ISO 9001:2015 audit checklist: verify your QMS

What this checklist is for

This checklist supports an internal audit of a quality management system against ISO 9001:2015. It follows the structure of the standard clause by clause and helps you verify whether the QMS conforms to its requirements. Each item asks you to examine evidence — how something has been determined, documented, communicated or reviewed — rather than to tick a box, so the audit produces a clear picture of where the system conforms, where it does not, and where there is room to improve.

Why an ISO 9001:2015 audit matters

An audit is how you find out whether the quality management system is doing what it is supposed to do. Working through the requirements of the standard item by item shows whether the organisation has established, documented and maintained the arrangements the standard expects, and whether those arrangements are being followed in practice. The checklist covers the context of the organisation (Clause 4), leadership (Clause 5) and planning (Clause 6), and it extends into support (Clause 7), including resources, competence, awareness, communication and documented information, so the audit looks at both the system's design and the way it is supported day to day.

What a good ISO 9001:2015 audit covers

A thorough audit looks at the whole system, not just parts of it. This checklist is organised so you can cover the ground methodically: - **Context of the organisation (Clause 4):** how external and internal issues relevant to the organisation's purpose and strategic direction have been determined, how they affect the ability to achieve the intended results of the QMS, and how they are monitored and reviewed. Also how interested parties and their relevant needs and expectations have been determined, how their impact or potential impact has been assessed, and how information about them is monitored and reviewed. > The checklist also covers how the scope of the QMS accounts for those issues, the requirements of interested parties and the organisation's products and services, and how the scope is documented and justified where requirements are not applicable. - **Clause 4 continued:** how the QMS processes have been determined, including their inputs and outputs, their sequence and interaction, the criteria, methods, measures and performance indicators needed to operate and control them, the resources allocated, and the responsibilities and authorities assigned. It also looks at how risks and opportunities are considered, how processes are monitored, measured and evaluated, how changes are implemented to reach intended results, and how improvement opportunities are identified. - **Leadership (Clause 5):** whether top management is identified and demonstrates leadership and commitment — taking accountability for the effectiveness of the QMS, ensuring the quality policy and objectives are established and compatible with strategic direction and context, integrating the QMS into business processes, encouraging the process approach and risk-based thinking, making resources available, communicating the importance of an effective QMS and of conforming to its requirements, achieving intended results, and engaging, directing and supporting people to contribute. It also covers promoting continual improvement and supporting other management roles. - **Quality policy (Clause 5.2):** whether the policy is appropriate to purpose and context, supports strategic direction, provides a framework for quality objectives, includes commitments to satisfy applicable requirements and to continually improve, is maintained as documented information, is communicated, understood and applied, and is available to interested parties. - **Roles, responsibilities and authorities (Clause 5.3):** whether these are assigned and communicated, including the responsibility and authority to ensure the QMS conforms to ISO 9001:2015, to ensure processes produce intended results, to report on performance and improvement opportunities to top management, and to maintain the integrity of the QMS when changes are planned and implemented. - **Planning (Clause 6):** how internal and external issues and interested parties are considered when planning the QMS; how risks and opportunities are determined and addressed so the system can achieve intended results, prevent and reduce undesired effects and improve continually; how actions are planned, integrated into QMS processes, implemented and evaluated for effectiveness; and, within the planning clauses, quality objectives and plans to achieve them and the planning of changes.

How to carry out the audit

Start by reading the standard's structure against the checklist so you know the path you will follow. Begin with the context of the organisation: check how the organisation has determined its external and internal issues and the interested parties that matter to the QMS, how it has assessed their impact, and how it monitors and reviews that information. Then confirm that the scope of the QMS reflects those issues, the requirements of interested parties and the organisation's products and services — and where the organisation has decided that a requirement of ISO 9001:2015 does not apply, that the justification is documented and that conformity of products and services is not affected. Next, examine the processes of the QMS: how they were determined, what their inputs and outputs are, how they interact, and what criteria, methods, measures and performance indicators are used to operate and control them. Check how resources, responsibilities and authorities are assigned; how risks and opportunities are considered and acted on; how processes are monitored, measured and evaluated; and how changes and improvement opportunities are handled. Then move to leadership. Confirm that top management is identified and look for evidence of the behaviours listed above. Read the quality policy and test it against each requirement — appropriate to context, a framework for objectives, commitments to satisfy requirements and improve, maintained as documented information, communicated and understood, and available to interested parties. Check that responsibilities and authorities for relevant roles are assigned and communicated, including the specific accountabilities the standard sets out. Finally, work through planning: how the organisation considers its context and interested parties when planning, how it determines and addresses risks and opportunities, how actions are integrated and implemented in its processes, and how it evaluates their effectiveness. Where the checklist reaches into Clauses 6.2 and 6.3, examine the quality objectives and the plans to achieve them, and how changes to the QMS are planned. As you go, record each finding against the relevant item. The answer scale gives you four options — 'Meets requirements', 'Nonconformity', 'Opportunity for improvement' and 'N/A' — so that conformities, non-conformities, opportunities for improvement and items that do not apply are all captured clearly.

Frequently Asked Questions

The checklist is built on the structure of the ISO 9001:2015 standard itself. It is organised into the clauses that make up a quality management system: the context of the organisation (Clause 4), leadership (Clause 5), planning (Clause 6), support (Clause 7), and the requirement to keep documented information, with each clause broken down into its sub-clauses so that you can work through the standard systematically.

Bring the documented information your QMS relies on — your scope statement, quality policy, objectives and plans, the description of your processes and their sequence and interaction, your risk registers, and the records supporting competence, awareness, communication and control of documented information. The checklist asks you to verify and demonstrate these points, so you will need to refer to them as you work.

It prompts you to look at how top management demonstrates leadership and commitment, including taking accountability for the effectiveness of the QMS, making sure the quality policy and objectives are established and compatible with the organisation's strategic direction, integrating the QMS into business processes, encouraging the process approach and risk-based thinking, making resources available, communicating the importance of the QMS and of conforming to its requirements, achieving the intended results, and engaging, directing and supporting people to contribute to its effectiveness. It also covers promoting continual improvement and supporting other management roles so that they can demonstrate leadership in their own areas of responsibility.

The scope of the QMS must consider external and internal issues, the requirements of interested parties, and the organisation's products and services. The checklist asks you to verify that the scope is documented, that it states which products and services are covered, and that where any requirement of ISO 9001:2015 has been found not applicable it gives a justification and does not affect the organisation's ability to ensure conformity of its products and services.

You can close out each item as 'Meets requirements', 'Nonconformity', 'Opportunity for improvement' or 'N/A', so the audit records not only non-conformities but also opportunities for improvement and items that do not apply. Section 1 also captures the date, who prepared the audit and the location.

The checklist runs to 245 items and takes its structure from the numbered clauses of ISO 9001:2015 — context of the organisation, leadership, planning, support and documented information — so you can work through the standard clause by clause and demonstrate conformity at each step.

Written by

Arne Reis

Founder

Process optimizer with 25 years of expertise, focused on operational excellence in quality, maintenance, EHS, and commissioning. Emphasizes innovative solutions and top-quality standards.

View LinkedIn profile