What is an audit checklist used for?
An audit checklist keeps an audit consistent and complete. It tells the auditor which requirements to test, prompts them to collect evidence rather than opinions, and gives every audit of the same area the same yardstick, so results can be compared over time. It also protects the auditee: they can see in advance what will be checked and against which standard.
What are the main types of audit checklist?
| Type | What it checks | Who usually audits | Typical frequency |
|---|---|---|---|
| Internal quality audit | Processes against the quality management system and ISO 9001 | Trained internal auditors | Each process at least yearly |
| Workplace safety audit | Hazard controls, permits, training and emergency readiness against the safety system and the law | Safety advisor with a supervisor and a worker representative | Monthly to quarterly |
| 5S audit | Sort, set in order, shine, standardise and sustain in one area | Team leader or a peer from another area | Weekly |
| Layered process audit | A few critical process controls at one station | Leaders at every level | Daily to monthly by layer |
| Supplier audit | A supplier's processes, controls and records | Supplier quality engineer | Before approval, then by risk |
| Pre-certification audit | Readiness for an external ISO audit | Internal lead auditor or consultant | Before the certification audit |
What should an audit checklist include?
| Section | What it records |
|---|---|
| Header | Area or process, audit scope, standard or procedure audited against, auditor, auditee, date |
| Questions | One requirement per line, with the clause or procedure reference |
| Result | Conforms, does not conform, N/A |
| Evidence | What was seen, sampled or read: record numbers, photos, names of people interviewed |
| Findings | Nonconformity (major or minor) or opportunity for improvement |
| Actions | Correction, corrective action, owner, due date, verification date |
| Sign-off | Auditor and auditee names; date the report was issued |
Example internal audit checklist
Use this as a starting point for an area audit that covers quality, safety and workplace organisation. Replace the references with your own procedures and drop rows that do not apply to the area.
| # | Area | Audit question | Reference | C | NC | N/A | Evidence |
|---|---|---|---|---|---|---|---|
| 1 | Documents | Are the work instructions at the workstation the current revision? | Document control procedure | ☐ | ☐ | ☐ | |
| 2 | Training | Is everyone doing the task signed off as competent for it? | Training matrix | ☐ | ☐ | ☐ | |
| 3 | Process control | Are process checks recorded at the frequency the control plan requires? | Control plan | ☐ | ☐ | ☐ | |
| 4 | Measurement | Are gauges and instruments in use within their calibration date? | Calibration register | ☐ | ☐ | ☐ | |
| 5 | Nonconforming product | Is suspect or rejected product tagged and segregated? | Nonconformance procedure | ☐ | ☐ | ☐ | |
| 6 | Corrective action | Are the actions from the last audit of this area closed, and has the fix held? | Last audit report | ☐ | ☐ | ☐ | |
| 7 | Safety | Are guards, interlocks and lockout points in place and working? | Machine risk assessment | ☐ | ☐ | ☐ | |
| 8 | Safety | Is the required PPE worn and available? | Area PPE standard | ☐ | ☐ | ☐ | |
| 9 | Safety | Are chemicals labelled, stored correctly and backed by a current safety data sheet? | Hazardous substances register | ☐ | ☐ | ☐ | |
| 10 | Emergency | Are exits, extinguishers and first aid kits clear, in date and signed? | Emergency plan | ☐ | ☐ | ☐ | |
| 11 | 5S | Does the area match its 5S standard, with only needed items present and everything in its marked place? | Area 5S standard | ☐ | ☐ | ☐ | |
| 12 | Daily management | Is the team board current, with problems and actions reviewed in the last shift? | Tier meeting standard | ☐ | ☐ | ☐ |
| Finding | Type (major, minor, OFI) | Correction | Corrective action | Owner | Due | Verified |
|---|---|---|---|---|---|---|
| ☐ |
How do you write good audit questions?
Write each question so the auditor has to look for evidence. "Are procedures followed?" invites a yes. "Show me the last three completed setup checks for this machine" gets the truth.
| Weak question | Better question |
|---|---|
| Is training up to date? | Pick two operators on shift: are both signed off on the training matrix for the task they are doing? |
| Is calibration OK? | Are all gauges at this station within their calibration due date on the label and in the register? |
| Is the area safe? | Are all fixed guards in place and do the interlocks stop the machine when opened? |
| Is 5S good? | Is every tool on the shadow board in its place or in use, with nothing unlabelled on benches? |
How do you run an audit with the checklist?
Plan the scope and tell the area. Read the last audit report and open actions. On the day, open with the area lead, then go to the work: observe, sample records and talk to the people doing the job. Record evidence against each question as you go, not from memory afterwards. Close with a short meeting to agree the findings, then issue the report within a few days.
What happens after the audit?
The checklist is only as useful as the follow-up. Grade each nonconformity, make the immediate correction, find the root cause for anything major or repeated, and raise a corrective action with an owner and due date. Review open actions at the team's regular meeting until they close, and verify that each fix worked at the next audit. Once a quarter, look across all audits for repeat findings: a question that fails in several areas usually points to a system problem, not a team problem.
Why do audit checklists fail?
- Copied from a generic download, so the questions do not match the area's real risks and procedures.
- Too long, so auditors skim and tick.
- Questions that can be answered from the office without seeing the work.
- Findings recorded with no owner or due date, so the same nonconformity reappears every audit.
- Never revised, so questions that always pass stay in and new risks never get added.
Step by step
- Define the scope and standard. Name the area or process being audited and the procedure, regulation or ISO clause it is audited against.
- List the requirements. Pull the requirements from the standard, the procedures, the risk assessment and the findings of previous audits.
- Turn each requirement into a question. One requirement per question, phrased so the auditor must observe the work or sample a record to answer it.
- Add result, evidence and finding fields. Give every question conforms, does not conform and N/A, a space for evidence and a place to record the finding.
- Set who audits and how often. Schedule audits by risk: high-risk areas and processes more often, with auditors independent of the work they audit.
- Link findings to corrective actions. Every nonconformity gets a correction, a root cause where needed, an owner, a due date and a verification check.
- Review and revise the checklist. After a few audit cycles, remove questions that never fail, add ones from recent incidents and complaints, and update references.
A worked example
A food packaging plant in Melbourne ran its internal audits from a 140-question spreadsheet covering every ISO 9001 clause, and most areas got audited once a year. It split the list into twelve-question area checklists like the one above and rotated them monthly. The first round found out-of-date work instructions on two lines and a metal detector check recorded but not performed on night shift. Both became corrective actions reviewed at the daily tier meeting, the night shift check was verified at the next audit, and the external certification audit later that year raised no major findings.