ISO Internal Audit Checklist: What to Check Before the External Audit

Your external audit is close. Take out your last internal audit report and read it again. Did it cover every process? Do the records match what staff really do? Were old problems fixed for good? Has management seen the results? Not sure about any of these? Fix them now. On audit day, it’s too late.

Here’s a small example. A factory finds some calibration records missing in March. In April the team marked the problem “closed”. No one checks it again. Then the auditor arrives and asks for last month’s record. Nobody can find it. It’s a bad start to the day, and it was easy to avoid.

An ISO Internal Audit finds problems like this early. You still have time to fix them. This checklist shows what to check, what proof to keep ready, and what to do when something is missing. It uses ISO 9001. ISO 27001 and ISO 20000 are alike, but each has its own rules.

What an internal audit is (and isn’t)

An internal audit is your business checking its own work. Someone compares what your procedures say with what staff do. Clear policies and procedures help businesses maintain consistent processes. The Australian Government explains how to develop effective business policies, procedures and processes. Then  they compare both with the standard. Think of a car service, not a roadside breath test.

ISO 9001 covers this in Clause 9.2. Plan your audits. Pick auditors who are fair. Tell management what you found. Fix the problems. Keep records. The main rule is independence. Nobody should audit their own work.

The external audit is the real one. An outside company, called a certification body, decides if you meet the standard. Pick one that JAS-ANZ has accredited. Certification is your choice. It is not the law. A clean internal audit won’t promise a pass, but it shows where you stand.

Why do the internal audit first?

An outside auditor can’t check everything. They take a sample. If something looks weak, they look closer. If you find the weak spots first, you choose when and how to fix them.

Most certification bodies want an internal audit and a management review done before they certify you. Ask yours what they need, and by when.

A thorough ISO internal Audit also helps your staff. They can practise explaining their work before the real auditor asks.

Which edition will you be audited against?

ISO 9001:2026 came out on 16 September 2026. It replaces the 2015 edition. If you are already certified, you have three years to switch. The clause numbers are the same. Ask your certification body which edition they will use, and when your switch is due.

A few points are new. Leaders must support quality and good behaviour (clause 5.1). Staff must know about both (clause 7.3). Risks and opportunities are now two separate things (clause 6.1).

Your pre-audit checklist

Use this table to plan your audit. Each row shows what to check, what proof an auditor may ask for, and what to do if it is not there. A star (*) means good practice, not a rule in the standard.

Short on time? This tip is ours, not ISO’s. Start with last audit’s findings, your corrective action records and your management review minutes. They are quick to check. Auditors often ask about all three.

Here is a fast way to find gaps.* Pick one recent customer order. Follow it from the first enquiry to delivery. At each step, ask to see the record. Can’t find one? That’s a gap.

When you finish the table, mark each row as fine, shaky or missing. Fine means you can show the proof in a few minutes. Shaky means it exists, but it is old or half done. Missing means you can’t find it. Fix the missing rows first. Then the shaky ones. Then check again.

Auditors don’t only read paper. They talk to your staff too. So try it yourself first. Ask two or three people a simple question. For example, “What does the quality policy mean for your job?” or “How do you know this is the latest version?” If someone goes quiet, you know where to spend your time.

Common mistakes

• Checking your own work. Ask someone else to run the audit.

• Only reading documents. Look at real records. Watch the work. Talk to the people who do it.

• Closing problems too fast. Say a late delivery leads to staff training. The auditor will ask how you know the training worked. A dated check of later deliveries answers that.

• Skipping the management review. Or holding it without the audit results.

• Starting too late. If you audit the week before certification, there is no time to fix anything.

What to do if you find gaps

Put every finding from your ISO internal Audit in one list.  Add a name and a due date to each. For each one, fix the problem. Then find out why it happened, and fix that cause. Then check that the fix worked.

The standard has its own words for this. A missed requirement is a nonconformity. The fix for its cause is a corrective action. Clause 10.2 says you must check the fix worked and keep a record.

Start with the risky ones. A missing record may take an afternoon. A process that keeps failing takes longer.

Watch for repeats. Maybe the same handover mistake keeps happening. Maybe approvals keep getting stuck. Then the process may be the problem, not your people. Process improvement consulting services can help here. They redesign the work, so you don’t just add another form. Methods like DMAIC, used in Lean Six Sigma consulting, suit this kind of problem.

When outside help makes sense

You can run your own audits if you have someone fair and independent who knows the standard. Get outside help if:

• nobody is free of the work they would check

• your team has never done an audit

• the same findings keep coming back

• the audit date is close

  
  

Independent ISO audit services give you a fresh view and a clear list of fixes. We work with businesses on ISO 9001, ISO 27001 and ISO 20000, including audits and certification readiness.

For a better understanding of the certification process, key preparation steps and expected timeframes, read our blog :-  ISO 27001 Certification Timeline: What Australian SMEs Should Expect for Australian small and medium-sized businesses.

For support with your ISO audit preparation, consider a free Business Discovery consultation with 6 Sigma Consulting. The aim is to understand your business needs and provide a clear recommendation, with no cost or obligation.

Frequently asked questions

Do we need a qualified auditor?

 ISO 9001 doesn’t set formal qualifications. The person should know the standard, know how to run an audit, and stay fair. That means they can’t check their own work.

How often should we audit?

 ISO 9001 says “at planned intervals”, so there is no fixed number. Check important processes more often. Do the same for anything that changed or had problems before.

Is an internal audit the same as a gap analysis?

 No. A gap analysis compares your system with the standard one time, usually before you build or fix it. An internal audit comes later. It checks if the system is really in use and working.

Does a clean internal audit mean we’ll be certified?

 No. The certification body makes that decision. It can still find issues on the day. A clean internal audit just means fewer surprises.

What records should we keep?

 Keep records of the audit program and its results, as ISO 9001 asks. This usually means the plan, your checklist or notes, each finding, the fix, and proof that someone checked the fix.