Internal Audit Checklist - Integrated Management Systems
A comprehensive checklist for conducting internal audits of integrated ISO 9001, 14001, and 45001 management systems.
Overview
This internal audit checklist provides a structured approach to auditing integrated management systems covering quality (ISO 9001:2015), environmental (ISO 14001:2015), and occupational health and safety (ISO 45001:2018) requirements.
The checklist follows the High-Level Structure (HLS) common to all three standards, enabling efficient combined audits while ensuring comprehensive coverage of each standard’s specific requirements.
Checklist Structure
The audit checklist is organized by HLS clause, with integrated questions that address all three standards where requirements align, and separate sections for standard-specific requirements.
Clause 4: Context of the Organization
4.1 Understanding the organization and its context
Verify that internal and external issues have been identified. Confirm that issues are relevant to the organization’s purpose and strategic direction. Check that issues affecting QMS, EMS, and OH&SMS intended results are addressed. Review evidence that context is monitored and reviewed.
4.2 Understanding needs and expectations of interested parties
Confirm interested parties have been identified for each management system. Verify their relevant requirements have been determined. Check that requirements are monitored and reviewed. Assess how stakeholder requirements influence system planning.
4.3 Determining the scope
Review documented scope for each management system. Verify scope considers internal and external issues. Confirm scope considers interested party requirements. Check that scope is available to relevant parties. Assess justification for any exclusions.
4.4 Management system and its processes
Verify processes needed for each management system are identified. Confirm process inputs, outputs, and interactions are determined. Check that process criteria and responsibilities are defined. Review how process risks and opportunities are addressed.
Clause 5: Leadership
5.1 Leadership and commitment
Interview top management to assess QMS, EMS, and OH&SMS commitment. Verify integration with business processes. Confirm resources are provided. Check that policy and objectives are established. Assess promotion of improvement and risk-based thinking.
5.2 Policy
Review quality, environmental, and OH&S policies. Verify policies are appropriate to context. Confirm commitment to requirements and continual improvement. Check that policies are communicated and available. Verify OH&S policy includes commitment to consultation and participation.
5.3 Organizational roles, responsibilities and authorities
Verify roles and responsibilities are assigned and communicated. Confirm authorities for process management. Check reporting mechanisms to top management. For OH&S, verify worker consultation arrangements.
Clause 6: Planning
6.1 Actions to address risks and opportunities
Review risk and opportunity identification methods. Verify actions are planned and implemented. Check integration with management system processes. For EMS, verify environmental aspects are identified and significant aspects determined. For OH&SMS, verify hazard identification and risk assessment processes.
6.2 Objectives and planning to achieve them
Review quality, environmental, and OH&S objectives. Verify objectives are measurable and consistent with policy. Confirm planning includes what, who, when, and how. Check that objectives are monitored and communicated.
Clause 7: Support
7.1 Resources
Verify resources are determined and provided. Check competence of personnel. Review training records and effectiveness evaluation. Confirm infrastructure is adequate. For OH&SMS, verify safe work environment considerations.
7.2 Competence
Review competence determination methods. Verify training needs analysis. Check training effectiveness evaluation. Review records of competence.
7.3 Awareness
Confirm personnel are aware of policy and objectives. Verify understanding of contribution to effectiveness. Check awareness of implications of non-conformance. For OH&S, verify awareness of hazards and risks.
7.4 Communication
Review internal and external communication processes. Verify what, when, with whom, and how to communicate is determined. For OH&S, verify worker consultation and participation processes.
7.5 Documented information
Review document control procedures. Verify creation and updating processes. Check control of documented information. Review retention and disposition arrangements.
Clause 8: Operation
8.1 Operational planning and control
Verify operational controls are implemented. Review control of planned changes. Check control of outsourced processes. For EMS, verify control of environmental aspects. For OH&SMS, verify hierarchy of controls implementation.
8.2 Emergency preparedness and response
Review emergency procedures (EMS and OH&SMS). Verify emergency testing and drills. Check communication of emergency procedures. Review post-emergency evaluation process.
Clause 9: Performance Evaluation
9.1 Monitoring, measurement, analysis and evaluation
Verify monitoring and measurement processes. Check calibration of monitoring equipment. Review compliance evaluation (EMS and OH&SMS). Assess data analysis methods.
9.2 Internal audit
Review internal audit program. Verify auditor competence and impartiality. Check audit scope and criteria. Review audit findings and actions.
9.3 Management review
Review management review inputs and outputs. Verify review frequency and records. Check that review addresses all required inputs. Assess effectiveness of decisions and actions.
Clause 10: Improvement
10.1 General
Review improvement processes. Verify improvement opportunities are identified. Check implementation of improvements.
10.2 Nonconformity and corrective action
Review nonconformity management process. Verify root cause analysis methods. Check corrective action effectiveness. Review records retention.
10.3 Continual improvement
Assess overall improvement evidence. Review improvement metrics and trends. Check management system enhancements.
Using This Checklist
Before the audit, customize questions based on the area being audited, previous audit findings, and known risks. During the audit, gather objective evidence through observation, interview, and document review. Record findings with specific reference to evidence.
Supplementary Materials
The downloadable PDF includes scoring guidance to assess conformity levels, space for evidence notes and observations, a nonconformity classification matrix, and a corrective action tracking template.