Audit Process Checklist: A Practical Guide for ISO Internal & Certification Audits

What Is an Audit Process Checklist?

An audit process checklist is a structured guide used by auditors to ensure:

• Audit objectives are clearly defined

• Scope and criteria are documented

• Required evidence is reviewed

• Interviews are consistent

• Findings are objective and traceable

• Nonconformities are properly classified

• Reports are complete and defensible

• Corrective actions are followed through to verified closure

It follows the audit principles and phases described in ISO 19011, the international guideline for auditing management systems, and it aligns with best practices reinforced through ISO Internal Audit Services. It is essential for:

• Internal audits

• Supplier audits

• Certification audits

• Surveillance audits

• Regulatory inspections

Note that this guide covers management system audits (ISO and related frameworks). Financial statement audits follow different standards and checklists.

The checklist ensures you audit systematically — not randomly.

The Core Audit Process Checklist (Step-by-Step)

Below is a practical, field-tested structure used across ISO-based systems and certification readiness engagements.

1. Audit Planning Checklist

Before the audit begins, confirm:

Scope & Criteria

• Defined audit scope (locations, departments, processes)

• Applicable standard(s) identified (e.g., ISO 9001, ISO 14001, AS9100)

• Regulatory requirements identified

• Customer-specific requirements (if applicable)

• Risk-based prioritization completed

• Results of previous audits and open corrective actions reviewed

Audit Objectives

• Conformity assessment?

• Process effectiveness?

• Risk evaluation?

• Certification readiness (see ISO Audit Preparation Services)?

Logistics

• Audit schedule confirmed

• Auditees notified

• Required documentation requested in advance

• Audit team roles defined

• Independence and impartiality confirmed

• Audit checklist and sampling plan prepared for each process in scope

A poorly planned audit creates confusion and weak findings.

2. Document & Records Review Checklist

Before conducting interviews, review documented information:

• Management system scope

• Policies and objectives

• Process maps or procedures

• Risk assessments

• Internal audit records

• Management review records

• Corrective action logs

• Training and competence records

• Monitoring & measurement results

• Regulatory compliance records (if applicable)

If you are preparing for certification, this step directly supports readiness for an ISO 9001 Certification Audit or other external audits.

The goal: identify areas requiring deeper verification.

3. Opening Meeting Checklist

During the opening meeting, confirm:

• Audit scope and objectives

• Audit criteria

• Methodology (sampling approach)

• Communication protocol

• Confidentiality expectations

• Timing and reporting format

Keep it structured and professional. It sets the tone for the audit.

4. Process Audit Checklist (On-Site or Virtual)

For each process being audited, verify:

Process Control

• Defined inputs and outputs

• Assigned responsibilities

• Monitoring and measurement methods

• Documented information controlled

• Risks identified and managed

Implementation

• Procedures followed in practice

• Employees understand their roles

• Records are complete and traceable

• Controls are effective

Performance

• KPIs monitored

• Objectives tracked

• Trends analyzed

• Issues escalated appropriately

Always validate through:

• Interviews

• Observation

• Record sampling

Sampling

• Select samples across the full audit period, not just the most recent records

• Include different shifts, sites, product lines, or teams where they apply

• Increase sample size where risk is higher or earlier results were weak

• Record exactly what was sampled (record IDs, dates, people interviewed) so findings can be traced

Avoid auditing paperwork alone.

5. Evidence & Nonconformity Checklist

When identifying findings, confirm:

• Objective evidence collected

• Clause reference identified

• Requirement clearly stated

• Gap described factually

• No assumptions included

• Severity classified appropriately

Nonconformities should be:

• Clear

• Concise

• Defensible

• Traceable to evidence

A useful structure for every written finding is: the requirement, the evidence observed, and the gap between them. Classification terms vary by certification body, but most distinguish a major nonconformity (a requirement not met in a way that puts the system's effectiveness at risk, or a systemic breakdown), a minor nonconformity (an isolated lapse that does not undermine the system), and an observation or opportunity for improvement (no requirement breached). Use the definitions in your own audit procedure consistently.

If your organization struggles with defensible findings, structured support from experienced ISO consultants often improves audit maturity quickly.

6. Closing Meeting Checklist

Before concluding the audit:

• Summarize audit scope

• Present findings clearly

• Clarify classification (minor/major/observation)

• Confirm next steps

• Establish corrective action timeline

• Confirm report distribution plan

Never surprise leadership after the meeting.

7. Audit Report Checklist

The final report should include:

• Audit objectives

• Audit scope

• Audit criteria

• Audit team

• Summary of activities

• Positive practices (optional but valuable)

• Nonconformities with evidence

• Overall conclusion

• Recommendations (if allowed)

Reports must be objective and professional — not emotional or vague.

8. Corrective Action & Follow-Up Checklist

An audit is not finished when the report is issued. Most repeat findings trace back to weak follow-up. After the audit, confirm:

• Each nonconformity has an owner and a due date

• Containment or correction taken where needed

• Root cause identified, not just the symptom (see root cause analysis)

• Corrective action addresses the root cause and is proportionate to the risk

• Evidence of implementation collected

• Effectiveness verified after enough time has passed to show results

• Findings closed in the audit record and fed into management review

• Lessons learned used to update the audit program and checklist

For a step-by-step method that works across standards, see our guide to developing an ISO corrective action plan.

Sample Audit Checklist Format

A checklist works best as a working record, not a list of yes/no boxes. Each line of a usable audit checklist typically captures:

• Requirement or clause: the specific requirement being tested

• Audit question: an open question tied to how the process actually runs

• Where to look: the records, people, or activities to sample

• Evidence observed: what was actually reviewed or seen, with references

• Result: conforms, nonconformity (major/minor), or observation

• Finding reference: a link to the written finding and its corrective action

For example, for a training and competence requirement, the audit question might be "How do you confirm that a new operator is competent before working unsupervised?", followed by sampling recent hires' training records against the competence criteria for their role.

If you need a clause-level starting point for quality systems, our ISO 9001 internal audit checklist shows how these fields apply to specific ISO 9001 requirements.

Audit Process Checklist for Specific Standards

While the audit structure remains consistent, emphasis varies by framework.

ISO 9001 – Quality Management Systems

Focus areas:

• Customer satisfaction

• Risk-based thinking

• Process performance

• Supplier controls

• Corrective action effectiveness

For detailed clause-level preparation, see ISO 9001 Requirements Checklist. For an overview of how the standard is structured, see our guide to the ISO 9001 quality management system.

ISO 14001 – Environmental Management

Audit emphasis:

• Environmental aspects & impacts

• Compliance obligations

• Operational controls

• Emergency preparedness

• Monitoring environmental performance

Certification readiness often aligns with ISO 14001 Certification Consulting.

ISO 45001 – Occupational Health & Safety

Audit emphasis:

• Hazard identification and risk assessment

• Worker consultation and participation

• Legal and other requirements

• Operational controls and management of change

• Incident investigation and emergency preparedness

Organizations building or certifying a safety management system often work with an ISO 45001 consultant.

ISO 27001 – Information Security

Audit emphasis:

• Risk assessment methodology

• Risk treatment plan

• Access control

• Incident management

• Statement of Applicability

Security-focused organizations often combine this with IT Security Audit Service support, and with ISO 27001 certification consulting when preparing for the certification audit.

AS9100 – Aerospace QMS

Audit emphasis:

• Configuration management

• Risk management

• Flowdown requirements

• Product safety

• Counterfeit parts prevention

Preparation for aerospace certification often requires structured planning under AS9100 Certification Process guidance, with support from an AS9100 certification consultant.

ISO 13485 – Medical Devices

Audit emphasis:

• Regulatory compliance

• Risk management integration (ISO 14971)

• Device master records

• Validation activities

• Complaint handling

Medical device manufacturers preparing for regulatory alignment frequently coordinate audits through ISO 13485 consultant services alongside FDA QMSR Consultant support.

Common Audit Checklist Mistakes

Organizations often:

• Turn the checklist into a clause-by-clause interrogation

• Ignore risk and focus only on documentation

• Fail to validate actual implementation

• Overlook effectiveness

• Copy generic checklists that do not reflect real operations

• Fail to follow up on corrective actions

An audit checklist should guide thinking — not replace it.

Internal Audit vs Certification Audit Checklist Differences

Internal Audit

• Improvement-focused

• More flexible sampling

• Deep process review

• Root cause emphasis

Often supported by structured ISO Internal Audit Services. For a broader view of how internal audit programs are planned and run, see our internal audit overview.

Certification Audit

• Conformity-focused

• Formal evidence requirements

• Defined audit stages (Stage 1 / Stage 2)

• Strict nonconformity grading

Preparation matters — particularly before a first-time ISO 9001 Certification Audit.

Surveillance and Recertification Audits

After certification, the certification body returns for periodic surveillance audits and a full recertification audit at the end of each certificate cycle. Surveillance audits sample part of the system each visit, so your checklist should confirm:

• Findings from the previous audit are closed and effective

• Internal audits and management reviews were completed as planned

• Changes to scope, processes, sites, or key personnel are documented

• Use of the certification mark and certificate follows the certification body's rules

Organizations that want a second set of eyes before these visits often use ISO surveillance audit support.

Integrated Management System Audit Checklists

If you operate multiple standards (ISO 9001 + ISO 14001 + ISO 45001 + ISO 27001), your audit process checklist should:

• Use a unified risk-based structure

• Audit shared processes (training, document control, corrective action)

• Avoid duplicative interviews

• Maintain a single reporting format

Organizations managing multi-standard environments often engage integrated management system consulting to streamline audit efficiency.

How to Build Your Own Audit Process Checklist

A practical method:

1. Define scope and standards

2. Map your processes

3. Identify risk-based priority areas

4. Align checklist questions to real process flows

5. Build evidence capture fields

6. Include follow-up tracking for corrective action

7. Keep it usable (not 200 pages long)

The best checklist is one auditors actually use.

Why a Structured Audit Process Checklist Matters

A strong audit process checklist:

• Improves audit consistency

• Reduces auditor bias

• Strengthens defensibility

• Improves corrective action quality

• Supports certification success

• Enhances leadership confidence

• Builds audit maturity over time

Audits should not feel chaotic. They should feel structured, objective, and professional.

Audit Process Checklist Questions

What are the main steps in an audit process checklist?

Most management system audits follow the same sequence: planning, document and records review, the opening meeting, process auditing, evaluating evidence and findings, the closing meeting, reporting, and corrective action follow-up. ISO 19011 describes this same overall flow for management system audits. The checklist content changes by standard, but the sequence does not.

Can we use the same checklist for internal audits and certification audits?

You can use the same structure, but the emphasis should differ. Internal audit checklists should probe effectiveness and improvement opportunities in depth, while certification readiness checklists should confirm that every applicable requirement has objective evidence behind it. Many organizations keep one master checklist and add a readiness layer before a Stage 1 or Stage 2 audit.

How often should internal audits be performed?

ISO management system standards require internal audits at planned intervals rather than at a fixed frequency. The audit program should set frequency based on the importance of each process, recent changes, and the results of previous audits, so higher-risk or poorly performing processes are audited more often.

Who should conduct internal audits?

Internal auditors need to be competent in the standard and in audit techniques, and they must be objective and impartial. In practice, that means auditors should not audit their own work. Smaller organizations often rotate auditors between departments or use an external auditor to maintain independence.

What is the difference between an audit checklist and an audit plan?

The audit plan sets the scope, criteria, schedule, team, and logistics for a specific audit. The audit checklist is the working tool auditors use during that audit to decide what to ask, what to sample, and where to record evidence and results. A good plan tells you where to go; a good checklist tells you what to verify when you get there.

If You’re Also Evaluating…

• ISO Internal Audit Services

• ISO Audit Preparation Services

• ISO 9001 Certification Audit

• ISO Consulting

• ISO Gap Assessment

If you need help building or strengthening your audit framework, Wintersmith Advisory supports organizations nationwide with structured, risk-based audit systems aligned to ISO and regulatory expectations. Schedule a free consultation to talk through your audit program.