Most ISO 9001 audit checklists list the clauses of the standard with a checkbox next to each one. That is useful for a document review, but it is not how an audit runs on the shop floor. An auditor picks a part or a job, asks who made it, who measured it and with what, and follows that job through your records.
If you are already certified, you have a surveillance audit every year and a recertification audit every third year. In between, the standard expects you to run your own internal audit and management review. This checklist follows the order an auditor usually works through a shop, so you can check the same things before they do. You can also use it as the checklist for your ISO 9001 internal audit.
How auditors work
An audit is a sample of evidence. The auditor picks a job, usually a recent one, and traces it through your shop: quote, order review, traveler, material cert, setup, first article, in-process checks, final inspection and shipment. At each step they ask what your process says should happen, whether it happened, and where the record is. A finding is written when those three things do not match.
Records have to be created as the work is done. They cannot be put together the week before the audit.
The checklist
Order review. The auditor will ask for proof that someone reviewed the PO before you accepted it, including capability, material, tolerances and delivery date. They often pick an order with customer flow-down requirements, such as a 10-year record retention clause, and ask how that requirement reached the people doing the work.
- Signed or stamped order review on the traveler or job packet
- Customer requirements, including flow-downs, available to the people doing the work
Drawings and revisions. This is one of the most common areas for findings in small shops. The auditor takes the print from the machine and checks its revision against your master list and the customer's current revision.
- One controlled list of current revisions
- No uncontrolled printed copies in the shop
- Old revisions marked obsolete or removed
Material and traceability. The auditor pulls the material cert for the job and checks the heat or lot number against the traveler.
- Material certs on file and matched to jobs
- Heat or lot numbers recorded where traceability is required
- Outside processes such as heat treat, plating and outside inspection controlled as approved suppliers, with certs on file
Measurement and calibration. Calibration is the most common source of findings in machine shops. The auditor checks a gauge ID and asks for its calibration record. They will also ask what you did the last time a gauge was found out of tolerance. The standard requires you to review the parts measured with that gauge since its last good calibration, not only repair or replace the gauge.
- Every measuring device identified and on a calibration schedule
- Calibration records that trace to each specific device
- An out-of-tolerance procedure that includes reviewing affected product
- Personal gauges either included in the calibration system or marked for reference only
Inspection and release. The auditor will ask who approved the part to ship, what criteria they used and where the record is.
- First article inspection with actual measured values recorded
- Final inspection records that show the acceptance criteria, the gauges used and who released the part
- A defined rule for who can release product
Nonconforming parts. The auditor will look at how you handle rejected parts and whether they are kept separate from good product.
- Nonconforming parts tagged and segregated
- Disposition recorded: rework, use-as-is with customer approval, or scrap
- Repeat problems sent to corrective action
Training and competence. The standard does not require training certificates. It requires evidence that the people doing work that affects quality are competent to do it.
- A skills matrix or similar record for roles that affect quality
- Training records for new hires and for anyone moved to new equipment
The quality system. These items are usually reviewed in the office, and they show whether the system was maintained between audits.
- An internal audit that covered your processes on schedule, done by someone who did not audit their own work
- Internal audit findings closed out, with evidence
- Management review minutes that record decisions and actions
- Corrective actions with an actual root cause, not "operator error"
- Quality objectives with measured results
If you also hold API Q1, the auditor will spend more time on risk assessment, contingency planning, management of change and supplier evaluation. Q1 has more detailed requirements in those areas than ISO 9001.
Using this checklist for your ISO 9001 internal audit
ISO 9001 clause 9.2 requires you to run internal audits at planned intervals. The checklist above can be used as your ISO 9001 internal audit checklist. Pick two or three recent jobs, trace each one through the steps above, and record what you find.
- Plan which processes you will audit and when, so every process is covered within the audit cycle
- Have people audit areas they do not work in, so no one audits their own work
- Record each finding with the evidence you reviewed
- Assign corrective actions for the findings and track them until they are closed
- Bring the internal audit results to your management review
Most common findings
- Calibration gaps, especially out-of-tolerance handling and personal gauges
- Obsolete drawing revisions at the machine
- Inspection records with checkmarks instead of measured values
- Corrective actions that describe the problem but do not identify the cause
- Management review minutes with no decisions recorded
These findings usually come from missing records, not from bad work.
Keeping the system current between audits
Most of the items on this list depend on work done throughout the year: document control, corrective actions, calibration, the internal audit and management review. In a shop of 10 to 50 people, that work usually falls on one person who has other responsibilities, often the owner. When it falls behind, it gets done in a rush right before the audit.
The internal audit is the step most often rushed or skipped. It is also the step designed to find these problems before the registrar does. ISO 9001 requires internal auditors to be objective and not audit their own work, which is difficult when one or two people run the entire quality system.
Outsourced internal audits for small shops
Many small shops use an outsourced internal audit so the audit is done by someone independent of their team. We schedule and run your internal audit with an experienced auditor, help you close out the findings, and keep your documents, corrective actions and records current between audits. If you have a surveillance or recertification audit coming up, contact us to talk through your schedule. Learn more about our internal audit service or call (832) 905-1664.