ISO 9001 audit checklist A self-assessment against the standard's core clauses. Tick what's actually true today, not what should be. An honest score here is more useful than a flattering one. Add the industry sections that apply to your site.
Transitioning an environmental system? Use the ISO 14001:2026 readiness checklist alongside this ISO 9001 checklist. What the 2026 revision of ISO 9001 changes is on the ISO 9001:2026 transition page ; the dates for ISO 14001 are on the ISO 14001:2026 transition page .
Clause 4 · Context of the OrganizationInternal and external issues relevant to the QMS are identified and reviewed periodically. Whether climate change is a relevant issue has been considered and the conclusion recorded. Interested parties (customers, regulators, suppliers) and their requirements are documented. The scope of the QMS is defined in writing, with exclusions justified. Processes are mapped with their sequence, interactions, and owners.
Clause 5 · LeadershipTop management can demonstrate active involvement in the QMS, not just sign-off. A quality policy exists, is communicated, and is understood at the shop-floor level. Customer focus is demonstrable: requirements and risks affecting product conformity are addressed. Roles, responsibilities and authorities for quality are assigned and known.
Clause 6 · PlanningRisks and opportunities affecting the QMS are assessed, not just listed once and forgotten. Quality objectives are measurable and tracked against a plan, not aspirational statements. Changes to the QMS are planned rather than made ad hoc.
Clause 7 · Support: Resources & CompetenceResources for the QMS (people, infrastructure, environment) are determined and provided. Equipment used for verification is calibrated or verified, and records are current. Organisational knowledge critical to operations is captured, not held in one person’s head. Competence records exist for staff in quality-critical roles, with training evaluated for effectiveness. Staff know how their work affects quality and what happens when requirements are not met.
Clause 7.5 · Support: Documented InformationDocumented information is controlled: version, approval and access are traceable. Documents of external origin (customer specs, standards) are identified and controlled. Records are protected from loss and unintended alteration, with retention defined.
Clause 8.1-8.2 · Operation: Planning & RequirementsOperational processes are planned with acceptance criteria and the records needed to prove conformity. Customer requirements (including delivery and post-delivery) are reviewed and confirmed before an order is accepted. Changes to orders or contracts are communicated to everyone affected.
Clause 8.3 · Operation: Design & DevelopmentIf you design products or services: design stages, reviews, and responsibilities are planned. Design inputs are complete and unambiguous; outputs are verified and validated against them. Design changes are controlled, with their impact on delivered product assessed.
Clause 8.4 · Operation: External ProvidersSuppliers are evaluated and re-evaluated against defined criteria. The type and extent of control applied to each supplier reflects its risk to your product. Purchasing information states requirements clearly, including competence and notification requirements where relevant.
Clause 8.5-8.7 · Operation: Production, Release & NonconformityProduction or service provision runs under controlled conditions: work instructions, suitable equipment, defined checks. Traceability exists from raw material or input through to delivered output. Customer or supplier property in your care is identified and protected. Product is preserved through handling, storage and delivery. Release requires planned verification to be complete, with authorisation traceable to a person. Nonconforming product or service is identified, segregated and dispositioned, including after delivery.
Clause 9 · Performance EvaluationWhat needs monitoring and measuring is defined, with methods and frequencies. Customer satisfaction is monitored with more than anecdote. Internal audits are scheduled, completed and their findings tracked to closure. Management review happens on a set cycle with documented inputs and outputs.
Clause 10 · ImprovementNonconformities trigger root-cause analysis, not just a fix at the point found. Corrective actions are verified as effective after implementation, not closed on completion alone. Improvement is evidenced: trends analysed, actions taken, results reviewed.
Significant gaps against the standard. Worth a conversation before committing to a certification timeline.
Book a Gap Analysis This is a self-assessment aid, not a certification audit. Your answers are saved only in your own browser. Nothing here is sent to us unless you choose to get in touch.