ISO 9001:2026 Internal Audit Checklist: What to Add for the New Edition
ISO Cloud Consulting editorial team
To audit against ISO 9001:2026, add questions for the changed requirements to your existing checklist: climate change and interested parties (4.1, 4.2), quality culture and ethical behavior (5.1.1, 7.3), separate risks and opportunities (6.1.2, 6.1.3), planning of changes (6.3) and disruption communication (8.2.1). The 25 questions below cover them. The rest of a sound 2015 checklist largely stays valid once clause references are updated.
How should we plan the first audit against the 2026 edition?
- Objective: determine whether the QMS conforms to the new and changed requirements of ISO 9001:2026 and is ready for the transition audit. State the objective on the audit plan.
- Criteria: ISO 9001:2026 and your own documented information.
- Scope: top management, the quality function and at least two operational processes.
- Timing: after the changes are implemented and awareness training is done, and at least six weeks before the transition audit so you can close findings.
- Auditors: briefed on the changes, and independent of the work they audit.
Audit questions for the changed clauses
Context and interested parties (4.1, 4.2)
- How did you determine whether climate change is a relevant issue? Who was involved and when?
- What was the conclusion, and where is it recorded?
- If relevant, how does it link to risks, opportunities or objectives?
- Which interested-party requirements have you decided to address through the QMS, and how was that decided?
- When were context and interested parties last reviewed?
Leadership, culture and ethics (5.1.1, 7.1.4, 7.3)
- To top management: what do quality culture and ethical behavior mean in this organization?
- What have you personally done in the last three months to promote them?
- Give an example where quality was put ahead of cost or schedule.
- How can someone raise a quality or ethics concern? What happened to the last one raised?
- To staff: what does ethical behavior mean in your job? What would you do if asked to change a record?
- What awareness activity has been delivered, and where are the records?
Risks and opportunities (6.1.2, 6.1.3)
- How are risks determined, analysed and evaluated? Show recent examples.
- How are opportunities determined and evaluated separately from risks?
- Pick one opportunity: what was decided, what was done and what was the result?
- How are actions integrated into processes, objectives or plans?
- How is the effectiveness of actions evaluated, and how often?
- How would you maintain conformity during disruption, for example loss of a key supplier, system or person?
Planning of changes (6.3)
- Show the last three significant changes to the QMS. How was each planned?
- How was each change communicated, and to whom?
- How was implementation monitored?
- Where is the review of results, and what was learned?
- Is the ISO 9001:2026 transition itself recorded as a planned change?
Customer communication (8.2.1)
- How do you inform customers about contingency actions or disruption to supply? Who is responsible?
- Show an example, or the planned arrangements if none has occurred.
Documents and references
- Have references to ISO 9001:2015, clause 10 numbering and documented information wording been updated across procedures, forms and the audit program?
How should findings be graded?
Use your normal grading. One option during transition is to record gaps against 2026-only requirements as observations with actions until the transition date you have set, and as nonconformities afterwards. Agree the approach in the audit plan so it is consistent.
Get the full checklist
The ISO 9001:2026 Internal Audit Checklist contains 253 questions across clauses 4 to 10 (17 New, 34 Changed, 45 Clarified and 157 Unchanged) with evidence prompts, finding grades, an automatic summary, a process audit view, and audit plan and report templates.
