This checklist is a practical review method informed by ISO 9001:2026. It is not the complete standard, a certification decision or a substitute for an audit programme. Use an authorised copy of the requirements to confirm coverage, then adapt the sampling to your scope, risks and changes.
Start with a completed job, a changed job and a job that went wrong. That combination makes a better first discussion than asking every department whether its documents exist. Record what you actually observed, including uncertainty, instead of awarding a pass from memory.
Prepare the review and choose meaningful samples
Name the review owner and the process owners who can explain the work. Confirm the QMS boundary, products or services, locations, outsourced activities and edition being assessed. ISO 9001:2026 is the current sixth edition; existing certificate holders should confirm their applicable transition arrangements with their certification body.
Choose samples that reveal variation: a new customer, a changed specification, a supplier problem or a different shift. Explain the selection. A small initial sample can expose a problem, but cannot establish that every transaction or location conforms.
For each check, record the requirement or process criterion, sample identifier, observation, evidence location, responsible owner and next action. Use distinct statuses such as demonstrated, gap found, further evidence needed and applicability to resolve. “Not checked” is not the same as “not applicable”.
Check 1: can the team explain the promise?
- Locate the customer’s agreed requirements and any relevant statutory or regulatory requirements for the product or service.
- Find the review of the organisation’s ability to fulfil the commitment, including conflicts or conditions resolved before acceptance.
- Trace later changes into the instructions used by the people delivering the work.
- Compare the accepted order with the website, proposal or sales description where these shaped the commitment.
Useful follow-up: ask the delivery owner what would happen if sales promised an exception tomorrow. If the answer depends on informal memory, examine whether the handover and authority are sufficiently clear. Do not manufacture a retrospective approval and present it as an original record.
Check 2: do scope and leadership match the operation?
- Compare the documented scope with the actual activity and the processes necessary to deliver it.
- Ask how relevant business conditions, interested-party requirements and climate relevance were considered.
- Check the rationale for any requirement considered inapplicable; do not assume outsourced or service work is automatically excluded.
- Locate a real leadership decision about quality priorities, resources or an unresolved conflict.
- Check that people know their authority to escalate a problem and the expected quality and ethical behaviour.
A signed policy is a starting point. Look for its effect when cost, schedule and conformity compete. If managers know a recurring failure but have assigned no resources or decision, record the unresolved issue rather than treating the policy signature as sufficient evidence.
Check 3: are plans changing the work?
- Find a relevant risk and examine the action taken to address its potential adverse effect.
- Find an opportunity being pursued and explain the intended benefit and how success will be evaluated.
- Check that quality objectives have meaningful measures, responsibility, resources and timing.
- Trace a recent change through its purpose, consequences, communication and review of results.
For example, a team may target fewer order-entry errors. Check how it defines an error, which orders enter the measure and whether corrections are counted consistently. A falling percentage is unhelpful when the team has quietly removed difficult cases from the denominator.
Check 4: can people perform the task reliably?
- Ask a person doing the work to show the current instruction and explain an important acceptance decision.
- Compare competence expectations with relevant education, training or experience and evidence that development actions worked.
- Check access to organisational knowledge, especially during absence, turnover or a process change.
- Examine the suitability of infrastructure, working conditions and resources used to check results.
- For measurement traceability where required or essential, inspect the applicable calibration or verification arrangements and action on unsuitable resources.
Do not equate a training attendance sheet with demonstrated competence. Equally, do not demand a qualification certificate when the task can be supported by other appropriate evidence. If a resource is found unfit, investigate whether earlier results were affected; replacing the device alone may leave an unresolved product or service issue.
Check 5: test design and external-provider decisions
Where design and development applies, follow a completed or changed design. Check the inputs, responsibilities, review decisions, verification and validation, and how unresolved issues were handled. A service design can need these controls just as a physical product does. Confirm how changes reached downstream users.
For an external provider, sample the selection decision, communicated requirements and recent performance. Check whether the controls reflect the provider’s effect on your output. A supplier questionnaire marked complete is not enough when repeated delivery problems are ignored.
Ask who decides what to verify on receipt or during delivery, and why. Retain the organisation’s accountability for the final outcome even when much of the work is purchased. Record any unresolved dependency with an owner rather than describing it simply as the supplier’s responsibility.
Check 6: follow delivery, release and exceptions
- Match the instructions and acceptance criteria used with the actual agreed requirement.
- Check identification or traceability where needed, preservation of the output and protection of customer or provider property, including relevant information.
- Find the evidence supporting release and the identity of the person authorising it.
- Trace a delivery change through review and authorisation.
- Inspect a nonconforming output: containment, decision, customer communication where appropriate, correction and subsequent verification.
Include a problem discovered after delivery when available. A process can appear satisfactory at dispatch while having no clear response to an incorrect result reported later. The review should examine relevant after-delivery obligations and what the organisation actually did.
Check 7: do evaluation and review lead to action?
Compare process measures with customer feedback and actual samples. Ask whether the monitoring method produces valid information and whether analysis happens in time to influence decisions. Customer perceptions can be understood through suitable methods; a survey is not the only possible method.
Review the internal audit programme, its coverage and the reasons for its timing. Process importance, changes and previous results should inform planning. Check objectivity and competence, findings, subsequent action and retained evidence. A calendar entry is not evidence that the audit occurred.
Then examine management review. Are the necessary inputs considered and are decisions about improvement, changes or resources recorded? Follow one decision to completion. Separate a correction that deals with an immediate problem from corrective action addressing its causes and possible recurrence. Confirm that effectiveness was checked.
Turn observations into useful findings
Hypothetical equipment-maintenance provider. A sampled job has a signed completion form, but its acceptance threshold comes from a superseded customer instruction. The reviewer records the job identifier, the conflicting revisions and the process criterion that was not met. The service owner checks other affected work, addresses the customer impact and corrects instruction distribution. A later sample tests whether technicians are using the right version. “Improve document control” alone would not have described the immediate exposure.
Hypothetical food-packaging distributor. Customer complaints cluster around damaged deliveries from a particular carrier. Supplier reviews show no reference to those complaints. The team connects damage data with provider evaluation, agrees proportionate controls and checks subsequent results. This is an illustration of a quality decision, not a food-safety certification claim. The chosen actions depend on the products, obligations and actual causes.
Close the review with decisions, not a readiness percentage
Group findings by their effect on customers, conformity and the effectiveness of the system. Assign an owner and realistic due date, identify dependencies, and decide what evidence will demonstrate completion. Where a requirement or applicability decision is unclear, resolve it against the standard and the actual scope.
A numerical score can hide a serious gap behind many easy checks. Present significant unresolved issues, areas not sampled and limits of the review alongside strengths demonstrated. Do not convert this checklist into an audit opinion or a promise of certification.
For an existing system, retain effective processes and improve the weaknesses found. For a new system, sequence work so people can operate and evaluate it before seeking a certification decision. Timing depends on scope, complexity, implementation progress and the independent certification process; this checklist does not impose a fixed operating history or audit interval.
Our ISO 9001 consulting and implementation support can help turn the findings into a scoped work programme with clear responsibilities. Use the ISO standards service directory when the quality system also needs to coordinate with another management system.
Reference basis
This guide uses ISO 9001:2026, Quality management systems — Requirements, sixth edition, including its informative explanatory annex. The official ISO catalogue and September 2026 release announcement were checked on 13 October 2026. The explanations, review method and hypothetical examples are CyberVantage360 guidance; they do not reproduce the standard or add requirements.
Questions and answers
Does completing this checklist demonstrate ISO 9001 conformity?
No. It is a practical starting point for examining work and locating gaps. Full coverage requires consideration of the applicable standard, the organisation’s scope and sufficient evidence of implementation and effectiveness.
How many documents or records must we prepare?
There is no universal fixed total that suits every organisation. Identify the documented information required by ISO 9001 and what your own processes need, then control it appropriately. Avoid creating forms merely to reach a published checklist count.
How many transactions should we sample?
Choose samples according to the review purpose, process variation, risk, changes and available evidence. Record the selection and its limitations. A small sample can identify a problem but cannot prove that all transactions conform.
Should every process be audited once a year?
ISO 9001 requires planned audit intervals and a programme informed by factors such as process importance, changes and earlier audit results. It does not impose one universal annual frequency on every process.
Can we use this checklist when transitioning from ISO 9001:2015?
Yes, as an additional practical review tool. Assess the actual changes against an authorised copy of ISO 9001:2026 and obtain the transition arrangements applicable to your certificate from your certification body. Do not infer a certificate expiry date from this guide.
Make the next quality decision concrete
Bring a representative job, your current scope and the most significant unresolved finding to a quality readiness discussion. We can agree what to examine, who should participate and which actions belong in the next stage.