QPPF 092 1 - InternalAuditChecklis

ISO 9001 INTERNAL AUDIT CHECKLIST
Issued by: Quality Assurance Date: 00-00-00 Revision: A QF-092-1
Refs Requirements What to look for and how Comply Auditor notes and evidence
This checklist is divided into sections corresponding to the quality system processes defined in the Process Map at the top of the checklist. The Process Map and
this audit checklist must call out the same processes. When you edit the Process Map to fit your company, remember to also make corresponding changes in the
checklist.
This is also an ISO 9001:2015 compliance checklist. The requirements for each process are paraphrased from ISO 9001 and there is a reference to the
corresponding clause of the standard (first column). The checklist is carefully designed to completely cover all requirements of the ISO 9001 standard. If, when
customizing the Process Map, you delete or add processes, make sure that you re-associate the corresponding clauses in ISO 9001 and don’t leave any out (e.g.,
maintain completeness of the checklist in regard to compliance with ISO 9001).
You should customize this checklist on three levels: 1) align it with any changes in the Process Map, 2) further develop the “Requirements” column to add other
relevant requirements (if any), and 3) edit the “What to look for and how” column to make it appropriate to the products, operations, practices and issues that are
relevant in your company. The third item in particular will require the most customizing.
INTERNAL AUDIT CHECKLIST Doc: QF-82-02-1 Revision: A Pg. 2 of 26
PROCESS MAP DIAGRAM
Quality System Processes
QSP 041: Context and interested parties QSP 081 : Production/service provision and quality planning
QSP 042: Quality management system processes QSP 082: Sales, contracting and customer communication
QSP 051: Leadership and commitment QSP 083: Design and development of products and services
QSP 052: Quality policy QSP 084: Purchasing and subcontractor control
QSP 053: Roles, responsibilities and authorities QSP 085: Production and service provision
QSP 061: Risks and opportunities QSP 086: Release of products and services
QSP 062: Quality objectives QSP 087: Control of nonconforming outputs
QSP 063: Planning of changes QSP 091: Monitoring, measurement, analysis and evaluation
QSP 071: Resources QSP 092: Internal audit
QSP 072: Competence QSP 093: Management review
QSP 073: Awareness QSP 101: Opportunities for improvement
QSP 074: Communication QSP 102: Corrective and preventive actions (CAPA)
QSP 075: Documented information QSP 103: Continual improvement
QSP 041 Context and interested parties

4.1 Determine external and internal Are the issues determined? Who determined Note
issues that are relevant to the the issues? How are the issues documented? "Yes"
purpose and strategic direction of Are there both internal and external issues? for
the company How are the issues communicated (Quality complia
Manual, training, etc.) Are the issues
reviewed from time to time to ensure their
nce and
continual relevance?. Are there any records "No" for
demonstrating that external issues were noncom
reviewed? Were there any issues added or pliance.
removed after the initial set of issues were
determined?
4.2 Determine interested parties Are interested parties determined? Who

relevant to the QMS and their determined the interested parties? How is it
requirements. documented who the interested parties are?
Are the requirements of the interested parties
determined? Are the interested parties
reviewed from time to time to ensure their
continual relevance?. Are there any records
demonstrating that interested parties were
reviewed? Were there any interested parties
added or removed after the initial
determination?
QSP 042 Quality management system processes

4.3 Determine the Are the boundaries and applicability of the QMS
 Scope of the QMS established and documented? How is the scope
documented? (Quality Manual).
 ISO 9001 requirements that don't
apply to the company When determining the scope, are external and internal
issues considered? Are requirements of interested
parties considered?
Are there any ISO 9001 requirements that are claimed
not to apply to the company? Are these claims
substantiated? Are these claims reasonable and
justified? Are any ISO 9001 requirements related to
enhancing customer satisfaction excluded?
4.4 Define the processes of the QMS Are processes needed for the quality
management system identified and
established (process map)? Is the sequence
and interaction between these processes
determined (process map)? Are criteria and
methods for the operation and control of
quality system processes established
(operational procedures)? Are required
resources available? Are quality system
processes monitored and measured (internal
audit, customer satisfaction, manufacturing
process performance, etc.)? Is the quality
system being continually improved?
NOTE: most of these questions can only be

fully answered after completing the entire
audit.
QSP 051 Leadership and Commitment

5.1 Top management shall Do employees understand the consequences
 support, promote and be of failing to meet requirements? Is there a
accountable for the effectiveness quality policy? Are quality objectives defined?
Are management reviews being conducted
of the QMS
regularly? ‘Are adequate resources
 communicate the importance of necessary for the quality system provided?
conforming to the QMS Are there specific examples how
requirements management promotes improvement?
 provide resources for the QMS
 establish the quality policy and
quality objectives
 promote improvement
5.1.2 Top management shall demonstrate What measures are implemented to ensure
leadership and commitment with that customer requirements are determined
respect to customer focus. and met (processes, procedures, training,
monitoring, auditing, etc.)?
Are there any risks related to customer
satisfaction determined?
QSP 052 Quality policy

5.2.1 The quality policy shall Is the quality policy appropriate (relevant to
 be appropriate to the purpose and the types of products, type of market,
context of the company customer expectations, etc.)? Does it include
explicit commitment to comply with
 provide a framework for quality requirements and continually improve the
objectives quality system? Is it related to quality
 include a commitment to satisfy objectives? Is the quality policy periodically
applicable requirements reviewed for continuing suitability?
 include a commitment to continual
improvement of the QMS
 be communicated and be
understood throughout the
company
 be reviewed for continuing
suitability
5.2.2 The quality policy shall Is the quality policy documented? Do
 be documented employees know the meaning of the quality
policy and understand how they can
 be communicated, understood and
contribute to achieving the policy? Is external
applied in the company, communication of the quality policy
 be available to relevant interested determined?
parties
QSP 053 Organizational roles, responsibilities and authorities

5.3 Assign the responsibility and Are all responsibilities and authorities
authority for: relevant to the QMS defined? How are roles
 ensuring that QMS conforms to and responsibilities assigned and

requirements of ISO 9001 communicated (organizational charts,
responsibilities and authorities defined in
 ensuring that processes are
procedures, process owners) Do operational
delivering their intended outputs procedures and work instructions assign
 reporting on performance of the responsibilities for performing activities that
QMS are defined in these documents? How are
 ensuring the promotion of responsibilities and authorities communicated
customer focus to employees (quality manual, procedures,
 ensuring that changes do not affect training)?
the integrity of the QMS
QSP 061 Risks and opportunities

6.1.1 Determine the risks and Are risks and opportunities defined? How are
opportunities that need to be risks evaluated? Are risks/opportunities
addressed to: reevaluated to ensure their continuing
relevance and validity?
 ensure that the QMS can achieve
intended results
 enhance desirable effects
 prevent or reduce undesired
effects
 achieve improvement
6.1.2 Plan and implement risk reduction Are risk reduction actions planned and
actions to address risks and implemented? Are the actions proportionate
opportunities. to the potential impacts (risks)?
Evaluate the effectiveness of risk Is the effectiveness of risk reduction actins

reduction actions evaluated? How often?
QSP 062 Quality objectives

6.2.1 Establish measurable quality How many objectives are established? Are
objectives that are consistent with they measurable? Is how to measure
the quality policy. progress defined and who is responsible for
doing this? Is anyone responsible for
implementation of the objectives? What
happens when an objective is achieved? Are
objectives updated? What is the mechanism

for establishing new objectives?
6.2.2 Plan how to achieve quality Are plans to achieve quality objectives
objectives, to include the documented? Do those plans include: what
determination of: will be done, what resources will be required,
who will be responsible, when it will be
 what will be done
completed, how the result will be evaluated?
 resources requirements
 responsibilities
 completion die date
 how results will be measured
QSP 063 Planning of changes

6.3 Changes to the QMS shall be When changes are planned and
carried out in a planned manner, to implemented, is there a consideration of
include consideration of: purpose, consequences, impacts on QMS,
availability of resources, and assignment of
 purpose and potential
responsibilities?
consequences What is the evidence that these issues have
 impact on the integrity of the QMS been considered?
 availability of resources
 allocation of responsibilities and
authorities
QSP 071 Resources

7.1.2 Determine and provide personnel Are there sufficient qualified personnel
necessary for implementation and assigned to maintain the QMS? Are
operation of the QMS. document changes (revisions),
corrective/preventive actions, and customer
complaints processed in a timely manner?
Are internal audits, management reviews,
training and other such activities conducted
at prescribed intervals and/or in accordance
with established schedules?
7.1.3 Determine and provide infrastructure Are there sufficient equipment and machines
necessary for operations and to to perform all specified production and
achieve conformity of products and service provision processes and
services. monitoring/measurement activities? Are the

equipment and machines adequate
(qualified/calibrated where appropriate)? Are
there sufficient qualified personnel to operate
these processes? Are buildings and facilities
in good repair and properly maintained (look
for leaking roofs, broken windows,
contamination, infestation, etc.)? Is there
sufficient space for office, production,
storage, and other operations and activities
(look for overcrowding, intermingling, cross-
contamination, etc.)? Is organization and
housekeeping of storage and work areas
satisfactory? Are supporting services
(communication, transportation, etc.)
adequate?
Maintain infrastructure necessary for Is process equipment regularly maintained

operations and to achieve conformity and serviced? Are there maintenance plans
of products and services. and schedules? Are there maintenance
records?
7.1.4 Determine, provide and maintain the In work areas, are temperature, humidity,
work environment needed to achieve particulate levels (dust), noise and other such
conformity of products and services. environmental conditions compatible with the
type of product and processes? Is there
appropriate and adequate lighting at work
stations? Are there any training/awareness
programs aiming to ensuring suitable social
and psychological conditions in the
workplace.
7.1.5.1 Determine and provide resources Is it determined what monitoring and

(devices, equipment or services) for measuring shall be undertaken to verify
monitoring and measurement, when product conformity and what measuring
used for verifying the conformity of devices/equipment are needed (control
plans, work orders, inspection procedures,
products and services. drawings, etc.)?
Ensure that measuring devices and Are measuring devices selected on the basis
equipment are suitable for the of the monitoring/measurement requirements
specific measurements for which (accuracy, environmental conditions, etc.)?
they are used, and that they are Are operators/inspectors competent (trained)
in the use of measuring devices? Are there
maintained. maintenance plans/schedules for measuring
equipment?
7.1.5.2 Ensure that measuring equipment Is there a list (inventory) of measuring

shall devices? Are all active devices calibrated
 be calibrated or verified against (those used for product verification)? Are
calibration certificates, or other records,
traceable measurement standards,
established and maintained? Is traceability to
 be adjusted or re-adjusted as national or international standards recorded?
necessary, Is calibration (adjustment) frequency
 be identified (also with calibration defined? Is it followed? Are measuring
status), devices identified (unique serial numbers)?
 be safeguarded from improper Are measuring devices identified with
adjustments, and calibration stickers? How are devices
safeguarded from unauthorized adjustments?
 be protected form damage and Are measuring devices adequately protected
deterioration. during handling, maintenance and storage?
Maintain calibration records.
Assess the validity of the previous What is done when a nonconforming
measuring results when the measuring device is found? Is there an
equipment is found to be investigation to establish whether acceptance
nonconforming (damaged, out of of any product is affected? Are results of
such investigation recorded (CAPAs)? Are
calibration, etc.). Take appropriate corrective actions taken on the equipment
action on the equipment and any and any product affected (CAPAs)?
product affected.
Validate computer software used in Is computer software used in any monitoring
the monitoring and measurement of and measurement? Is it in-house developed
specified requirements. software? Can the software be changed or
updated? Is the software validated? Are
validation reports available?
7.1.6 Determine, acquire, maintain and How is it determined when and what kind of
preserve knowledge necessary for new organizational knowledge is needed
operations and to achieve conformity (design reviews, management reviews,
of products and services, planning of changes, CAPA investigations,
marketing reports, etc.) How is organizational
knowledge maintained and preserved?
(document control and distribution, training)
QSP 072 Competence

7.2 Determine the necessary Are there defined competence (education,

competence requirements for training, skills and/or experience)
personnel requirements for jobs and positions that can
affect conformity of products and
services? Are there job/position
descriptions and/or specifications for
education/training requirements for key
positions?
Ensure that personnel are Is there a deliberate process to verify that
competent and, when applicable, personnel assigned to specific jobs/positions
provide training to satisfy satisfy the competence requirements for that
competency requirements and job? Are new employees formally trained for
new jobs/positions? How? Is this training
evaluate the effectiveness of recorded?
training.
After completion of training, how is the
effectiveness of the training evaluated?
(tests, formal evaluations, certifications,
performance monitoring, etc.)
Maintain training and competency Are competence (education, training, skills

records. and/or experience) records maintained for
each employee? Where, how and by whom
are these records maintained? How do
managers/supervisors responsible for
assignment of work activities know who is
competent to perform a particular job
(training matrix)?
QSP 073 Awareness

7.3 Ensure that personnel are aware of Are there any formal training programs to
the quality policy and quality advance employee awareness related to the
objectives, how they contribute to QMS? (ISO 9001 training) Are employees
the effectiveness of the QMS, and aware of and understand the quality policy?
Are they aware of the quality objectives
the implications of not conforming relevant to their jobs/positions and do they
with the QMS requirements. know, specifically, how they can contribute to
reaching these objectives? Are employees
aware of specific consequences of product
deficiencies and failures (safety,
environmental, customer dissatisfaction,
etc.)?
QSP 074 Communication

7.4 Determine the internal and external How is it known in the company what and
communications relevant to the when will be communicated, who is
QMS, including what and when will responsible for communicating, and who are
be communicated, who is the recipients?
responsible for communicating, and Are QMS policies and objectives, product
who are the recipients. quality requirements (specifications), quality
system effectiveness/performance data and
results, product quality data, etc., adequately
communicated?
What specific processes (methods) are used
to communicate this information and data
(QMS documentation, regularly scheduled
review meetings, bulletin boards/newsletters,
training, etc.)? Are these processes fully
implemented and are they regularly
maintained and used? Are there procedures
or instructions defining these communication
processes?
Are there communication processes for
employees to report product/system quality
problems, and to suggest improvements to
the quality system?
QSP 075 Documented information

7.5.1 Establish documented information Is there a quality manual, or other documents
required by the ISOI 9001 standard, defining the scope of the QMS, quality policy
and documented information and quality objectives?
necessary for the effectiveness of Is there a quality manual? Operational
the QMS, to include: procedures?
 scope of the QMS and exclusions How are processes and requirements of the
 quality policy and quality objectives QMS defined and communicated? (process
 process procedures, operational procedures, operational procedures,
procedures, work instructions, work instructions, training materials) Are
training materials these processes and requirements
 drawings, specifications, methods
and other documents defining documented?

products and services Are drawings, specifications, methods
and other documents defining products
and services issued and maintained as
controlled documents?
7.5.2 When creating and updating Are documents uniquely identified (unique
documents, ensure that documents title and /or code-number) and are they
are: legible?
 uniquely identified, Are documents approved before issue? How
 reviewed and approved for is the approval evidenced (signature)? Is
suitability and adequacy there a process for reviewing, updating and
re-approving documents? Are documents
 created in appropriate format and
identified with their revision level? How are
media changes identified (change brief, highlighted,
etc.?)
Are documents created in appropriate format
and language, so that they can be readily
accessed, and be understood by the people
who use them?
7.5.3 Control documented information to What measures are implemented to ensure

ensure that: that relevant and current documents are
 it is available for use where and available at points of use (distribution lists,
current master lists, etc.)? When obsolete
when is needed,
documents are retained, is it for a specific,
 it is adequately protected form stated reason? Are obsolete documents
loss, deterioration, confidentiality, clearly marked to distinguish them from
improper use, etc.). current revisions? What other measures are
implemented to prevent unintended use of
obsolete documents?
Are documents stored in dry, clean locations
to protect them from deterioration? Are
electronic documents (computer files)
regularly backed up? How are electronic
documents protected against
unintended/unauthorized alteration?
Define processes and activities Are there procedures and/or instructions for
related to the control of documents, control of documents?
to include:
 distribution, access, retrieval and

use of documents
 storage and preservation
 control of changes
 retention and disposition
Identify and control documents of Is there a process for receiving, reviewing,
external origin approving (for use) and distributing
documents of external origin (form
customers, regulators, suppliers, etc.)
Establish and maintain records to How is it determined and communicated

provide evidence of conformity of which QMS records are maintained by the
products and services, and the QMS company? (procedures, work instructions,
work orders, technical documentation, etc.)
Are the records sufficient to demonstrate
Protect records against loss, product, service and process conformity, and
deterioration, and from unintended the conformity and effectiveness of the
and unauthorized alteration. QMS?
Is there a procedure for the control of
records? Does it address the identification,
storage, protection and retrieval of records?
Are retention times and storage locations
defined for all types of records?
Are records stored in dry, clean locations to
protect them from deterioration? Are
electronic records backed up? How are
electronic records protected against
unintended/unauthorized alteration?
Are records readily retrievable (test by asking
for retrieval of specific records)?
QSP 081 Production/service provision and quality planning

8.1 Determine quality and other Are quality requirements (tolerances, surface
requirements for products and finish, workmanship standards, etc.) for the
services. product defined? How are they documented
(drawings, specifications, samples, etc.) and
communicated (instructions, samples,
Establish acceptance criteria for training, etc.)?
products and services. Are requirements for product inspection and

testing defined and documented for all stages
of product realization (receiving of purchased
products, in-process and final product
release)? Are inspection/testing methods and
procedures defined and documented? Are
acceptance criteria defined/documented?
How is the quality plan for a product
communicated to production and QC
personnel (work order, procedures,
checklists, etc.)?
Establish criteria for production and Are production processes validated or tested
service provision processes. (refer also to PRP 05 ISO 7.5.2)? Who
selects production equipment, and how? Are
Provide resources (human, operators trained? Are there adequate work
instructions?
equipment, machines, etc) for the Select a sample of processes and ask how
process. they were developed and validated/tested;
and review the associated documentation
Implement control of the processes (performance/validation test results, work
in accordance with the criteria. instructions, operator qualification
requirements, setup verification records,
etc.).
Determine records needed to Is each specified inspection, test and

provide evidence that production monitoring activity recorded? Is the scope
and service provision processes, and format of records defined (work orders,
and resulting products and services tags/tickets, forms, electronic data collection
systems, etc.)?
meet specified requirements.
Control changes and review the How are requests for process changes
consequences of changes. documented and evaluated? Who reviews
and approves requests for process changes?
Is the effect of change considered ?
Ensure that outsourced processes Are process requirements and requirements

are likewise controlled. for process control/monitoring clearly
specified for outsourced processes? Are
these requirements included in purchase
orders or contracts?
QSP 082 Sales, contracting and customer communication

8.2.1 Determine and implement Are processes for communicating with
arrangements for customers adequately defined, to include
 communicating product policies, assignment of authorities and
responsibilities, and methods (procedures,
information,
instructions, training)? Are these processes
 handling enquiries, RFQs, consistently implemented?
contracts, orders and change Verify that product brochures/specifications
orders and other product information (including the
internet site) are current.
Determine and implement effective Is there a system for receiving customer

arrangements for communicating feedback and complaints (logs, complaint
with customers regarding customer files, etc.)? Are responsibilities for handling
feedback and customer complaints. customer complaints assigned? Is there a
linkage with the corrective/preventive action
system?
Communicate with customers is this requirement relevant, i. e., does the

regarding company ever receive any customer
 handling and controlling customer product? (templates, gauges, returnable
packaging, intellectual property). If so, look
property
for identification showing that the product
 requirements for contingency belongs to customer. Investigate whether
actions (when relevant) there were any events of loss, damage, or
unsuitability of customer property and
whether this was promptly reported back to
the customer.
8.2.2 Determine product requirements, to How are customer requirements determined

include requirements and communicated? Are they documented?
 specified by the customer Who processes this information and how is it
done? Are there written
(including delivery and post-
procedures/instructions and/or training?
delivery);
 not stated by the customer, but Are there any requirements that are not
stated by the customer but are necessary?
necessary for specified or intended
Are there any regulatory requirements? Who
use; determines, and how, what these additional
 statutory and regulatory requirements are? Are they documented?
requirements related to the How?
product; and
Check a sample of orders to verify that
 any additional requirements procedures, instructions and/or training are
considered necessary by the being followed. Interview employees and
company. review customer complaints to find out

whether there is history of order requirements
Ensure that claims for products and that were misunderstood and/or incomplete.
services can be met.
8.2.3 Prior to the commitment to supply How are customer requirements reviewed,
products and services, review and by whom? Are there written procedures,
requirements related to the offered instructions, checklists, and/or training. Are
products and services to ensure that there records demonstrating that the required
reviews are being conducted for every order?
 requirements are defined,
 any discrepancies and ambiguities Check a sample of orders to verify that
procedures, instructions and/or training are
are resolved, and
being followed. Interview employees and
 company is able to meet the review customer complaints and on-time
requirements. delivery records to find out any cases of
orders that were shipped late due to lack of
Maintain review records. adequate capacity to fulfill these orders.
Where customer requirements are Is it permissible to take and accept verbal

not documented (not communicated orders? If so, are these orders confirmed?
in writing), confirm the requirements How are such orders confirmed?
before accepting the order. Ask for records (copies) of the confirmations.
Interview personnel to find out whether they
were consistently trained/instructed to
confirm verbal orders.
8.2.4 When changing or amending orders, How are change orders processed? Is there
ensure that relevant documents are a system for amending documents? Are
amended and that changes are there written instructions, procedures and/or
communicated to relevant training? How is information about order
changes communicated to relevant
personnel. departments/personnel within the company?
Review a sample of change orders to verify
that procedures, instructions and/or training
are being followed. See if you can uncover
any past problems caused by mishandling of
change orders.
QSP 083 Design and development of products and services

8.3.2 Plan design and development Are design stages/activities identified? Are
stages and controls, considering: review, verification and validation activities
 required design process stages identified? Are responsibilities/authorities for

 the review, verification and each activity assigned? Are documentation
requirements defined? (drawing schedule or
validation activities appropriate to
list)
each stage
 resource needs and assignment of Verify that there is a design project schedule,
responsibilities and authorities or at least due dates for completion of major
design phases; and that it includes design
 the need to control interfaces reviews and design verification/validation
between design functions and activities.
groups
 involvement of customers and
users
 requirements for subsequent
realization of the design
(production of service provision)
 the level of control by customers
and other interested parties
 documentation requirements
8.3.3 Determine and document design How is design input documented (design
and development inputs, project book, kickoff sheet, etc.)? Is there
considering: evidence that statutory and regulatory
requirements are included, and that potential
 functional and performance
consequences of failure are considered?
requirements Who is responsible for reviewing the input?
 information from previous similar How is the review documented/recorded?
designs How are changes and/or introduction of
 statutory, regulatory and other additional inputs handled?
applicable requirements
 potential consequences of failure.
Resolve conflicting inputs.

8.3.4 Perform systematic design reviews How many design reviews are planned for
to evaluate whether the design is on the design project? What is the role of these
track toward meeting input reviews? Who participates? Are there
requirements, and to identify any records of the reviews? Are there records
demonstrating that the resulting actions are
problems and propose necessary implemented and their effectiveness verified?
actions. Maintain records of the
reviews and the resulting actions.
Carry out design verification to What specific actions are taken to verify that
ensure that design outputs have met design outputs meet the design input
the design input requirements. requirements? Is this a systematic review?
Maintain records of the verification Are all design inputs considered? Are the
results and any related actions. actual verification results (calculations, data,
etc.) included in the record?
Prior to delivery or implementation of How is the design validated? Is a prototype

the product, perform design built and tested? Is the first article tested? Is
validation to ensure that the resulting the design based on a similar proven design?
product is capable of meeting the Are validation records maintained? Are the
actual validation results (test data) included
requirements for the specified in the record?
application or intended use. Maintain
records of the validation results and
any related actions.
8.3.5 Ensure that the design output Is there a systematic review to verify that
 meets design input requirements, design output meets design input
requirements (last design review meeting)? Is
 provides necessary information for
information for purchasing, such as material
development of production or specs, parts lists, etc. included? Are there
service provision processes, and clear specifications, drawings and
for purchasing, instructions for production? Are there
 contains acceptance criteria, and acceptance criteria for inspection and testing
 specifies product characteristics of product? Where applicable, are safety and
that are essential for its safe and operation/use features considered in the
proper use. design and included in the design output?
Document design output and Is design output documented? How? Are the
approve the design output prior to documents reviewed and approved prior to
release. release and by whom? How are preliminary
documents distinguished from the final
released documents?
Verify that design output documents
forwarded to production, subcontractors or
other consultants are clearly identified as
final or preliminary.
8.3.6 Review, verify, validate, as How are requests for design changes
appropriate, and approve design documented and processed? Who reviews
changes before implementation. and approves requests for design changes?
Evaluate the effect of the changes Is the effect of change on the overall product
considered (ask for specific examples)? Who
on constituent parts and on product decides, and how, what reviews, verifications
already delivered. Maintain records and validations need to be done for a design
of changes and of their change? Are results of reviews, verifications

reviews/evaluations and any and validations included in design change
necessary actions. records?
QSP 084 Purchasing and subcontractor control

8.4.1 Control suppliers and the purchased How are suppliers controlled: initial selection
products and services to ensure that evaluations, ongoing monitoring, audits of
outsourced processes and the supplier’s QMS and/or manufacturing
supplied products and services processes, requests for corrective actions?
How is purchased product controlled: review
conforms to specified requirements. of quality records (SPC charts, inspection
reports, lab test results, etc.), receiving
inspection? Who makes these decisions?
Evaluate and select suppliers based Are suppliers evaluated and reviewed before
on their ability to supply products they are approved? What are the scope,
conforming to specified extent and criteria for evaluating and
requirements. approving suppliers? Who decides? How is
the approval documented (an approved
vendor list)? Are there records of initial
Establish evaluation, selection, supplier evaluations?
performance monitoring, and re- Select randomly and review a sample of
evaluation criteria. supplier evaluation and monitoring files. Is
their approval status clearly authorized? Is
Maintain records or supplier their performance consistently monitored? In
evaluations and related actions. the event of nonconforming deliveries, are
they required to implement corrective
actions? Is there a follow up?
8.4.2  Ensure that externally provided What is being done to ensure purchased
processes remain within the product conformity: Supplier’s QMS
control of the QMS certification? Audits of supplier's QMS?
Certificates or inspection reports from
 Define controls to be applied to the supplier or independent labs? Supplier's
external providers and to the process SPC records, Cpk or Ppk
resulting output (the supplied requirements? Containment and receiving
processes, products and services) inspection?
 Determine verification or other Select a sample of purchased product
activities to ensure that supplied categories and investigate for each what
processes, products and services activities or arrangements are planned to
meet requirements. ensure their conformity, how this plan is
documented and communicated, and

In determining the extent of controls whether it is consistently implemented.
consider impacts (risks) of potential
nonconformity and the effectiveness
of controls already applied by the
supplier.
8.4.3 In purchasing specifications include, Where appropriate, are there requirements
where appropriate for certificates, inspection reports, SPC data,
 requirements for approval of approval of samples, etc. included in
purchasing documents? Are there any
products, processes, equipment,
requirements/criteria for release of products
methods and criteria for release of and services? Are there any requirements
products and services with regard to supplier’s quality management
 requirements for competence and system?
qualification of personnel Review a sample of purchase orders,
 communication requirements and especially those where the product is
methods expected to come with certificates.
 controls and monitoring to be
Are audits or inspections to be performed at
applied the supplier's premises? If so, review a
 verification and validation activities sample of purchase orders or contracts to
to be performed at the supplier's ascertain that such activities are defined in
premises. the purchasing documents.
Ensure adequacy of purchasing How is adequacy of purchasing documents

specifications before they are ensured? Are the documents reviewed
forwarded to suppliers. before release? Are there standard, pre-
approved, specifications in the system? What
other methods are used?
See if you can uncover any past problems
caused by errors or omissions in purchasing
documents.
QSP 085 Production and service provision

8.5.1.a) Ensure the availability of documents Are adequate product specifications
defining the characteristics of (drawings, parts lists, math data, standards,
products and services to be samples, etc.) available to production
produced or provided. personnel? Are the specifications approved
and are they current?
Interview production personnel and ask how
they know what to make and what the
requirements are for workmanship standards

(appearance, precision, surface quality, color,
etc.).
8.5.1.b) Ensure the availability of measuring Is there a system for controlling the inventory
8.5.1.c) devices and the implementation of of measuring/monitoring devices (a list with
monitoring and measurement identification, location, calibration status)? Is
activities. the inventory of measuring devices adequate
to meet requirements of the
monitoring/measurement program
(inspections, tests, SPS, etc.)?
Are processes monitored? How? (SPC, tool
ware, etc). Are process outputs inspected or
otherwise verified? (first article inspection, in-
process inspections, etc.) How are process
monitoring and process output verification
defined? (work orders, quality plans, etc.).
Are monitoring and measurement records
established and maintained?
8.5.1.d) Ensure the use of suitable Who selects/specifies production equipment

equipment, machines and and tooling? Is equipment/tooling tested
environment for operation of before it is used in production? Is tool wear
processes. monitored, and how? Are equipment checks
and/or tool change intervals defined? Is the
physical environment (temperature, humidity,
etc.) suitable to operation of processes?
8.5.1.e) Appoint competent persons and Are there specified competency requirements
ensure the availability of work for operating processes? Are process
instructions, as necessary. operators assigned based on meeting the
competency requirements for the process?
How is it known who is competent too
operate specific processes?
Are there adequate instructions for operating
machines and processes? Who decides and
how (criteria) whether work instructions shall
be established for a given process/work
station? Are process parameters
(temperature, pressure, speed, etc.) defined?
Ask operators what should the settings be for
various parameters in their processes, and
how they know this? What are the lower and
upper limits for the parameters? What should
they do, and how, when a parameter

(temperature, for example) goes over limit?
8.5.1.f) Validate processes where the Who is responsible for identifying processes
resulting output cannot be verified by requiring validation? How is it determined
subsequent monitoring or what controls, validations and arrangements
measurement. Establish shall be required for each such process
(criteria for review and approval)? Are
arrangements for these processes process validation results recorded? Are
including, as applicable processes revalidated (where appropriate)?
 criteria for their review and Select a sample of processes that require
approval, validation and investigate how these
 approval of equipment and processes were validated, and whether this
qualification of personnel, complies with requirements.
 use of specific methods and
procedures,
 requirements for records, and
 revalidation.
8.5.1.g) Implement actions to prevent human How is it determined where prevention of
error. human error is needed? (risk analysis,
CAPAs) Are there any arrangements, setups
or equipment aiming to prevent human error?
(automation, use of templates, alarms, etc.).
8.5.1.h) Ensure the implementation of Are there defined responsibilities for these
release, delivery and post-delivery activities? How are requirements
activities. documented (procedures, work orders,
installation/servicing requisitions, etc.)?
Are delivery-related activities (processing of
shipping orders, packaging, dispatch,
delivery, installation, etc.) defined in
procedures, work instructions, training, etc.?
Are appropriate records maintained?
8.5.2 Identify outputs and their acceptance Are materials and products used in
(inspection) status. production uniquely identified while in
storage, in staging areas, at work stations,
etc? Is the acceptance status identified?
Verify that for any product (material) in
production areas it is evident what the
product is and whether it passed inspection
(test) and can be moved to the next
processing stage or be dispatched to
customer (or finished goods warehouse).
Where traceability is a requirement, How is it determined what products

control and record the unique (materials) require traceability (customer
identification of the outputs. requirements, regulatory requirements,
internal engineering or QA requirements,
etc.)? How are traceability requirements for
specific products documented? Where
required, how is traceability recorded?
Review a sample of production records and
verify the integrity of the traceability system.
Verify that rework operations (diluting,
mixing, reprocessing, etc.) do not
compromise the integrity of the traceability
system.
8.5.3 Identify, verify, protect and Is this relevant? If so, look for identification
safeguard customer and supplier showing that the product belongs to customer
property provided for use or or supplier. Investigate whether there were
incorporation into the product; and any events of loss, damage, or unsuitability
of customer property and whether this was
report to customers or suppliers any promptly reported back to the owner.
event of loss, damage or Are there any requirements/procedures for
unsuitability of their property. handling confidential intellectual property that
belongs to customers or suppliers?
8.5.4 Protect and preserve the conformity In warehouses, storage and staging areas:
of product in storage and during Are there designated areas for storage of
delivery to the intended destination. particular products? Are products kept in
boxes, bags, bins or other protective
packaging? Are there products that require
special storage conditions (temperature,
humidity, cleanliness, etc)? How are these
conditions ensured? Are they recorded? Are
there products with limited shelf life? How is
such product managed? Is there an effective
first-in-first-out system? Are stacking
limitations defined? Are they observed? Is
there a risk of cross-contamination? How is it
managed? Is there an inventory management
system? Is it kept current?
Look for misplaced product, product taken
out of packaging, unused product returned to
storage, product returned by customers,
product intermingled with other unrelated
product, etc. Test the accuracy of the

inventory management system. Always keep
an eye on damaged and deteriorated
product.
Are there documented packaging
specifications? Are packaging materials and
processes controlled?
Investigate if customer complaints (or other
evidence) indicate that there were instances
of product damage/deterioration due to
inadequate or defective product
packaging/protection.
Go to purchasing and the packaging material
storage areas and check that only the
specified packaging materials are being
purchased and used.
8.5.5 Determine the extent of required Are there any post-delivery activities
post-delivery activities, considering: specified? Have safety and other risks been
 statutory and regulatory considered, and how they could be
potentially mitigated in the post-delivery
requirements
phase?
 the potential undesired Has there been any consideration of the
consequences (risks) associated environmental impacts of the product while in
with products and services use and/or at the end of its useful life. If
 the nature, use and life cycle of relevant, have a recycling program been
products and services considered, for example?
 customer requirements and
customer feedback
8.5.6 Review control and authorize How are requests for process changes
process changes. documented and processed? Who reviews
and authorizes process changes? Is the
Maintain records of changes, effect of change on other processes and/or
product considered (ask for specific
reviews and authorizations, and any examples)? Who decides, and how, what
related actions. tests and validations need to be done to
verify a process change? Are results of
reviews, verifications, validations and
authorizations maintained?
QSP 086 Release of products and services

8.6 Prevent the release of product until How is the finished product released? Who
all planned processing (production) verifies, and how, that all specified production
and verification activities have been and verification activities have been
completed. completed? How is the released product
identified (distinguished from product that has
not yet been released)? What measures are
implemented to ensure that product that has
not been formally released is not used or
shipped?
Ask personnel in inventory management and
shipping functions how do they know (and
verify) what is the release status for any
given product (batch).
Select a sample of production/QC records
(and/or product staged for shipping) and
verify that all product release activities were
carried out as planned.
Maintain records of the releases of Are there records of product releases? Do

products and services, to include: the records include, or refer to evidence of
 evidence of conformity conformity with acceptance criteria? Are
persons authorizing the release identified?
 identity of the person(s) authorizing
the release
QSP 087 Control of nonconforming outputs

8.7.1 Identify and control nonconforming Is there a procedure for identifying,
outputs (products) to prevent their controlling and dealing with nonconforming
unintended use or delivery. product? Is the identification (labels, tags,
etc.) firmly attached/affixed to the product or
its container? Are nonconforming products
segregated? Quarantined? How? Are there
arrangements to identify/segregate
nonconforming (purchased) product in
receiving areas? In production areas? In
inspection areas? In storage areas
(warehouses)? In shipping areas? Are
personnel trained in the uses of the
procedure in each relevant area?
Deal with nonconforming outputs by Are responsibilities assigned for making NC

 correcting the nonconformity product disposition decisions? Are these
(rework), decisions documented? How is this
documentation associated with the actual
 segregating, containing and product (control number, special stickers/tag,
suspending delivery, or copy of the NCR report attached to the
 informing the customer and product, etc.)? When accepting NC products,
obtaining authorization for how is it determined whether customer
acceptance under concession. concession is required or not? Who has the
authority to accept NC products under a
concession?
Verify the conformity of reworked or Are reworked or corrected products verified

corrected products. (re-inspected, re-tested, etc.) to their original
specification? Are the results recorded? Is
reworked product formally released for use or
delivery?
8.7.2 Maintain records of the Are there records describing the nature of
 nature of nonconformities nonconformities and actions taken? Are they
traceable to specific product batches or
 subsequent action taken
shipments? Are customer concessions
 concessions obtained included in the record? Is the authority
 the authority deciding the action deciding the disposition identified? How long
and disposition with respect to the are these records retained?
nonconformity
QSP 091 Monitoring, measurement, analysis and evaluation

9.1.1 Determine the monitoring and Is it determined what monitoring and
measurement to be undertaken, measuring shall be undertaken and what
including: methods and equipment shall be used
(control plans, work orders, inspection
 what needs to be measured and
procedures, drawings, etc.)?
monitored, and when
 methods for monitoring and Are results of monitoring and measurement
recorded?
measurement
 when results shall be analyzed and
evaluated
Evaluate the performance and How is the performance and effectiveness of
effectiveness of the QMS the QMS monitored and measured? (internal
audits, collecting of quality performance
data). How is the performance evaluated?

(management review, analysis of quality
performance data and trends).
9.1.2 Monitor information relating to What type of information is used to determine

customer satisfaction. Determine customer satisfaction (feedback, surveys,
methods for obtaining and using this interviews, etc.)? How is this information
information. obtained? How often? How is this information
processed and used (for example, statistical
analysis reported to management review)?
9.1.3 Analyze data arising from monitoring What specific data are analyzed to meet
and measurement, to evaluate: requirements of this clause? Are data on
 conformity of products and product nonconformity rates collected and
analyzed? How are data on customer
services
satisfaction analyzed? Are there data on
 customer satisfaction trends of characteristics of processes and
 performance and effectiveness of products (e.g., on how these characteristics
the QMS vary within the specified tolerance)? Is the
 implementation of planned effectiveness of risk reduction actions
arrangements evaluated? What specific supplier
performance data are being systematically
 effectiveness of risk reduction
collected (on-time delivery, nonconformity
actions rates, etc.)?
 performance of external providers Is it determined how the data is to be
 the needs for improvements to the analyzed and by whom? How are results
QMS reported and used?
QSP 92 Internal Audit

9.2.1 Plan and conduct internal audits to Are internal audits carried out at planned
determine whether the quality intervals? Are all relevant processes and
management system conforms to areas covered by the audits?
requirements (ISO 9001 , internal
requirements); and whether it is
effectively implemented and
maintained.
9.2.2 Establish, implement and maintain Is there a written procedure for internal
an audit program, including: auditing?
schedules, methods, responsibilities, Are there documented audit plans and
and reporting requirements. schedules? Are importance, changes and
past compliance history considered when

Schedule audits based on the planning audits (increased audit frequency
importance, changes and past for important and/or problematic
performance history of processes processes/areas)?
How are audit criteria and scope documented
For each audit, define audit criteria (standard, checklists, etc.)?
and scope; and ensure objectivity Are auditors impartial and independent from
and impartiality of auditors. the process being audited? Are auditors
competent (trained)?
Are there any records of what specific
evidence was reviewed (usually auditor notes
on checklists)?
Take appropriate corrective actions Are nonconformities (audit findings)

to address audit findings. documented? How?
Is there a process for requesting,
implementing and evaluating corrective
actions to address audit findings? Are there
records of the corrective actions?
Report results of internal audits to Are results of internal audits reported to

management. management? how and how often?
(management review).
QSP 093 Management Review

9.3.1 Periodically review the quality How often are management reviews
management system to ensure its conducted? Who participates? Is there an
continuing suitability, adequacy and agenda prepared for each review? How are
effectiveness. the reviews recorded (minutes of meetings)?
9.3.2 The input into management reviews Are all required inputs provided for each
shall take into consideration: review? Are there records specifically
 status of actions from previous demonstrating that each input was provided
and considered?
reviews
 changes Have all actions from the preceding review
 customer satisfaction and been closed out? What happens to actions
that have not been fully completed?
feedback
 quality objectives How, for example, are opportunities for
 process performance and product improvement input into the review? Who is
conformity, responsible for this input? How are the
opportunities for improvement considered?
 nonconformities and corrective
Who decides which opportunities will be
actions implemented?
 results of monitoring and
measurement
 results of audits
 performance of external providers
(suppliers)
 adequacy of resources
 effectiveness of risk reduction
actions
 opportunities for improvement.
9.3.3 The output from management In the last two management reviews, what
reviews shall include decisions and specific decisions and actions related to
actions related to: improvement were taken? How were they
implemented?
 improvement,
 changes to the QMS Does the record show that management
 resource needs. reviews include decisions related to changes
to the QMS?
Were there any special resources provided to
implement the improvements or changes?
10 Improvement
10.1 Determine and select opportunities Are there specific examples of recent
for improvement, to include: improvements to products and services?
 improvement of products and Is the risk evaluation process actively used to
services identify risks and to implement actions to
 preventing or reducing undesired reduce risks?
effects What have been done recently to improve the
 improving the QMS QMS?
10.21 Take actions to control and correct Is there a process for initiating, investigating,
nonconformities (including any implementing and evaluating the
arising from complaints) and to deal effectiveness of corrective actions. Is this
with their consequences. process documented in a procedure?
Are there recent examples of corrective

actions taken arising from customer
complaints?
How many corrective actions have been
initiated through the period? How many are
open? How long have they been open? Are
there due dates?
Evaluate the need for actions to Are root causes of nonconformites

eliminate causes of nonconformities. determined? Is every corrective action
evaluated for the need to eliminate root
causes? Are the results of this evaluation
documented
Implement corrective actions and Is implementation of corrective actions

review their effectiveness. documented? Is it verified? Are corrective
actions implemented in a timely manner? Are
Ensure that corrective actions are there due dates for implementing corrective
actions?
appropriate to the effects of the
nonconformities.
Evaluate the need to update risks Does evaluation of nonconformities include
and opportunities and make consideration whether there are other related
changes to the QMS. activities or processes that are at risk of a
similar nonconformity?
Are there examples of risk analysis projects
related to a nonconformity and associated
corrective actions?
10.2.2 Maintain records on the nature of Are all nonconformities recorded? Do the
nonconformites, any subsequent records include description of the nature of
action taken, and results of the nonconformity? Are subsequent actions
corrective actions. and their results recorded? Are these records
readily retrievable?
10.3 Continually improve the suitability, Are results of the analysis of quality
adequacy and effectiveness of the performance data used in identifying the
QMS. needs and opportunities for improvement?
Are management review outputs identifying
the needs and opportunities for
improvement?
What are the most recent examples of
improvements made to the QMS?

QPPF 092 1 - InternalAuditChecklis

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

QPPF 092 1 - InternalAuditChecklis

Uploaded by

Copyright:

Available Formats

ISO 9001 INTERNAL AUDIT CHECKLIST

Issued by: Quality Assurance Date: 00-00-00 Revision: A QF-092-1

PROCESS MAP DIAGRAM

Quality System Processes

QSP 041 Context and interested parties

4.2 Determine interested parties Are interested parties determined? Who

QSP 042 Quality management system processes

NOTE: most of these questions can only be

QSP 051 Leadership and Commitment

QSP 052 Quality policy

QSP 053 Organizational roles, responsibilities and authorities

 ensuring that QMS conforms to and responsibilities assigned and

QSP 061 Risks and opportunities

Evaluate the effectiveness of risk Is the effectiveness of risk reduction actins

QSP 062 Quality objectives

objectives updated? What is the mechanism

QSP 063 Planning of changes

QSP 071 Resources

services. monitoring/measurement activities? Are the

Maintain infrastructure necessary for Is process equipment regularly maintained

7.1.5.1 Determine and provide resources Is it determined what monitoring and

7.1.5.2 Ensure that measuring equipment Is there a list (inventory) of measuring

QSP 072 Competence

7.2 Determine the necessary Are there defined competence (education,

Maintain training and competency Are competence (education, training, skills

QSP 073 Awareness

QSP 074 Communication

QSP 075 Documented information

and other documents defining documented?

7.5.3 Control documented information to What measures are implemented to ensure

 distribution, access, retrieval and

Establish and maintain records to How is it determined and communicated

QSP 081 Production/service provision and quality planning

products and services. Are requirements for product inspection and

Determine records needed to Is each specified inspection, test and

Ensure that outsourced processes Are process requirements and requirements

QSP 082 Sales, contracting and customer communication

Determine and implement effective Is there a system for receiving customer

Communicate with customers is this requirement relevant, i. e., does the

8.2.2 Determine product requirements, to How are customer requirements determined

company. review customer complaints to find out

Where customer requirements are Is it permissible to take and accept verbal

QSP 083 Design and development of products and services

 required design process stages identified? Are responsibilities/authorities for

Resolve conflicting inputs.

Prior to delivery or implementation of How is the design validated? Is a prototype

of changes and of their change? Are results of reviews, verifications

QSP 084 Purchasing and subcontractor control

documented and communicated, and

Ensure adequacy of purchasing How is adequacy of purchasing documents

QSP 085 Production and service provision

requirements are for workmanship standards

8.5.1.d) Ensure the use of suitable Who selects/specifies production equipment

they do, and how, when a parameter

customer (or finished goods warehouse).

Where traceability is a requirement, How is it determined what products

product, etc. Test the accuracy of the

QSP 086 Release of products and services

Maintain records of the releases of Are there records of product releases? Do

QSP 087 Control of nonconforming outputs

Deal with nonconforming outputs by Are responsibilities assigned for making NC

Verify the conformity of reworked or Are reworked or corrected products verified