INTERNAL AUDIT CHECKLIST

Issued by: QA Date: 00-00-00 Revision: A QF-82-02-3

This checklist is for Process Approach based internal auditing. It is divided into sections corresponding to the quality system processes defined in the Process Map
in the Quality Manual Section 4.1.1, Quality System Processes. The Process Map and this audit checklist must call out the same processes. When you edit the
Process Map to fit your company, remember to also make corresponding changes in the checklist.

While using the Process Approach, this is also an ISO 9001 compliance checklist. The requirements for each process are paraphrased from ISO 9001 and there is
a reference to the corresponding clause of the standard (first column). The checklist is carefully designed to completely cover all requirements of the ISO 9001
standard. If, when customizing the Process Map, you delete or add processes, make sure that you re-associate the corresponding clauses in ISO 9001 and don’t
leave any out (e.g., maintain completeness of the checklist in regard to compliance with ISO 9001).

You should customize this checklist on three levels: 1) align it with any changes in the Process Map, 2) further develop the “Requirements” column to add other
relevant requirements (if any), and 3) edit the “What to look for and how” column to make it appropriate to the products, operations, practices and issues that are
relevant in your company. The third item in particular will require the most customizing.

Product Realization Process PRP 01 – Sales and Order Processing

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.2.1 Determine product requirements How are customer requirements determined and "Comply" is abbreviation for "Compliance". Note "Yes" for compliance
 specified by the customer (including communicated? Are they documented? Who and "No" for noncompliance.
processes this information and how is it done? Are
delivery and post-delivery);
there written procedures/instructions and/or training?
 not stated by the customer, but necessary Are there any requirements that are not stated by the
for specified or intended use; customer but are necessary? Are there any regulatory
 statutory and regulatory requirements requirements? Who determines, and how, what these
related to the product; and additional requirements might be? Are they
 any additional requirements determined by documented? How?
the company. Check a sample of orders to verify that procedures,
instructions and/or training are being followed.
Interview employees and review customer complaints
to find out whether there is history of order
requirements that were misunderstood and/or
incomplete.

7.2.2 Prior to the commitment to supply product, How are customer requirements reviewed, and by
review requirements related to the product to whom? Are there written procedures, instructions,
ensure that checklists, and/or training. Are there records
 requirements are defined, demonstrating that the required reviews are being
conducted for every order?
 any discrepancies and ambiguities are Check a sample of orders to verify that procedures,
resolved, and instructions and/or training are being followed.
 company is able to meet the requirements. Interview employees and review customer complaints
Maintain review records. and on-time delivery records to find out any cases of
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 2 of 25

orders that were shipped late due to lack of adequate

capacity to fulfill these orders.

7.2.2 Where product requirements are not Is it permissible to take and accept verbal orders? If so,
documented (not communicated in writing), are these orders confirmed? How are such orders
confirm the requirements before accepting confirmed?
the order. Ask for records (copies) of the confirmations. Interview
personnel to find out whether they were consistently
trained/instructed to confirm verbal orders.

7.2.2 When changing or amending orders, ensure How are change orders processed? Is there a system
that relevant documents are amended and for amending documents? Are there written
that changes are communicated to relevant instructions, procedures and/or training? How is
personnel. information about order changes communicated to
relevant departments/personnel within the company?
Review a sample of change orders to verify that
procedures, instructions and/or training are being
followed. See if you can uncover any past problems
caused by mishandling of change orders.

7.2.3.a Determine and implement arrangements for Are processes for communicating with customers
7.2.3.b  communicating product information, adequately defined, to include policies, assignment of
authorities and responsibilities, and methods
 handling enquiries, orders and change (procedures, instructions, training)? Are these
orders. processes consistently implemented?
Verify that product brochures/specifications and other
product information (including the internet site) are
current.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 3 of 25

Product Realization Process PRP 02 – Purchasing

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.4.1 Control suppliers and the purchased product How are suppliers controlled: initial selection
to ensure that the product conforms to evaluations, ongoing monitoring, audits of supplier’s
specified purchase requirements. QMS and/or manufacturing processes, requests for
corrective actions?
How is purchased product controlled: review of quality
records (SPC charts, inspection reports, lab test
results, etc.), receiving inspection? Who makes these
decisions?

7.4.1 Evaluate and select suppliers based on their Are suppliers evaluated and reviewed before they are
ability to supply products conforming to approved? What are the scope, extent and criteria for
specified requirements. Establish evaluation evaluating and approving suppliers? Who decides?
and selection criteria. Maintain records or How is the approval documented (an approved vendor
list)? Are there records of initial supplier evaluations?
supplier evaluations and related actions. Select randomly and review a sample of supplier
evaluation and monitoring files. Is their approval status
clearly authorized? Is their performance consistently
monitored? In the event of nonconforming deliveries,
are they required to implement corrective actions? Is
there a follow up?

7.4.2 In purchasing specifications include, where Where appropriate, are there requirements for
appropriate certificates, inspection reports, SPC data, approval of
 requirements for approval of product, samples, etc. included in purchasing documents? Are
procedures, processes and equipment; there any requirements with regard to supplier’s quality
management system?
 requirements for approval of personnel, Review a sample of purchase orders, especially those
and where the product is expected to come with
 quality management system requirements. certificates.

7.4.2 Ensure adequacy of purchasing How is adequacy of purchasing documents ensured?

specifications before they are forwarded to Are the documents reviewed before release? Are there
suppliers. standard, pre-approved, specifications in the system?
What other methods are used?
See if you can uncover any past problems caused by
errors or omissions in purchasing documents.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 4 of 25

Product Realization Process PRP 03 – Receiving

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.4.3 Establish and implement activities for What is being done to ensure purchased product
ensuring that purchased products meet conformity: certificates or inspection reports from
specified purchase requirements. supplier or independent labs, SPC records, Cpk or Ppk
requirements, in house receiving inspection, supplier’s
QMS certification?
Select a sample of purchased product categories and
investigate for each what activities or arrangements
are planned to ensure their conformity, how this plan is
documented and communicated, and whether it is
consistently implemented.

7.4.3 When intending to perform product Is this relevant? If so, review a sample of purchase
verification at supplier premises, define orders or contracts to ascertain that product verification
verification arrangements and methods in and release methods are defined in the purchasing
the purchasing documents. documents.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 5 of 25

Product Realization Process PRP 04 – Inventory Management

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.5.5 Protect and preserve the conformity of In warehouses, storage and staging areas: Are there
product in storage. designated areas for storage of particular products?
Are products kept in boxes, bags, bins or other
protective packaging? Are there products that require
special storage conditions (temperature, humidity,
cleanliness, etc)? How are these conditions ensured?
Are they recorded? Are there products with limited
shelf life? How is such product managed? Is there an
effective first-in-first-out system? Are stacking
limitations defined? Are they observed? Is there a risk
of cross-contamination? How is it managed? Is there
an inventory management system? Is it kept current?
Look for misplaced product, product taken out of
packaging, unused product returned to storage,
product returned by customers, product intermingled
with other unrelated product, etc. Test the accuracy of
the inventory management system. Always keep an
eye on damaged and deteriorated product.

7.5.3 Identify product and its acceptance In warehouses, storage and staging areas: Are all
(inspection) status while the product is in products identified with part numbers or other unique
storage. designations? Is it possible to distinguish product that
have passed receiving inspection (or was accepted on
other basis)?
Look for product taken out of packaging or returned
from production, and for identification (and
segregation) of product on hold (awaiting
documentation or resolution of issues), and of
nonconforming product.

7.5.4 Identify, verify, protect and safeguard Is this relevant? If so, look for identification showing
customer property provided for use or that the product belongs to customer. Investigate
incorporation into the product; and report to whether there were any events of loss, damage, or
customers any event of loss, damage or unsuitability of customer property and whether this was
promptly reported back to the customer.
unsuitability of their property.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 6 of 25

Product Realization Process PRP 05 – Production

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.5.1 Ensure the availability of product Are adequate product specifications (drawings, parts
specifications. lists, math data, standards, samples, etc.) available to
production personnel? Are the specifications approved
and are they current?
Interview production personnel and ask how they know
what to make and what the requirements are for
workmanship standards (appearance, precision,
surface quality, color, etc.).

7.5.1 Ensure the availability of work instructions, Are there adequate instructions for operating machines
as necessary. and processes? Who decides and how (criteria)
whether work instructions shall be established for a
given process/work station? Are process parameters
(temperature, pressure, speed, etc.) defined?
Ask operators what should the settings be for various
parameters in their processes, and how they know
this? What are the lower and upper limits for the
parameters? What should they do, and how, when a
parameter (temperature, for example) goes over limit?

7.5.1 Ensure the use of suitable equipment. Who selects/specifies production equipment and
tooling? Is equipment/tooling tested before it is used in
production? Is tool wear monitored, and how? Are
equipment checks and/or tool change intervals
defined?

7.5.1 Ensure the availability of measuring devices Is there a system for controlling the inventory of
and the implementation of monitoring and measuring/monitoring devices (a list with identification,
measurement. location, calibration status)? Is the inventory of
measuring devices adequate to meet requirements of
the monitoring/measurement program (inspections,
tests, SPS, etc.)?

7.5.1 Ensure the implementation of release, Are there defined responsibilities for these activities?
delivery and post-delivery activities. How are requirements documented (procedures, work
orders, installation/servicing requisitions, etc.)?

7.5.2 Validate processes where the resulting Who is responsible for identifying processes requiring
output cannot be verified by subsequent validation? How is it determined what controls,
monitoring or measurement. Establish validations and arrangements shall be required for
arrangements for these processes including, each such process (criteria for review and approval)?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 7 of 25

as applicable Are process validation results recorded? Are processes

 criteria for their review and approval, revalidated (where appropriate)?
 approval of equipment and qualification of Select a sample of processes that require validation
personnel, and investigate how these processes were validated,
and whether this complies with requirements.
 use of specific methods and procedures,
 requirements for records, and
 revalidation.
7.5.3 Identify product and its acceptance Are materials and products used in production uniquely
(inspection) status throughout production. identified while in storage, in staging areas, at work
stations, etc? Is the acceptance status identified?
Verify that for any product (material) in production
areas it is evident what the product is and whether it
passed inspection (test) and can be moved to the next
processing stage or be dispatched to customer (or
finished goods warehouse).

7.5.3 Where traceability is a requirement, control How is it determined what products (materials) require
and record the unique identification of the traceability (customer requirements, regulatory
product. requirements, internal engineering or QA requirements,
etc.)? How are traceability requirements for specific
products documented? Where required, how is
traceability recorded?
Review a sample of production records and verify the
integrity of the traceability system. Verify that rework
operations (diluting, mixing, reprocessing, etc.) do not
compromise the integrity of the traceability system.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 8 of 25

Product Realization Process PRP 06 – Delivery

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.5.1 Define and implement delivery activities. Are delivery-related activities (processing of shipping
orders, packaging, dispatch, delivery, installation, etc.)
defined in procedures, work instructions, training, etc.?
Are responsibilities assigned? Are appropriate records
maintained?

7.5.5 Protect and preserve the conformity of Are there documented packaging specifications? Are
product during delivery to the intended packaging materials and processes controlled?
destination. Investigate if customer complaints (or other evidence)
indicate that there were instances of product
damage/deterioration due to inadequate or defective
product packaging/protection.
Go to purchasing and the packaging material storage
areas and check that only the specified packaging
materials are being purchased and used.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 9 of 25

Product Realization Process PRP 07 – Inspection, Test and Metrology

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
8.2.3 Monitor and measure processes and product Are all specified receiving, in-process and final
8.2.4 characteristics to verify their conformity with inspections (tests) implemented? Are all specified
requirements (in accordance with quality process monitoring activities implemented? Are
plans established in PRP 08, Production and inspection/test and/or process monitoring methods and
acceptance criteria documented (drawings,
Quality Planning). specifications, procedures, work instructions, training)?
Are inspection/testing personnel trained?

8.2.4 Maintain records of process and product Are all inspection, testing and process monitoring
conformity and the person(s) authorizing activities and their results recorded? Is the identity of
release of product. the inspecting/testing personnel recorded?
Select a sample of production/QC records and verify
that the whole quality plan was implemented and the
results recorded.

8.2.4 Prevent the release of product until all How is the finished product released? Who verifies,
planned production and verification activities and how, that all specified production and verification
have been completed (in accordance with activities have been completed? How is the released
quality plans established in PRP 08, product identified (distinguished from product that has
not yet been released)? What measures are
Production and Quality Planning). implemented to ensure that product that has not been
formally released is not used or shipped?
Ask personnel in inventory management and shipping
functions how do they know (and verify) what is the
release status for any given product (batch).
Select a sample of production/QC records (and/or
product staged for shipping) and verify that all product
release activities were carried out as planned.

7.6 Determine the monitoring and measurement Is it determined what monitoring and measuring shall
to be undertaken and the measuring devices be undertaken to verify product conformity and what
needed to verify product conformity. measuring devices are needed (control plans, work
orders, inspection procedures, drawings, etc.)?

7.6 Establish processes for monitoring and Are measuring devices selected on the basis of the
measuring activities. monitoring/measurement requirements (accuracy,
environmental conditions, etc.)? Are
operators/inspectors competent (trained) in the use of
measuring devices?

7.6 Ensure that measuring equipment shall Is there a list (inventory) of measuring devices? Are all
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 10 of 25

 be calibrated or verified against traceable active devices calibrated (those used for product
measurement standards, verification)? Are calibration certificates, or other
 be adjusted or re-adjusted as necessary, records, established and maintained? Is traceability to
 be identified (also with calibration status), national or international standards recorded? Is
calibration (adjustment) frequency defined? Is it
 be safeguarded from improper followed? Are measuring devices identified (unique
adjustments, and serial numbers)? Are measuring devices identified with
 be protected form damage and calibration stickers? How are devices safeguarded
deterioration. from unauthorized adjustments? Are measuring
Maintain calibration records. devices adequately protected during handling,
maintenance and storage?

7.6 Assess the validity of the previous What is done when a nonconforming measuring device
measuring results when the equipment is is found? Is there an investigation to establish whether
found to be nonconforming (damaged, out of acceptance of any product is affected? Are results of
calibration, etc.). Take appropriate action on such investigation recorded (CARs)? Are corrective
actions taken on the equipment and any product
the equipment and any product affected. affected (CARs)?

7.6 Validate computer software used in the Is computer software used in any monitoring and
monitoring and measurement of specified measurement? Is it in-house developed software? Can
requirements. the software be changed or updated? Is the software
validated? Are validation reports available?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 11 of 25

Product Realization Process PRP 08 – Production and Quality Planning

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.1 Determine quality objectives and Are quality objectives and requirements (tolerances,
requirements for the product. surface finish, workmanship standards, etc.) for the
product defined? How are they documented (drawings,
specifications, samples, etc.) and communicated
(instructions, samples, training, etc.)?

7.1 Establish production processes and Are production processes validated or tested (refer
documentation, and provide adequate also to PRP 05 ISO 7.5.2)? Who selects production
equipment, operators and other resources equipment, and how? Are operators trained? Are there
specific to the product. adequate work instructions?
Select a sample of processes and ask how they were
developed and validated/tested; and review the
associated documentation (performance/validation test
results, work instructions, operator qualification
requirements, setup verification records, etc.).

7.1 Determine required verification, validation, Are requirements for product inspection and testing
monitoring, inspection and test activities defined and documented for all stages of product
specific to the product and the criteria for realization (receiving of purchased products, in-
product acceptance. process and final product release)? Are
inspection/testing methods and procedures defined
and documented? Are acceptance criteria
defined/documented? How is the quality plan for a
product communicated to production and QC
personnel (work order, procedures, checklists, etc.)?

7.1 Determine records needed to provide Is each specified inspection, test and monitoring
evidence that production processes and activity recorded? Is the scope and format of records
resulting product meet specified defined (work orders, tags/tickets, forms, electronic
requirements. data collection systems, etc.)?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 12 of 25

Product Realization Process PRP 09 – Product Design

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.3.1 Plan design product design activities, to Are design stages/activities identified? Are review,
include verification and validation activities identified? Are
responsibilities/authorities for each activity assigned?
 the design stages; Verify that there is a design project schedule, or at
 the review, verification and validation least due dates for completion of major design phases;
activities appropriate to each stage; and and that it includes design reviews and design
 assignment of responsibilities and verification/validation activities.
authorities.
7.3.2 Determine, document, review and approve How is design input documented (design project book,
design inputs, to include, as applicable, kickoff sheet, etc.)? Who is responsible for reviewing
 functional and performance requirements, and approving the input? How is the approval
 statutory and regulatory requirements, and documented/recorded? How are changes and/or
introduction of additional inputs handled?
 information from previous similar designs.
7.3.3 Provide design output that is in a form Is design output documented? How? Are the
suitable for verification against design input documents reviewed and approved prior to release and
requirements, and approve the design output by whom? How are preliminary documents
prior to release. distinguished from the final released documents?
Verify that design output documents forwarded to
production, subcontractors or other consultants are
clearly identified as final or preliminary.

7.3.3 Ensure that the design output Is there a systematic review to verify that design output
 meets design input requirements, meets design input requirements (last design review
 provide necessary information for meeting)? Is information for purchasing, such as
purchasing and production, material specs, parts lists, etc. included? Are there
clear specifications, drawings and instructions for
 contains acceptance criteria, and production? Are there acceptance criteria for inspection
 specifies product characteristics that are and testing of product? Where applicable, are safety
essential for its safe and proper use. and operation/use features considered in the design
and included in the design output?

7.3.4 Perform systematic design reviews to How many design reviews are planned for the design
evaluate whether the design is on track project? What is the role of these reviews? Who
toward meeting input requirements, and to participates? Are there records of the reviews? Are
identify any problems and propose there records demonstrating that the resulting actions
are implemented and their effectiveness verified?
necessary actions. Maintain records of the
reviews and the resulting actions.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 13 of 25

7.3.5 Carry out design verification to ensure that What specific actions are taken to verify that design
design outputs have met the design input outputs meet the design input requirements? Is this a
requirements. Maintain records of the systematic review? Are all design inputs considered?
verification results and any related actions. Are the actual verification results (calculations, data,
etc.) included in the record?

7.3.6 Prior to delivery or implementation of the How is the design validated? Is a prototype built and
product, perform design validation to ensure tested? Is the first article tested? Is the design based
that the resulting product is capable of on a similar proven design? Are validation records
meeting the requirements for the specified maintained? Are the actual validation results (test data)
included in the record?
application or intended use. Maintain records
of the validation results and any related
actions.
7.3.7 Review, verify, validate, as appropriate, and How are requests for design changes documented and
approve design changes before processed? Who reviews and approves requests for
implementation. Evaluate the effect of the design changes? Is the effect of change on the overall
changes on constituent parts and on product product considered (ask for specific examples)? Who
decides, and how, what reviews, verifications and
already delivered. Maintain records of validations need to be done for a design change? Are
changes and of their reviews/evaluations results of reviews, verifications and validations
and any necessary actions. included in design change records?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 14 of 25

Measurement and Improvement Process MIP 01 – Control of Nonconforming Product

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
8.3 Identify and control nonconforming product Is there a procedure for identifying, controlling and
to prevent its unintended use or delivery. dealing with nonconforming product? Is the
identification (labels, tags, etc.) firmly attached/affixed
to the product or its container? Are nonconforming
products segregated? Quarantined? How? Are there
arrangements to identify/segregate nonconforming
(purchased) product in receiving areas? In production
areas? In inspection areas? In storage areas
(warehouses)? In shipping areas? Are personnel
trained in the uses of the procedure in each relevant
area?

8.3 Deal with nonconforming product by Are responsibilities assigned for making NC product
 eliminating the nonconformity (rework), disposition decisions? Are these decisions
 authorize its use, release or acceptance documented? How is this documentation associated
(accept as-is under concession), or with the actual product (control number, special
stickers/tag, copy of the NCR report attached to the
 preclude its original use or application product, etc.)? When accepting NC products, how is it
(scrap or re-grade). determined whether customer concession is required
or not? Who has the authority to accept NC products
under a concession?

8.3 Maintain records of the nature of Are there records describing the nature of
nonconformities and any subsequent action nonconformities and actions taken? Are they traceable
taken. to specific product batches or shipments? How long
are these records retained?

8.3 Re-verify reworked or repaired products to Are reworked or repaired products re-verified (re-
demonstrate their conformity. inspected, re-tested, etc.) to their original specification?
Are the results recorded? Is reworked product formally
released for use or delivery?

8.3 Take actions to mitigate the effects of What actions are taken when product nonconformity is
nonconformity when a nonconforming detected after delivery? Who decides what needs to be
product has been shipped (or use has done? Are these decisions documented? How? Is
started). there a follow up to determine whether the actions
were completed and were effective?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 15 of 25

Measurement and Improvement Process MIP 02 – Internal Audits and Analysis of Data
ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
8.2.2 Plan and conduct internal audits to Is there an internal audit plan/schedule? Are status and
determine whether the quality management importance of a process considered when planning
system conforms to requirements (planned audits (increased audit frequency for important and/or
arrangements, ISO 9001, internal problematic processes/areas)? Are all relevant
processes and areas covered by the audit
requirements); and whether it is effectively plan/schedule?
implemented and maintained.
8.2.2 Define and document audit criteria, scope, Is there a written procedure for internal auditing? Are
frequency and methods; and ensure auditors trained? How are audit criteria and scope
objectivity and impartiality of the audit documented (standard, checklists, etc.)? Are there any
process. records of what specific evidence was reviewed
(usually auditor notes on checklists)? How are
nonconformities documented? Are auditors impartial
and independent from the work being audited?

8.2.2 Take actions to eliminate detected Are specific responsibilities assigned for corrective
nonconformities and their causes, and follow actions to eliminate nonconformities and their causes?
up to verify the actions taken and to report Are corrective actions documented/recorded? Is there
the verification results. a follow up to verify the implementation and
effectiveness of corrective actions?

8.4 Collect and analyze data on the performance What specific data and information are collected
of the quality management system, to regarding customer satisfaction (see also MIP 04)? Are
include data on product nonconformity rates collected? Are
 customer satisfaction, there data on trends of characteristics of processes
and products (e.g., on how these characteristics vary
 product conformity, within the specified tolerance)? What specific supplier
 characteristics and trends of processes performance data are being systematically collected
and products (including opportunities for (on-time delivery, nonconformity rates, etc.)?
preventive actions), and Is it determined how the quality performance data is to
 suppliers. be collected and by whom? How is the data processed,
analyzed and used?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 16 of 25

Measurement and Improvement Process MIP 03 – Corrective and Preventive Action

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
8.5.2 Take actions to eliminate causes of How many corrective actions have been initiated
nonconformities to prevent recurrence. through the period? How many are open? How long
have they been open? Are there due dates?

8.5.2 Establish documented procedure for Is there a documented procedure for corrective
 reviewing nonconformities (including actions? How are nonconformities identified and
customer complaints), reviewed (nonconforming product/process reports,
 determining causes, customer-returned product, product returned for
servicing, customer complaints, etc.)? How are causes
 evaluating the need for corrective action, determined? Are they documented (CAR form?) How is
 determining and implementing corrective the need for corrective actions determined (authorized
actions, personnel/managers issuing CARs)? How are the
 recording the results of actions taken, and required actions determined and recorded (in a CAR
 reviewing corrective actions. form)? Are corrective actions followed up and are their
results recorded? Are corrective actions reviewed
(Management Review)?

8.5.2 Take actions to eliminate causes of potential How many preventive actions have been initiated
nonconformities to prevent occurrence. through the period? Are they distinct from corrective
actions? How?

8.5.2 Establish documented procedure for Is there a documented procedure for preventive
 determining potential nonconformities and actions (may be together with the corrective action
causes, procedure)? How are potential nonconformities
 evaluating the need for preventive action, determined (quality performance trends, customer
complaints, service records, etc.)? How are causes
 determining and implementing preventive determined? Are they documented (PAR form?) How is
actions, the need for preventive actions determined (authorized
 recording the results of actions taken, and personnel/managers issuing PARs)? How are the
 reviewing preventive actions. required actions determined and recorded (in a PAR
form)? Are preventive actions followed up and are their
results recorded? Are preventive actions reviewed
(Management Review)?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 17 of 25

Measurement and Improvement Process MIP 04 – Customer Complaints & Satisfaction

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
7.2.3.c Determine and implement effective Is there a system for receiving customer feedback and
arrangements for communicating with complaints (logs, complaint files, etc.)? Are
customers regarding customer feedback and responsibilities for handling customer complaints
customer complaints. assigned? Is there a linkage with the
corrective/preventive action system?

8.2.1 Monitor information relating to customer What type of information is used to determine
satisfaction. Determine methods for customer satisfaction (feedback, surveys, interviews,
obtaining and using this information. etc.)? How is this information obtained? How often?
How is this information processed and used (for
example, statistical analysis reported to management
review)?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 18 of 25

Management Responsibility Process MRP 01 – Planning and Objectives

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
4.1 Document, implement and maintain a quality Are processes needed for the quality management
management system in accordance with system identified and established (process map)? Is
requirements of ISO 9001. the sequence and interaction between these processes
determined (process map)? Are criteria and methods
for the operation and control of quality system
processes established (operational procedures)? Are
required resources available? Are quality system
processes monitored and measured (internal audit,
customer satisfaction, manufacturing process
performance, etc.)? Is the quality system being
continually improved?

4.1 Ensure control of outsourced processes. How are outsourced processes controlled? Are outputs
of outsourced processes verified? Are subcontractors
and suppliers required to operate and maintain quality
management systems (ISO 9001)?

5.1 Top management shall How is importance of meeting customer and other
 communicate to the organization the requirements communicated? Do employees
importance of meeting customer and other understand the consequences of failing to meet
applicable requirements, requirements? Is there a quality policy? Are quality
objectives defined? Are management reviews being
 establish the quality policy, conducted regularly? ‘Are adequate resources
 establish quality objectives, necessary for the quality system provided?
 conduct management reviews, and
 ensure availability of resources.
5.2 Top management shall ensure that customer What measures are implemented to ensure that
requirements are determined and are met. customer requirements are determined and met
(processes, procedures, training, monitoring, auditing,
etc.)?

5.3 The quality policy shall Is the quality policy appropriate (relevant to the types
 be appropriate to the purpose of the of products, type of market, customer expectations,
organization, etc.)? Does it include explicit commitment to comply
 include a commitment to comply with with requirements and continually improve the quality
system? Is it related to quality objectives? Do
requirements and continually improve the employees know the meaning of the quality policy and
quality management system, understand how they can contribute to achieving the
 provide a framework for establishing the policy? Is the quality policy periodically reviewed for
quality objectives, continuing suitability?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 19 of 25

 be communicated and be understood

throughout the organization, and
 be reviewed for continuing suitability.
5.4.1 Establish measurable quality objectives that How many objectives are established? Are they
are consistent with the quality policy. measurable? Is how to measure progress defined and
who is responsible for doing this? Is anyone
responsible for implementation of the objectives? What
happens when an objective is achieved? What is the
mechanism for establishing new objectives?

5.4.2 Plan the quality management system and How is the quality system planned and by whom? How
ensure that the system integrity is is the plan documented (quality manual, gap analysis
maintained when changes are implemented. checklist, etc.)? When changes are implemented, is
there an evaluation of the impact of the change on the
overall system?

5.5.1 Define responsibilities and authorities and Is there an organizational chart (or other type of
communicate them throughout the specification of organizational responsibilities and
organization. authorities)? Does it clearly show who is responsible
for processes needed for the quality system? Do
operational procedures and work instructions assign
responsibilities for performing activities that are defined
in these documents? How are responsibilities and
authorities communicated to employees (quality
manual, procedures, training)?

5.5.2 Appoint a management representative for Who is appointed as the management representative?
the quality management system. Define How is this appointment documented? Are
his/her responsibilities, to include: responsibilities and authorities of the representative
 ensuring that processes needed for the defined? Does the representative have sufficient
authority to ensure that quality system is established,
quality system are established, implemented and maintained? What evidence is there
implemented and maintained, that the representative reports to top management on
 reporting to top management on the the performance of the quality system (management
performance of the quality system and review meetings)? What examples are there of the
need for improvement, and representative promoting awareness of customer
 promotion of awareness of customer satisfaction?
requirements.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 20 of 25

Management Responsibility Process MRP 02 – Management Review

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
5.6.1 Periodically review the quality management How often are management reviews conducted? Who
system to ensure its continuing suitability, participates? Is there an agenda prepared for each
adequacy and effectiveness, and to identify review? How are the reviews recorded (minutes of
opportunities for improvement. meetings)?

5.6.2 The input into management reviews shall Are all required inputs provided for each review? Are
include: there records specifically demonstrating that each input
 results of audits, was provided and considered? Have all actions from
 customer feedback, the preceding review been closed out? What happens
to actions that have not been fully completed? How, for
 process performance and product example, are recommendations for improvement input
conformity, into the review? Who is responsible for making the
 preventive and corrective actions, recommendations? How are those recommendations
 actions from previous reviews considered? Who decides which recommendations are
 changes, and accepted and which are rejected?
 recommendations for improvement.
5.6.3 The output from management reviews shall In the last two management reviews, what specific
include decisions and actions related to: decisions and actions related to improvement of the
 improvement of the quality system and its quality system and the product were taken? How were
processes, they implemented? Were there any special resources
provided to implement the improvements? Was the
 improvement of product related to implementation verified?
customer requirements, and
 resource needs.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 21 of 25

Management Responsibility Process MRP 03 – Continual Improvement

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
8.5.1 Continually improve the effectiveness of the Is there a process for identifying opportunities for
quality management system through the use improvement? How are the quality policy and quality
of objectives used in this process? How are audit results
 quality policy and analysis of data used? What specific
improvements have been implemented through the
 quality objectives, current (last) cycle? Is there a systematic process for
 audit results, implementing improvements and for verifying their
 analysis of data, effectiveness (objective implementation projects,
 corrective and preventive actions, and corrective and preventive actions, etc.)?
 management reviews.
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 22 of 25

Resource Management Process RMP 01 – Personnel Competence and Skills

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
6.2.1 Ensure that personnel performing work Are competence (education, training, skills and/or
6.2.2.e affecting product quality have appropriate experience) records maintained for each employee?
education, training, skills and experience; What is the format of these records and who maintains
and maintain records of their qualifications. them? How do managers/supervisors responsible for
assignment of work activities know who is competent
to perform a particular job (training matrix)?

6.2.2.a  Determine the necessary competence Are there defined competence (education, training,
6.2.2.b requirements for personnel, skills and/or experience) requirements for each
6.2.2.c  provide training or take other actions to job/position affecting product quality? How are they
satisfy these needs, and documented?
Are new employees formally trained for new
 evaluate the effectiveness of the training jobs/positions? How? Is this training recorded?
provided (or other actions taken). After completion of training, how is the effectiveness of
the training evaluated? Is it done for all training
provided, without exceptions?

6.2.2.d Ensure that personnel are aware of the Are employees aware of specific consequences of
relevance and importance of their work and product deficiencies and failures (safety,
how they contribute to the achievement of environmental, customer dissatisfaction, etc.)? Are
quality objectives. employees aware of the quality objectives relevant to
their jobs/positions and do they know how, specifically,
they can contribute to reaching these objectives?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 23 of 25

Resource Management Process RMP 02 – Information, Document Control and IT

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
4.2.1 Establish and maintain quality management Are quality policy and quality objectives documented?
system documentation, to include: Where?
 quality policy and quality objectives, Is there a quality manual? Operational procedures?
 quality manual Are drawings, specifications, work instructions, work
orders, control plans, etc., issued and maintained as
 operational procedures controlled documents (as required in 4.2.3)?
 specifications, drawings, work instructions Are electronic documents (computer files) backed up?
and other such documents needed to
ensure the effective planning and
operation of the quality system, and
 records (ref to ISO 9001 4.2.4)
4.2.2 Ensure that the quality manual includes Is the quality manual addressing all relevant
 the scope of the quality management requirements of ISO 9001? Are exclusions from
system and exclusions, Section 7, Product Realization, documented in the
 operational procedures or references to quality manual (if any)? Are operational procedures
included or referenced in the quality manual? How is
them, and the interaction between the processes of the quality
 description of the interaction between the system documented (process map, flowcharts, etc.)?
processes of the quality system.
4.2.3 Define (in a written procedure) the controls Is there a written procedure for control of documents?
needed to Are controlled documents approved? How is the
 approve documents prior to issue, approval evidenced (signature)? Is there a process for
 review, update and re-approved reviewing, updating and re-approving documents? Are
documents identified with their revision level? How are
documents, changes identified (change brief, highlighted, etc.?)
 identify changes and current revisions of What measures are implemented to ensure that
documents, relevant and current documents are available at points
 make relevant and current documents of use (distribution lists, current master lists, etc.)? Are
available at points of use, documents uniquely identified (unique title and /or
 ensure that documents are legible and code-number) and are they legible? Is there a process
identifiable, for receiving, reviewing, approving (for use) and
 identify and control the distribution of distributing documents of external origin (form
documents of external origin, and customers, regulators, suppliers, etc.) When obsolete
documents are retained, is it for a specific, stated
 identify retained obsolete documents and reason? Are obsolete documents clearly marked to
prevent their unintended use. distinguish them from current revisions? What other
measures are implemented to prevent unintended use
of obsolete documents?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 24 of 25

4.2.4 Establish and maintain records to provide Is there a list (or other documented specification) of
evidence of conformity and effectiveness of quality system records that are maintained by the
the quality management system. company? Are the records sufficient to demonstrate
product and process conformity, and the conformity
and effectiveness of the quality management system
and its implementation?

4.2.4 Establish documented procedure for the Is there a documented procedure for the control of
identification, storage, protection, retrieval, records? Does it address the identification, storage,
retention time and disposition of records. protection and retrieval of records? Are retention times
and storage locations defined for all types of records?

4.2.4 Ensure that records remain legible, readily Are records stored in dry, clean locations to protect
identifiable and retrievable. them from deterioration? Are electronic records backed
up? Are records readily retrievable (test by asking for
retrieval of specific records)?
 INTERNAL AUDIT CHECKLIST Doc: QF-82-02-3 Revision: A Pg. 25 of 25

Resource Management Process RMP 03 – Facilities, Equipment and Work Environment

ISO
Requirements What to look for and how Comply Auditor notes and evidence
9001
6.3 Determine, provide and maintain Are buildings and facilities in good repair and properly
infrastructure needed to achieve conformity maintained (look for leaking roofs, broken windows,
to product requirements, to include: contamination, infestation, etc.)? Is there sufficient
 buildings, workspaces and associated space for office, production, storage, and other
operations and activities (look for overcrowding,
utilities, intermingling, cross-contamination, etc.)? Is
 process equipment, and organization and housekeeping of storage and work
 supporting services. areas satisfactory? Is process equipment regularly
maintained and serviced? Are supporting services
(communication, transportation, etc.) adequate?

6.4 Determine and manage the work In work areas, are temperature, humidity, particulate
environment needed to achieve conformity to levels (dust), noise and other such environmental
product requirements. conditions compatible with the type of product and
processes? Is there appropriate and adequate lighting
at work stations?