Internal audit checklist
An internal audit checks whether a process is run the way your own procedures say, and whether it achieves what it's meant to. This free Word checklist takes one audit from plan to close: scope and criteria, questions with the evidence you saw, findings graded as nonconformities, observations or opportunities for improvement, and corrective actions with a follow-up date.
Running a company of 30 to 200 people? Documents like this are now worth money.
ISO 9001, the international standard for quality management systems, requires organisations that use it to carry out internal audits at planned intervals (clause 9.2). The current edition, ISO 9001:2026, replaced the 2015 one in September 2026; certified companies move to it within a timeframe set by their certification cycle, which their certification body can confirm. The checklist works just as well for an uncertified company checking that its SOPs are followed.
What's in the template
Internal audit checklist and report
| Audit number | e.g. IA-2026-04 |
|---|---|
| Process audited, and its owner | |
| Lead auditor | Not someone who works in this process |
| Audit date | |
| Criteria | What you audit against, e.g. SOP-OPS-03, ISO 9001 clauses, a contract |
| Scope | Sites, dates and records covered |
1. Audit plan
| Item | Detail |
|---|---|
| Objective | |
| Why now: risk, changes or past findings | |
| People to interview, and records to sample | |
| Opening and closing meetings | Dates and who attends |
2. Findings from the last audit
| Previous finding | Action taken | Effective? |
|---|---|---|
3. Checklist
Record what you actually saw: document names, record numbers, dates, people.
| # | Requirement | Question | Evidence seen | Result (C, NC, OBS, OFI) |
|---|---|---|---|---|
| 1 | Procedure current and approved | Is the version in use the latest approved one? | ||
| 2 | Inputs checked | How are incoming orders or materials checked? | ||
| 3 | Steps followed | Walk me through the last job you completed | ||
| 4 | Records kept | Show me the records for three recent jobs | ||
| 5 | Competence | How were you trained for this, and where is it recorded? | ||
| 6 | Faulty output controlled | What happens when something goes wrong? | ||
| 7 | Performance measured | How do you know this process is working? | ||
| 8 | ||||
| 9 | ||||
| 10 |
4. Findings
C: conforms. NC: nonconformity, a requirement not met. OBS: observation, at risk of failing. OFI: opportunity for improvement.
| # | Finding | Grade | Requirement | Evidence |
|---|---|---|---|---|
5. Corrective actions
| Finding # | Cause | Correction (this case) | Corrective action (stop it recurring) | Owner | Due |
|---|---|---|---|---|---|
6. Follow-up and close
| Follow-up date | |
|---|---|
| Actions effective? | Yes or no, with the evidence |
| Report sent to | Process owner and management |
| Closed by, and date |
How to run an internal audit
- Plan the year's programme. List your processes, and audit the high-risk, recently changed and troubled ones more often than the rest.
- Pick an auditor from outside the process. Nobody can objectively audit their own work. In a small company, swap auditors between departments.
- Set the scope and criteria. Scope is what you'll look at (sites, dates, records); criteria are what you'll compare it against, such as the SOP, the contract or the clauses of the standard.
- Prepare questions from the procedure itself, and fix your sample in advance, such as ten purchase orders from last month.
- Gather evidence three ways: ask people to show you, watch the work, and check records. Follow a trail where you can, such as one customer order through to its invoice.
- Grade each finding against a criterion, with its evidence, and agree the facts at a closing meeting so the report holds no surprises.
- Agree corrective actions and follow up. The audit isn't closed until you've seen evidence the actions worked.
Nonconformity, observation or opportunity?
| Grade | Means | Example |
|---|---|---|
| Nonconformity (NC) | A requirement isn't met, and you can point to the evidence | Purchase orders raised with a supplier missing from the approved list |
| Observation (OBS) | Nothing has failed yet, but it's at risk of failing | Supplier scores kept in a spreadsheet only one person can edit |
| Opportunity for improvement (OFI) | The requirement is met, but there's a better way | Price checks done by email that a shared price list would speed up |
Every nonconformity needs a correction (fix this case), a look at the cause, and a corrective action (stop it happening again). Observations and opportunities are for the process owner to weigh up; record what they decide.
Example: auditing purchasing at a fictional manufacturer
A fictional 75-person metal fabrication company audited its purchasing against its own procedure, SOP-PUR-02, sampling ten purchase orders from August.
| Finding | Grade | Evidence |
|---|---|---|
| Orders placed with unapproved suppliers | NC | Purchase orders 4471 and 4502; neither supplier is on the approved list |
| Approved supplier list overdue for review | NC | Last reviewed 14 months ago; the procedure says every 12 |
| Supplier scoring depends on one person | OBS | The spreadsheet can only be edited by the buyer |
A short root cause analysis of the first finding showed that approving a new supplier took a week, so urgent orders went round the process. Corrective action: a fast-track approval for urgent one-off orders, and a block on unapproved suppliers in the purchasing system. Follow-up in eight weeks: sample another ten orders and confirm the block works.
Common mistakes
- Auditing the paperwork only. A desk check can't show whether people follow the documents; watch the work.
- Copying the standard's clauses as the checklist. Write questions about your own process, and point each one at the clause or procedure it tests.
- Findings without evidence, such as "staff seem unaware of the procedure". Say what you saw and where.
- Treating the audit as an inspection of people. It tests the process, and staff who feel blamed stop showing you how the work is really done.
- Closing findings when the action is done, rather than when you've checked it worked.
Frequently asked questions
Is an internal audit a legal requirement?
For most companies, no. ISO 9001 and other management system standards require it of the organisations that use them, and customers may ask to see audit records.
How often should we audit?
ISO 9001 asks for audits at planned intervals, not a set frequency. Spread them across the year so every process is covered at least once, and audit high-risk or fast-changing processes more often.
Who can be an internal auditor?
Anyone trained in auditing who is independent of the process. ISO 19011, the international guidance on auditing management systems, covers audit principles, audit programmes and auditor competence.
What's the difference between an internal and an external audit?
An internal (first-party) audit is run by or for the company itself. External audits are done by customers (second-party) or certification bodies (third-party).