What is the difference between a process audit and a system audit?

A process audit examines one process in depth: its inputs, steps, controls, and outputs against the defined procedure. A system audit examines the whole quality management system across functions against a standard like ISO 9001. Process audits are frequent and narrow; system audits are periodic and broad. A healthy program runs both, plus occasional product audits.

How often should internal quality audits be done?

ISO 9001 requires audits at planned intervals but sets no frequency; the schedule should be risk-based. Common practice is covering the full QMS at least annually, with higher-risk processes (recent nonconformances, complaints, new equipment or staff) audited more often. Many plants run a rolling monthly schedule of small process audits instead of one annual marathon.

Can you audit your own department?

You should not audit your own work. ISO 9001 clause 9.2.2 requires auditors to be objective and impartial, which in practice means auditing outside your own area. Small plants handle this by cross-training auditors between departments or borrowing a trained auditor from another site.

What is the difference between a major and minor nonconformity?

A major nonconformity is a systemic breakdown: a required process is absent, routinely ignored, or the failure could reach customers or compromise safety or certification. A minor is an isolated lapse in an otherwise functioning process, like a single missed record. Majors demand containment and root-cause corrective action; minors need correction and confirmation that they are truly isolated.

How do you write a good audit finding?

State three things: the requirement (with its source), the objective evidence you observed, and the gap between them. For example: 'Procedure QP-07 requires torque verification at each setup; records for lines 1-3 show no verification on 6 of 14 June setups.' No opinions or adjectives; evidence-based findings get fixed instead of argued.

Is an audit checklist required by ISO 9001?

No. ISO 9001 requires an audit program and documented results, not a checklist. But a checklist built from the standard, your procedures, and recent problem history keeps audits consistent and complete. The trap to avoid is a checklist of yes/no questions copied from the standard, which produces compliant-looking audits that discover nothing.

Quality Audit Checklist: Internal Audits That Find Real Problems

Trade the photocopy-the-standard checklist for one built to catch what actually breaks.

A quality audit checklist is a structured list of questions and evidence to examine during an internal audit, built from your own procedures and the standard you follow. A good checklist keeps the audit objective and complete; a great one is written to find real problems, not to collect easy yeses.

Most internal audits fail before they start, because the checklist is a photocopy of the standard's clauses turned into yes/no questions. The auditee says yes, the auditor ticks the box, and everyone returns to work unbothered. Audits that find real problems are built differently: they follow processes end to end, they ask for evidence instead of assurances, and they treat findings as inputs to improvement rather than grades. This guide covers the three audit types, a six-step audit cycle, how to triage findings, and includes a printable ISO 9001-aligned checklist to adapt.

What are the three types of quality audits?

Process, product, and system audits look at different altitudes of the operation, and mixing them up produces audits that answer the wrong question.

Type	Question it answers	Scope	Example
Process audit	Is this process being run as defined, and is it effective?	One process: inputs, steps, controls, outputs	Audit the changeover process on line 2 against the setup procedure
Product audit	Does the product conform to requirements?	One product or lot, re-inspected in depth	Pull finished units and verify dimensions, labeling, packaging against spec
System audit	Does the whole management system meet the standard and work as a system?	The QMS across functions	Internal audit of the full quality system against ISO 9001

Internal audit programs need all three, in roughly that proportion: frequent small process audits, periodic product audits, and a system audit cycle that covers everything over the year. Plants that only do the annual system audit discover problems annually. If you run supplier quality the same taxonomy applies to supplier audits.

The 6-step internal audit cycle

The cycle below follows the plan-do-check-act shape and aligns with the guidance in ISO 19011:2018 the international guideline for auditing management systems.

Plan the program, not just the audit. Schedule audits across the year based on risk: processes with recent nonconformances customer complaints, new equipment, or new people get audited sooner and more often. ISO 19011:2018 added a risk-based approach as a core audit principle for exactly this reason.
Prepare the checklist from three sources. The standard's requirements, your own procedures, and the process's recent history (NCRs, complaints, CAPAs last audit's findings). The history is what turns a generic checklist into a targeted one.
Audit the process, not the paperwork. Walk the floor. Watch the work happen. Trace one real order, one real batch record, one real calibration from start to finish. Interview the people doing the job, not just the supervisor. Documents confirm; observation discovers.
Record findings as evidence, not opinions. A finding states the requirement, the objective evidence, and the gap: "Procedure QP-07 requires torque verification each setup; records for lines 1-3 show no verification on 6 of 14 setups in June." No adjectives needed.
Report and triage. Classify each finding by severity (see below), agree on ownership and dates in the closing meeting, and route anything systemic into the CAPA process rather than leaving it as an audit-report orphan.
Follow up and verify closure. An audit finding is closed by evidence that the fix happened and works, not by a reply email. Overdue findings feed the next cycle's risk-based planning, which closes the loop.

The audit cycle as PDCA. The loop only improves anything if ACT feeds back into the next PLAN.

How do you classify audit findings?

Findings need a severity triage so major problems get urgency and minor ones do not clog the system. The common three-level scheme:

Major nonconformity: a requirement is absent or has broken down systemically: no process exists, the process is routinely ignored, or the failure could reach customers or compromise safety or certification. Demands containment thinking and a root-cause CAPA.
Minor nonconformity: an isolated lapse in an otherwise functioning process: one missed record, one out-of-date document in circulation. Fix it, check it is truly isolated, close with evidence.
Opportunity for improvement (OFI): conforms to requirements, but the auditor sees risk or waste: an awkward workaround, a fragile single-person dependency, a form nobody uses. No obligation, but the best audit programs mine OFIs for cheap wins.

Severity triage. The classifications only work if majors are rare, loud, and fast.

What belongs on the checklist, and what doesn't

A working checklist has three layers of questions, in this proportion:

Requirement questions (about a third). Drawn from the standard and your procedures: is the current revision at the point of use, are calibrations in date, are records complete. These keep the audit legally and certifiably sound.
Trace questions (about half). "Show me": trace one real order from receipt to ship, one batch record end to end, one operator's training against the work they did today. Trace questions are where real problems surface, because staged floors survive requirement questions and collapse under traces.
History questions (the rest). Built from the last 90 days of NCRs complaints, and CAPA activity in this area: did the fix for March's labeling escape actually hold? Was the recurring downtime cause addressed? This is the layer that makes each audit different from the last one.

What does not belong: questions answerable only by opinion ("is quality culture strong?"), questions the auditee can satisfy with a rehearsed yes, and anything you will not follow with "show me the record." If a line on your checklist has been answered "yes" for six consecutive audits, replace it with a trace; it has stopped earning its ink.

What the standards actually require

ISO 9001:2015 clause 9.2 requires internal audits at planned intervals, with a program that considers importance and previous results, objective auditors, and corrective action on findings without undue delay. It does not prescribe a frequency; risk does that.
ISO 19011:2018 the auditing guideline, lists seven audit principles including integrity, evidence-based approach, and (new in the 2018 edition) a risk-based approach to planning and conducting audits.
Auditor independence means auditors do not audit their own work, per ISO 9001 clause 9.2.2. In a small plant that can be as simple as trading audits between departments or borrowing a trained auditor from a sister site.

Why audits miss real problems

Four patterns turn audits into theater. Checklists written only from the standard, so the audit verifies grammar instead of practice. Pre-announced walking routes, so the floor is staged by the time the auditor arrives. Findings written as opinions, which start arguments instead of fixes. And no follow-up loop, so the same findings reappear each year with new dates. Every one of these is a program-design choice, which means every one is fixable this cycle.

The quiet fifth pattern is evidence that is miserable to gather. When training records, calibration logs, and quality checks live in binders across three offices, audit prep takes days and sampling is thin. Plants that have digitized those records at the point of work, the way Harmony's paperwork digitization and quality reporting modules do, can pull a batch record, its checks, and its exceptions in minutes, which changes both audit cost and audit depth alongside the QMS. Findings then flow into the same system that tracks CAPAs so closure verification is a query, not a chase. Unfound problems, meanwhile, do not stay free; they surface later as failure costs in your cost of quality.

The printable checklist below is a starting skeleton: generic ISO 9001-aligned themes, meant to be rewritten in your plant's language with your procedures' numbers before first use.