ISO 9001 checklist: every requirement in the order you will meet it, with the evidence auditors ask for

Clause 4: Context of the organisation

This is where the project starts as well: agree what shapes quality here, who has a stake in it and where the system's boundary runs, before anyone writes a procedure.

• The internal and external issues relevant to your purpose and strategic direction, and able to affect what the quality management system is meant to achieve, are identified and kept under review. Evidence: a dated context analysis that has been revisited since it was first written.
• You have determined whether climate change is a relevant issue, and can show how you reached the answer. Evidence: the conclusion and its reasoning, usually within the context analysis.
• The interested parties relevant to the system, and those of their requirements that matter to it, are identified and kept under review. Evidence: a list of parties with their requirements and how each is met.
• The scope is written down: the products and services covered, boundaries such as sites, and the reasoning for any requirement you consider cannot apply. Evidence: a scope statement that matches the certification application and what happens on site.
• The processes the system needs are mapped in sequence and interaction, each with an owner, inputs, outputs, criteria, resources and measures, and the documents and records it relies on. Evidence: a process map and a short description of each process.

Clause 5: Leadership

Leadership items describe what top management does and can explain, so tick them with top management in the room rather than on its behalf.

• Top management takes accountability for the system's effectiveness and can explain the policy, the objectives and current performance in its own words. Evidence: interviews with top managers, and minutes in which quality results are discussed and decided.
• Quality requirements are built into everyday business processes such as sales, purchasing, recruitment and budgeting, and the system gets the resources it needs. Evidence: plans, budgets or approvals that reflect quality objectives and resource decisions.
• Top management promotes a quality culture and ethical behaviour, a leadership expectation added in the 2026 edition. Evidence: examples such as leadership messages, conduct expectations and decisions that put quality ahead of a deadline.
• Customer focus shows in decisions: customer and applicable statutory and regulatory requirements are met, and risks to conformity and customer satisfaction are addressed. Evidence: satisfaction and complaint trends reviewed by management, with the actions that followed.
• A quality policy is approved that fits your purpose, context and strategic direction, frames the quality objectives, commits to meeting applicable requirements and to continual improvement, and is available to interested parties who need it. Evidence: the approved policy, how it was communicated, and staff who can say what it means for their work.
• Responsibilities and authorities for the system are assigned, communicated and understood, including who reports on its performance to top management. Evidence: an organisation chart and role descriptions that match what people actually do.

Clause 6: Planning

Planning turns the context work into decisions. The 2026 edition separates actions on risks from actions on opportunities and strengthens the planning of changes, so check these items even if your system is already certified.

• Risks and opportunities are determined from the issues and interested-party requirements identified under clause 4. Evidence: a register in which each risk or opportunity can be traced to its source.
• Actions to address risks are planned, built into the relevant processes and checked for effectiveness. Evidence: owners, actions, review dates and recorded results in the register.
• Actions to address opportunities are planned in their own right, rather than left as the other half of a risk entry. Evidence: opportunities with their own owners, actions and outcomes.
• Quality objectives are set for the relevant functions, levels and processes: consistent with the policy, measurable, monitored, communicated and updated. Evidence: each objective with a baseline, a target, a date and the latest result.
• Each objective has a plan stating what will be done, the resources, who is responsible, the completion date and how results will be evaluated. Evidence: objective plans with progress recorded against them.
• Changes to the quality management system are planned before they are made, communicated, and reviewed afterwards for whether they achieved the intended result. Evidence: a record for a real change showing its purpose, consequences, resources, responsibilities and the follow-up review.

Clause 7: Support

Support covers what the system runs on. Start document control in the first weeks, because every document the project writes needs it; competence records are among the first things an auditor samples.

• The people, infrastructure and working environment each process needs are determined, provided and maintained, human factors as well as physical ones. Evidence: staffing decisions, maintenance records for equipment that affects output, and environmental controls where conditions matter.
• Monitoring and measuring resources, from gauges and test equipment to software and survey methods, are suitable for their purpose and maintained. Evidence: a list of the resources used to verify conformity and how their fitness is kept.
• Where measurement traceability is required, equipment is calibrated or verified at set intervals, its status identified and protected, and earlier results assessed if it is found unfit. Evidence: calibration certificates traceable to national or international standards, and records of any out-of-tolerance assessment.
• The knowledge each process depends on is identified, maintained and shared, with a way to gain new knowledge when needs change. Evidence: lessons learned, know-how captured for critical roles, and access to external sources.
• The competence needed for each role whose work affects quality is defined. Evidence: role profiles or a competence matrix covering education, training, experience and skills.
• Everyone doing work that affects quality is competent through education, training or experience, and the proof is on file. Evidence: current competence records for the people the auditor samples, contractors included.
• Where a competence gap was found, the action taken to close it is recorded and its effectiveness evaluated. Evidence: training or coaching records followed by an evaluation, such as observed work or results.
• People are aware of the quality policy, the objectives relevant to them, their contribution, what follows if they do not conform, and the organisation's quality culture and ethical behaviour. Evidence: induction and briefing records, and people who can explain these points in interview.
• Internal and external communication about the system is planned: what is communicated, when, with whom and how. Evidence: a communication plan or matrix, and examples of it in use.
• Documents are identified, suitably formatted, reviewed and approved before issue, each with an owner and a version. Evidence: a document register and the approved current versions.
• Documents are available where work is done, protected, changed under control and kept for set periods; documents from outside, such as customer specifications, are controlled; records are protected against unintended change. Evidence: current versions at points of use, retention periods and a list of external documents.

Clause 8: Operation

Clause 8 follows the work from enquiry to delivery and after, and so does this list. It is where Stage 2 auditors trace real jobs end to end, so each item needs records from actual work, not examples prepared for the audit.

• Each process that delivers your products and services is planned: requirements, criteria for the work and for acceptance, resources, controls and the records needed, with outsourced processes covered too. Evidence: quality plans, job or service plans, and acceptance criteria.
• Customer communication is defined for product and service information, enquiries, orders and changes, feedback including complaints, customer property and, where relevant, contingency actions. Evidence: the channels in use and a complaints record.
• The requirements for each product or service are determined, including the statutory and regulatory requirements that apply, and you can meet the claims you make. Evidence: specifications or service definitions, and a current list of applicable legal requirements.
• Before committing to supply, each order or contract is reviewed, covering delivery and post-delivery requirements, needs the customer did not state, and differences from earlier offers. Evidence: review records for a sample of orders, showing who reviewed them and when.
• When requirements change, the documents are amended and the people concerned are told. Evidence: amended orders and a trail showing the change reached operations.
• Where you design products or services, design and development is planned in stages, with responsibilities, interfaces, customer involvement and inputs defined. Evidence: a design plan and recorded inputs, including legal requirements and lessons from earlier designs.
• Design reviews, verification and validation are carried out and recorded, outputs are fit for their purpose, and design changes are reviewed and authorised. Evidence: review, verification and validation records, released outputs and a change log.
• Every external provider and outsourced process that affects your products or services is identified, including providers who deliver directly to your customers. Evidence: an approved list of providers and outsourced processes, with the controls applied to each.
• Criteria for evaluating, selecting, monitoring and re-evaluating external providers are set and applied. Evidence: evaluation and re-evaluation records with performance data, and the action taken on poor performers.
• The control applied to outsourced processes and to bought-in products and services is defined, and what is received is verified before use. Evidence: incoming verification records, and monitoring of outsourced work such as service reports or provider audits.
• Your requirements reach external providers before work starts: what is to be supplied, approvals, competence needed, interactions and any verification you will carry out. Evidence: purchase orders or contracts that state these requirements.
• Production and service provision runs under controlled conditions: instructions at the point of use, suitable equipment and measuring resources, competent people, checks at the right stages and actions to prevent human error. Evidence: current work instructions in use, and in-process check records.
• Any process whose output cannot be verified by later monitoring or measurement is validated, and revalidated periodically. Evidence: validation records, for example for welding, heat treatment or sterilisation.
• Outputs are identified, their inspection status is clear, and traceability is controlled where it is a requirement. Evidence: labels, job or batch numbers, and traceability records.
• Property belonging to customers or external providers, including data and intellectual property, is identified and protected, and any loss or damage is reported to the owner. Evidence: a register of such property and any reports made.
• Outputs are preserved during production and service provision, from handling and storage to packaging, contamination control and transport. Evidence: storage and handling controls, and condition or shelf-life checks where relevant.
• Post-delivery obligations such as warranty, maintenance and support are defined and met. Evidence: warranty, service or support records.
• Changes to production or service provision are reviewed and controlled so that outputs keep conforming. Evidence: change records showing the review, who authorised the change and the actions taken.
• Products and services are released only when the planned checks are complete, unless a relevant authority, and the customer where applicable, approves otherwise. Evidence: release records showing conformity with acceptance criteria and who authorised release.
• Nonconforming outputs are identified and kept from unintended use or delivery, then corrected, segregated, returned, suspended or accepted under concession by an authorised person, with the customer informed where needed. Evidence: a nonconforming output record with the action taken and who decided it.

Clause 9: Performance evaluation

Clause 9 comes last in the project because it needs a system that has been running: measures with results, audits of real work and a review that decides things. Most of its items carry double weight, and the internal audit and management review guides explain how to run each.

• You have decided what is monitored and measured, the methods that give valid results, and when results are analysed and evaluated. Evidence: defined measures with owners and frequencies, and the results recorded.
• Customers' perceptions of how far their needs and expectations are met are monitored by a defined method, and the information is reviewed. Evidence: survey or feedback results, complaint trends and what was done with them.
• Monitoring results are analysed and used to judge conformity, customer satisfaction, system performance, whether planning worked, the effect of actions on risks and opportunities, provider performance and the need for improvement. Evidence: an analysis that feeds management review, not only a table of numbers.
• An internal audit programme covers the whole scope, with frequency set by the importance of processes, changes and earlier results. Evidence: the programme and a schedule showing every process and requirement covered.
• Each internal audit has defined criteria and scope, is carried out by auditors who do not audit their own work, and is reported to the managers concerned. Evidence: audit plans, notes of the evidence sampled, reports and auditor competence records.
• At least one full internal audit cycle is complete before the certification audit, and its findings are acted on without undue delay. Evidence: findings closed with correction and corrective action, or dated plans for those still open.
• Top management reviews the system at planned intervals, covering every required input, including earlier actions, changes in issues and in what interested parties need, performance trends, audit results, resources and the effect of actions on risks and opportunities. Evidence: an agenda and review pack that address each input.
• The review ends in decisions on improvement, changes to the system and resource needs, each with an owner and a date. Evidence: minutes with decisions, and actions tracked to completion.

ISO 9001 internal audit: planning, conduct and reporting

ISO 9001 management review: inputs, outputs and the record

Clause 10: Improvement

Open the nonconformity and corrective action route in the first weeks: complaints, supplier failures and audit findings raised while the system runs are exactly what the auditor asks to see handled. Continual improvement opens clause 10 in the 2026 edition; it comes last here because it draws on everything above.

• Each nonconformity, including those raised through complaints, is controlled and corrected, and its consequences are dealt with. Evidence: a nonconformity log showing the immediate correction for each entry.
• The need to remove the cause is evaluated: the nonconformity is reviewed, its cause determined, and similar cases that exist or could occur are checked. Evidence: a root-cause analysis for each significant nonconformity.
• Corrective actions are implemented and reviewed for effectiveness, with risks, opportunities or the system updated where needed. Evidence: a closure record with the data or observation showing the cause was removed.
• Opportunities for improvement are selected and acted on, drawing on analysis results and management review decisions. Evidence: improvement records whose results show in the measures.