How to build an internal audit checklist

A weak checklist turns an audit into a questionnaire. “Is there a documented procedure for purchasing? Yes.” “Are suppliers evaluated? Yes.” The auditee answers, the auditor ticks, and the audit misses the three suppliers nobody has looked at in two years. A good checklist does the opposite: it tells the auditor what to ask for, what to sample and what a pass looks like. This guide shows how to build one, with a worked example for a purchasing audit at Kestrel Metals, a fictional fabrication company with plants in Lagos and Ogun.

What a checklist is for

A checklist is a working document for one audit. It does three jobs:

• Plans the audit. It sets out what will be examined, in what order and against which audit criteria.
• Guides the auditor on the day. It reminds them what evidence to ask for and how much to sample.
• Records what was examined. With the auditor’s notes, it shows later what was seen and how conformity was judged.

ISO 9001:2015 clause 9.2 does not require a checklist. It requires criteria and scope for each audit and retained documented information as evidence of the programme and the results. A checklist is usually the simplest way to provide both. ISO 19011:2018 treats checklists as part of the documented information prepared for an audit, and notes that they should not limit what the auditor examines: an auditor who sees a problem that is not on the list should follow it.

Process-based or clause-based

There are two ways to organise the questions.

Clause-based checklists walk through the standard in order: 4.1, 4.2, and so on. They are easy to write and make it obvious that every clause is covered, but they split one process across many headings and lead auditors to ask about the standard rather than the work.

Process-based checklists follow the process as it runs: from a purchase requisition, through supplier selection and the order, to receipt and payment. Each question is tagged with the clauses and procedures it tests. They take longer to write, but they match how people work, they follow real records from end to end, and they pick up the gaps between departments where many problems sit.

Most experienced internal audit teams use process-based checklists and keep a clause cross-reference table to show coverage across the audit programme. The guide on planning a risk-based audit programme explains how to spread that coverage over a cycle.

Write questions that ask for evidence

The single most useful rule: every question should make the auditee show you something. Compare these pairs.

Weak (yes/no)	Strong (show me)
Are suppliers evaluated?	Show me the most recent evaluation for each of five suppliers I pick from the approved list.
Is there a training matrix?	Show me the training records for the two most recent starters in goods-in.
Are purchase orders reviewed?	Take me through how this order was checked before it was sent. Who checked it, and where is that recorded?
Is the procedure followed?	Show me what happened the last time a delivery failed inspection.

The strong versions do not ask whether something exists. They ask for audit evidence that it happened, in a sample the auditor chooses. They also invite the auditee to explain the process in their own words, which is where differences between procedure and practice show up.

A few more habits help:

• Start questions with “show me”, “walk me through”, “how do you know” or “what happens when”.
• Ask about exceptions and failures, not just the normal path. Rejected deliveries, urgent orders and new suppliers are where controls are tested.
• Avoid questions that contain the answer, such as “You do check the certificates, don’t you?”
• Keep one requirement per question, so a gap can be traced to one criterion.

Link every question to a criterion

Each question should say where its requirement comes from: the clause of the standard, your own procedure, a customer specification or a legal requirement. That link does two things. It lets the auditor write a finding straight from the checklist, and it stops checklists filling up with questions that test the auditor’s preferences rather than any requirement.

The criterion column also makes integrated audits easier. If purchasing is audited against ISO 9001 and ISO 14001 at the same time, a question about supplier evaluation can carry both references, for example clause 8.4 of ISO 9001 and the environmental criteria in your own supplier procedure, and a single sample answers both. Over a year, the criterion column lets you build a simple coverage table from the checklists themselves: which clauses were tested, in which processes and how often. That table is usually the first thing a certification auditor asks for when they want to know whether the programme covers the whole system.

A useful layout has four columns: the question, the criterion, what to sample and what conformity looks like. The last column matters more than it looks. “Evaluation completed within the last twelve months, scored against the four criteria in QP-08” leaves much less room for argument than “suppliers evaluated”.

Worked example: a purchasing audit

Here is part of the process-based checklist Tunde Bakare used for the purchasing audit at Kestrel Metals. The audit scope was purchasing at the Ikeja plant for orders raised January to August 2026.

#	Question	Criterion	Sample	Conforms if
1	Show me the approved supplier list and when it was last reviewed.	8.4.1; QP-08 s.4	Current list	Reviewed within 12 months; revision controlled
2	For suppliers I choose, show me the latest evaluation.	8.4.1; QP-08 s.5	5 of the active suppliers, including the top two by spend	Each evaluated within 12 months against QP-08 criteria
3	Walk me through how a new supplier was approved this year.	8.4.1; QP-08 s.3	Most recent new supplier	Approval recorded before first order
4	Show me how requirements were stated on these purchase orders.	8.4.3	8 orders across the period	Grade, specification and certificate needs stated
5	What happened the last time a delivery failed goods-in inspection?	8.4.2; 8.7	Last 2 rejections	Nonconforming material identified, supplier informed, recorded
6	How do you know whether a supplier’s performance is getting worse?	8.4.1; 9.1.3	Delivery and quality data for 2026	Performance monitored and acted on
7	Show me training records for the buyers who raised these orders.	7.2	Buyers on the sampled orders	Competence for the role recorded

Question 2 is where the audit found its nonconformity: when Tunde extended the sample to all eleven active suppliers, three had no evaluation since 2023. Question 6 produced an observation that the evaluation form did not include delivery performance.

Tell the auditor what to sample

The sample column is the one most checklists leave out, and it is the one that most affects quality. Without it, auditors sample whatever is closest to hand, which is usually the folder the auditee prepared.

Good sampling instructions say:

• How many, as a starting point. A common practice is five to ten items from a population of a few dozen, more if the first few show a problem.
• From where. “Pick from the full purchase order list for the period” rather than “look at some orders”.
• Which items deliberately. The highest spend, the newest supplier, the month the buyer changed, the order linked to last quarter’s complaint.
• In which direction. Trace from the list to the record and from the record back to the list. Each direction catches different gaps.

Keep checklists current

A checklist is only as good as its last review. Before each audit, the auditor should update it from:

• Changes to the procedure or the process since the last audit.
• Findings from the last audit of the process, so the auditor can check that fixes have held.
• Complaints, incidents, near misses or nonconformities raised since.
• Changes in the standard or in customer requirements.

After the audit, note which questions produced useful evidence and which did not. Retire the ones that always produce a tick and add questions about the areas where findings came from.

Watch for two common mistakes. The first is the checklist that grows every year: each audit adds questions, none are removed, and the auditor runs out of time halfway through. Cap the length and replace rather than add. The second is the checklist copied from the procedure, with one question per paragraph. It tests whether people can recite the procedure, not whether the process delivers what it should. Keep a few questions that look at outcomes, such as delivery performance or rejected material, and follow them back into the process.

In Orisynx, audit templates are built by your team, with text, number, date and choice fields, so a process-based checklist like the one above can be set up once and reused; there are no pre-loaded checklists to adapt. The guide on how to run an internal audit shows where the checklist fits in the day.

Sources

• ISO 19011:2018, Guidelines for auditing management systems: https://www.iso.org/standard/70017.html
• ISO 9001:2015, Quality management systems, Requirements: https://www.iso.org/standard/62085.html