scope; auditor with no self-auditing; check open actions from the last audit
2 weeks before	audit plan to auditees; derive question catalogue from criteria; fix the sample
audit day	opening, collect and verify evidence, findings with criterion, closing meeting
within 1 week after	report to relevant management, findings confirmed, actions with owner and due date
after the defined period	effectiveness review, finding closed

The checklist

Programme

• Audit programme covers frequency, methods, responsibilities, planning and reporting
• Frequency per process justified: importance, changes, previous results
• Critical areas identified (product quality, validation, measuring equipment, multiple sites)
• Coverage across the certification cycle is traceable

Preparation

• Objective, criteria and scope defined per audit (objective: required from ISO 9001:2026)
• Auditor does not audit own work; compensation documented where unavoidable
• Competence requirements for auditors defined and met, including subject knowledge
• Question catalogue derived from the criteria, not generic
• Standard edition fixed per audit (2015 or 2026)

Conduct

• Evidence verified by record, observation or independent confirmation
• Every finding assigned to a specific criterion

Reporting and actions

• Results reported to relevant management
• Findings graded consistently
• Cause determined for every nonconformity, not just the symptom described
• Corrections and corrective actions with owner and due date

Follow-up

• Effectiveness reviewed after a defined period (10.2.1 d)
• Open actions from last year’s audit checked before the next audit
• Results reported as trends in the management review

Programme review

• Coverage, recurring findings and auditor performance reviewed at least annually

2027: the transition year in the programme

Global ACI has set the transition period to ISO 9001:2026: certificates to the 2015 edition cease to be valid on 30 September 2029, and from 31 March 2028 initial certifications are issued only to the new edition [5]. For the 2027 programme that means auditing the changed clauses internally before the certification body’s transition audit, and recording per audit which edition it was held against. How to version the question catalogue and clause mapping is covered in ISO 9001:2026 and internal audits.

How qportal handles it

In qportal, every audit hangs off an audit programme and is bound to exactly one standard edition. Questions and findings reference a hierarchical catalogue of audit criteria rather than free text, so every finding carries its clause. If the auditor and the audited org unit coincide, the system warns. Actions carry an owner, a due date and their own effectiveness review, and an analysis shows for what share of closed corrective actions the review actually took place. More on the audit management page.

Conclusion

A checklist is only as good as its link to the requirement. The requirements in 9.2 are few and barely change with ISO 9001:2026 — the audit objective is essentially the only addition. What counts in the certification audit, the APG guidance spells out clearly: a risk-based rationale for the programme, auditors who do not audit their own work and know the area, and results that actually lead to improvement.

Sources

1. ISO 9001:2015, Quality management systems — Requirements, consulted in the bilingual edition DIN EN ISO 9001:2015-11, Beuth Verlag, Berlin. Clauses 9.2.1, 9.2.2, 10.2.1.
2. ISO/DIS 9001:2025(en): Quality management systems — Requirements. ISO/TC 176/SC 2, committee ballot 2025-08-27 to 2025-11-19. Not publicly available; checked against a copy on 2026-09-30 (clause 9.2) — not the published IS edition.
3. ISO: ISO 19011:2026 — Guidelines for auditing management systems. Fourth edition, published 2026-05. Clauses 4 to 7 are paywalled and are cited here by number only. https://www.iso.org/standard/19011 (accessed 2026-08-27)
4. ISO 9001 Auditing Practices Group: Guidance on: Internal Audits. Edition 1, Amd 1, 2020-07-19, issued by ISO/TC 176 and the International Accreditation Forum. Carries a disclaimer that it has not been through an endorsement process at ISO, ISO/TC 176 or the IAF. https://committee.iso.org/files/live/sites/tc176/files/PDF%20APG%20New%20Disclaimer%2012-2023/ISO-TC%20176-TF_APG-InternalAudit.pdf (accessed 2026-09-30)
5. Global ACI: Global ACI-TECH-3-TR 2029-09-30 (M) — Transition Requirements for ISO 9001:2026. Mandatory document, version 1.0, in force since 2026-09-16. https://sys.global-aci.org/uploads/documents/TECH-3-TR_2029-09-30_(M)_ISO_9001_2026_Transition_v1_03.pdf (accessed 2026-09-30)

Consultancy, certification-body and content-marketing pages are not cited. Normative text is copyrighted; requirements are paraphrased with their clause reference. Where this text goes beyond the documented evidence, it is marked as an assessment.