At a glance
ISO 9001 audit guide: how to plan and conduct internal audits under ISO 9001:2026. Updated checklist and audit programme guidance.
- Focus: internal audit · audit checklist
- Read time: 18 minutes
- Updated: August 7, 2026
The Role of Internal Audits in ISO 9001:2026
This ISO 9001 audit guide explains internal audit planning. It covers conducting and documenting under ISO 9001:2026. Internal auditor training must be updated for the 2026 requirements. The internal audit checklist now asks for quality culture evidence. It also asks about opportunities management.
Audits are the main way to verify QMS conformity with ISO 9001. Audits verify the QMS is effectively implemented and maintained. Clause 9.2 of ISO 9001:2026 preserves internal audit requirements from 2015. Auditors must include the new 2026 requirements in the audit scope.
Key Insight
Key Takeaway:: This article explains key ISO 9001:2026 requirements. It shows what they mean for organizations transitioning from ISO 9001:2015.
Use the authoritative source on the ISO 9001 standard page on ISO.orgISO 9001 standard page on ISO.orghttps://www.iso.org/standard/62085.html. See the ISO TC 176 committeeISO TC 176 committeehttps://committee.iso.org/home/tc176sc2 responsible for the revision.
This guide provides a complete, updated method for internal auditors. It includes a clause-by-clause checklist and sample questions for the new requirements. It also guides assessment of new concepts: quality culture and ethical behaviour.
What Has Changed for Internal Auditors in ISO 9001:2026
Internal auditors for ISO 9001:2026 must address three areas. They were not explicit in ISO 9001:2015:
Quality culture and ethical behaviour (Clause 5.1.1). This is the most significant new audit area. Auditors must assess whether top management is actively promoting quality culture and ethical behaviour — not just documenting a policy, but demonstrating behavioural evidence of commitment.
Climate change context (Clause 4.1). Auditors must verify the organization considered climate change as an internal and external issue. They must also verify this consideration is documented.
Restructured risk and opportunity management (Clause 6.1). Clause 6.1's three-part structure requires auditors to verify conformance for each sub-clause. Auditors must verify 6.1.1 (General), 6.1.2 (Actions), and 6.1.3 (Planning to achieve objectives).
ISO 9001 Audit Requirements: What Changed in 2026
Stay Current
ISO expects the next edition in September 2026. Get source-checked weekly briefings.
ISO 9001:2026 Internal Audit Checklist
The following checklist covers all clauses of ISO 9001:2026. Entries marked [NEW] or [CHANGED] show areas needing updated audit approaches.
Clause 4: Context of the Organization
4.1 Understanding the organization and its context
- Has the organization identified external and internal issues relevant to its purpose and strategic direction?
- [CHANGED] Has the organization considered whether climate change is a relevant external or internal issue?
- Is the consideration of climate change documented?
- Is the context review conducted at planned intervals and when significant changes occur?
Sample audit question: "Describe how you identified external and internal issues. Explain how you considered climate change in that process. Show the records or documented evidence for this consideration."
4.2 Understanding the needs and expectations of [interested parties](/glossary#interested-parties)
- Has the organization identified relevant interested parties and their requirements?
- Are interested party requirements monitored and reviewed?
4.4 QMS and its processes
- Are QMS processes identified with inputs, outputs, sequence, and interactions documented?
- Are process owners assigned and aware of their responsibilities?
Clause 5: Leadership
5.1.1 Leadership and commitment — General [CHANGED — MOST SIGNIFICANT]
- Does the quality policy explicitly reference quality culture and ethical behaviour?
- Is there documented evidence that top management communicates quality culture expectations?
- Can top management articulate what quality culture means for the organization?
- Is there behavioural evidence of top management promoting quality culture (meeting records, communications, decisions)?
- Are employees aware of quality culture and ethical behaviour expectations?
Sample audit questions for top management: "How do you show commitment to quality culture in day-to-day operations? Provide a recent example where quality culture influenced a management decision."
Sample audit questions for employees: "What does quality culture mean in this organization? What would you do if you saw behaviour that conflicts with the organization's quality values?"
5.2 Policy
- Does the quality policy align with the organizational context and strategic direction?
- [CHANGED] Does the policy reference quality culture and ethical behaviour?
- Is the policy communicated, understood, and available to interested parties?
Clause 6: Planning
6.1.1 General [CHANGED — NEW STRUCTURE]
- Has the organization determined risks and opportunities that need to be addressed?
- Does the risk and opportunity framework consider the context issues from Clause 4.1?
6.1.2 Actions to address risks and opportunities [CHANGED — NEW STRUCTURE]
- Are actions planned to address identified risks and opportunities?
- Are actions integrated into QMS processes?
- Is the effectiveness of actions evaluated?
6.1.3 Planning to achieve quality objectives [NEW SUB-CLAUSE]
- Are quality objectives established at relevant functions, levels, and processes?
- Are objectives measurable and consistent with the quality policy?
- Is planning documented for how objectives will be achieved?
Clause 7: Support
7.3 Awareness [CHANGED]
- Are employees aware of the quality policy?
- [CHANGED] Are employees aware of quality culture and ethical behaviour expectations?
- Are employees aware of their contribution to QMS effectiveness?
- Are employees aware of the implications of not conforming to QMS requirements?
Clause 9: Performance Evaluation
9.3 [Management review](/glossary#management-review)
- Are management reviews conducted at planned intervals?
- Does the review input include all required items?
- [CHANGED] Does the review include consideration of quality culture promotion effectiveness?
- Are management review outputs documented?
Clause 10: Improvement
10.1 General and [Continual Improvement](/glossary#continual-improvement) [CHANGED — MERGED CLAUSES]
- Are opportunities for improvement identified and acted upon?
- [CHANGED] Has the organization considered emerging technologies and digitalization as potential improvement tools?
- Is continual improvement of QMS suitability, adequacy, and effectiveness demonstrated?
Auditing Quality Culture: A Practical Methodology
Quality culture is the most challenging new audit area in ISO 9001:2026. Auditors must assess behavioural evidence, not only documented procedures.
The Three-Level Assessment Model
Level 1: Policy and Documentation. Verify that quality culture and ethical behaviour are referenced in the quality policy, communicated in awareness training, and included in management review agenda items. This is the minimum threshold — necessary but not sufficient.
Level 2: Management Behaviour. Interview top management to assess how they explain quality culture. Ask for examples showing how they demonstrate that culture. Ask how they resolve conflicts between quality, cost, and schedule.
Level 3: Employee Perception. Interview employees at multiple levels to assess their view of quality culture. Determine whether staff experience the culture as genuine organizational behaviour. Discrepancies between management claims and employee perceptions are significant audit findings.
Common Nonconformities in Quality Culture Audits
Major [nonconformity](/glossary#nonconformity): Quality policy does not reference quality culture or ethical behaviour. There is no evidence of top management communicating the organization's quality values. Employees show no awareness of quality culture expectations.
Minor nonconformity: Quality policy references quality culture, but awareness training is not updated. Management can describe quality culture but lacks specific behavioural examples.
Observation: Quality culture is documented and communicated through formal channels. Evidence of active promotion is limited to formal actions, not informal leadership behaviour.
Audit Reporting for ISO 9001:2026
Audit reports for ISO 9001:2026 should include sections covering the new requirements. When documenting findings on quality culture (Clause 5.1.1) and climate change (Clause 4.1), include:
Related Articles
- What Is ISO 9001:2026?What Is ISO 9001:2026?/article/what-is-iso-9001-2026.
- How to Transition from ISO 9001:2015 to ISO 9001:2026How to Transition from ISO 9001:2015 to ISO 9001:2026/article/how-to-transition-iso-9001-2015-to-2026.
- ISO 9001:2026 vs ISO 9001:2015: Complete ComparisonISO 9001:2026 vs ISO 9001:2015: Complete Comparison/article/iso-9001-2026-vs-2015-complete-comparison.
List the specific evidence reviewed during the audit; state the conformance determination and rationale for that decision; cite the specific clause reference used for the finding; and for nonconformities, identify the requirement not met and list objective evidence supporting the finding.
Corrective actionCorrective action/glossary#corrective-actions for nonconformities related to the new requirements should be verified for effectiveness at the next scheduled audit. For quality culture nonconformities, effectiveness verification requires re-interviewing employees and management — document review alone is insufficient.
Key Resources
The following resources support your ISO 9001:2026 transition planning:
- Track the forthcoming standard: ISO/FDIS 9001:2026 on ISO.orgISO/FDIS 9001:2026 on ISO.orghttps://www.iso.org/standard/88464.html is listed as under development with publication planned for September 2026. The final standard will be available through ISO and national standards bodies after publication.
- IAF transition guidance: The International Accreditation Forum (IAF)International Accreditation Forum (IAF)https://www.iaf.nu publishes mandatory documents that certification bodies must follow during the transition period.
- Free gap analysis template: Download our ISO 9001:2026 Gap Analysis TemplateISO 9001:2026 Gap Analysis Template/resources/gap-analysis-template — a clause-by-clause PDF worksheet covering all 29 requirements with ★ markers for the three new clauses.
- Free transition checklist: Download our ISO 9001:2026 Transition ChecklistISO 9001:2026 Transition Checklist/resources/transition-checklist — a 30-item action checklist covering all four transition phases.
- Transition guide: Our comprehensive ISO 9001:2026 transition guideISO 9001:2026 transition guide/article/how-to-transition-iso-9001-2015-to-2026 covers the full three-year transition window with a step-by-step action plan.
- Certification costs: See our ISO 9001:2026 certification cost guideISO 9001:2026 certification cost guide/article/iso-9001-2026-certification-cost-guide for current pricing by organization size and region.
- Internal audit preparation: Our ISO 9001:2026 internal audit guide and checklistISO 9001:2026 internal audit guide and checklist/article/iso-9001-2026-internal-audit-guide-checklist covers all new clause requirements.
- Frequently asked questions: Visit our ISO 9001:2026 FAQ pageISO 9001:2026 FAQ page/faq for answers to the most common questions about the new revision.
- ISO 9001 Compliance Checklist 2026ISO 9001 Compliance Checklist 2026/article/iso-9001-compliance-checklist-2026 — clause-by-clause requirements checklist.
Frequently Asked Questions
Q: How often should internal audits be conducted under ISO 9001:2026?
A: ISO 9001:2026 does not specify a fixed frequency. Conduct audits "at planned intervals" based on process importance and previous audit results. Most organizations conduct full QMS audits annually and process-specific audits quarterly.
Q: What is new in ISO 9001:2026 internal audit requirements?
A: The core audit requirements in Clause 9.2 remain mostly unchanged. Key additions require auditors to evaluate evidence of quality culture and ethical behaviour (Clause 5.1.1). Auditors must also assess how the organization addressed the climate change context (Clause 4.1).
Q: Can internal auditors audit their own work?
A: No. ISO 9001:2026 maintains the requirement for objectivity and impartiality — auditors must not audit their own work. This applies to all audit activities.
Q: What records must be retained from internal audits?
A: Organizations must retain documented informationdocumented information/glossary#documented-information as evidence of the audit programme and results. This includes audit plans, checklists, findings, nonconformity reports, and corrective action records.
Q: How should audit findings be reported to top management?
A: Report audit results to relevant management. Under ISO 9001:2026, top management must demonstrate awareness of audit findings. Top management must pay particular attention to findings about quality culture and ethical behaviour.