Blog

Internal Audit checklist is used in audit process, to ensure the compliance and effectiveness of ISO 9001, TS 16919 and Quality management system.

42 Basic phases of internal audit

Quality Management Systems
General Documentation Requirements
Quality Manual
Control of Documents
Control of Records
Management Commitment
Customer Focus
Organizational Quality Policy
Quality Objectives
Business Quality Management System Planning
Responsibility and authority
Management Representative
Internal Communication
Management Review
Human Resources
Infrastructure
Work Environment
Planning for Product Realization
Determination of requirements related to the products
Review of the requirements related to the product
Customer Communication
Plan / Design and development planning
R.M Plan / Design and development inputs
Design and Development Outputs
Design and development review and verification
Control of design and development changes
Purchasing Process
Purchasing information
Verification of purchased products
Control of production and service provision
Validation of processes of production
Identification and tractability
Customer Property
Preservation of products
Control of monitoring and measuring devices
Measurement, analysis and improvement
Monitoring and measurement of product
Control of nonconforming product
Analysis of data
Corrective action
Preventive action

Internal Audit checklist template

Quality Management Systems

1. 1. • Have the key work processes of the organisation been identified?
      • Does the company measure efficiency and effectiveness of the work processes?
      • How does the company achieve control of the processes?
      • Are there any outsourcing or subcontracted work to external party(s), if, yes, how the organisation control those processes and identify relevant control within them?
      • Is continuous improvement on performance being implemented? Are the process management activities supported by appropriate operational records (to show planning, operation and control)?

General Documentation Requirements

1. 1. • Are the six mandatory documented procedures documented, namely, control of documents, control of records, internal audits, control of nonconforming product, corrective action, preventive action?
      • Are there documents such as flow charts, memos, policies that guide the work for the employees?
      • Are these appropriate records kept to show evidence of the implementation of the processes?

Quality Manual

1. 1. • Does the company compile have a Quality System Manual (QSM) established and maintained? Are the following included?
      • The work processes within the scope of the quality management systems,
      • Scope of the QMS, including details and justification for any exclusions,
      • The reference to the documented systems, and Descriptions of the interaction between the processes of the quality management system?
      • Are there documented statements of a quality policy and quality objectives?
      • Are there documented procedures required by the Standard, (viz, control of documents, control of records, control of nonconforming product, corrective action, preventive action, internal audit)

Control of Documents

1. 1. • Has the company appointed designated personnel for the approval and issue of the documents?
      • Is there a documented procedure for the control, issue, review and approval for changes to existing documents and issues of new documents?
      • How was the quality management system and its documented procedures implemented?
      • Are external documents used within the organization? Are these documents being identified properly to preclude uses of obsolete documents?
      • Does the company distribute its quality management systems documents with identification to ensure proper references?
      • Have all controlled documents, including forms, been defined? (e.g. QA manual, procedures, forms, quality plans, work instructions, user manuals, training manuals, Legal manuals, etc.)
      • Who is responsible for the control of documents? Where this responsibility is defined (documented)?
      • How is electronic (computer) data collected? Where is this defined?
      • How are documents of external origin, such as standards and circulars, identified and controlled?
      • Who is responsible for the identification and control of documents from external sources, such as standards, regulatory standards and circulars?
      • Is the pertinent issues of appropriate documents are available at all locations where operations essential to the effective functioning of the quality management system are performed
      • Invalid and/or obsolete documents are promptly removed from all points of issue or use, or otherwise assured against unintended use.
      • Any obsolete documents retained for legal and/or knowledge – preservation purposes are suitably identified.
      • Who is responsible for ensuring that invalid and/or obsolete documents are promptly removed from all points of issue or use, or otherwise protected from unintended use? How is this accomplished?
      • Who is responsible for ensuring that any obsolete documents retained for legal and/or knowledge preservation purposes are suitably identified? How is this accomplished?

Control of Records

1. 1. • Is there a documented procedure for the identification, storage, protection, retrieval, retention times and disposition of the records related to quality management system?
      • Who is responsible for the collection of each record? (Remaining questions are usually directed toward the appropriate person in each area.)
      • How are records identified, indexed and filed? Can you show me example in process?
      • How do you ensure that records are legible?
      • How do these records demonstrate conformance to specified requirements and effective operation of the quality management system?
      • Who has access to these records? Are all the records stored here? (To determine whether off-site storage is used.)
      • What is the retention time for each record? Where applicable regulatory and legal requirements taken into consideration in establishing these retention times? If so, can you show me the applicable regulatory and legal requirements that were consulted?
      • Who is responsible for maintaining these records? Does that person also dispose of records” where is this process defined in your quality plan and/or documented procedures?
      • How do you store and retain records in such way that they are readily retrievable in facilities that provide a suitable environment to prevent damage or deterioration and prevent loss?
      • Do you keep electronic (computer) records? Do you create back-ups of this data? How often? What is responsible for initiating these back-ups? Can you load a recent back up (bring up the header) so that I can verify the date? Where is this process defined in your quality plan and/or documented procedures?
      • Do you maintain pertinent suppliers’ records? Can you show me examples of this?
      • Are quality records available for evaluation by the customer or the customer’s representative, where agreed by contract, for the agreed period? How is this accomplished?

Management Commitment

1. 1. • How does the management demonstrate leadership, commitment and involvement?
      • Does top management actively involved in establishing, maintaining and reviewing the quality management system?
      • Does the top management develop specific programs for communicating customer and regulatory requirements and creating awareness of the importance and establish a list of quality objectives or is there any communication to the organization the importance of meeting customer as well as statutory and regulatory requirements?
      • Is there evidence of top management commitment, example, in the management review minutes.
      • Do top management review resource requirements to ensure the availability of relevant resources?
      • Is there top commitment on the continual improvement of the effectiveness of the quality management system?

Customer Focus

1. 1. • Does top management ensure that customer requirements are determined and fulfilled with the aim of enhancing customer satisfaction?
      • How does the company identify customer needs on a continual basis?
      • How does the company management identify peoples’ needs for recognition, work satisfaction, competence and personal development?
      • How does the company consider potential benefits of establishing partnerships with suppliers?
      • How does that company ensure that statutory and regulatory requirements are met?

Organization Quality Policy

1. 1. • What is the organization quality policy?
      • Does the quality policy consider the vision of meeting requirements, customer requirements and continual improvement?
      • How does the quality lead to visible and expected improvements?
      • Where is your quality policy, including objectives for quality and commitment to quality, documented?
      • How does the quality policy ensure that the needs and expectation of the customers are understood?
      • How is the quality policy appropriate to the purpose of the company?
      • Who is responsible for ensuring that your company quality policy and objectives are communicated to all levels of the organization?
      • How is your quality policy communicated and understood within the organization?
      • How do you ensure that the quality policy is understood at all level of the organization? Can you provide evidence that demonstrates this?
      • Is the quality policy being reviewed for continuing suitability and address in management review minutes?
      • Is the Quality policy including a commitment to continually improve the effectiveness of the quality management system by top management?

Quality Objectives

1. 1. • Are suitably quality objectives being set to translate quality policy into measurable goals?

Business Quality Management System Planning

1. 1. • Are the objectives deployed by functions, and by individuals so as to assure individual’s contribution to the achievement of the objectives?
      • Are resources allocated to implement the stated quality objectives?
      • Are quality objectives established at relevant functions and levels within the organization (cascading formula)?
      • Are these quality objectives measurable and consistent with the quality policy?

Responsibility and authority

1. 1. • Who in your company has the organizational freedom and authority to initiate action to prevent the occurrence of any nonconformity relating to product, process, and quality system? Where is this defined and documented?
      • Who is in your company is authorized or responsible for verifying the implementation of solutions? Where is this defined and documented?

Management Representative

1. 1. • Is a management representative appointed to promote the quality management system implementation and to raise awareness of customer requirements within the organization?
      • Who is your management representative? Where is the documented?
      • Is the management representative a member of management?
      • What evidence are in place to show the management representative promote awareness of customer requirements within the organization?

Internal Communication

1. 1. • Does management communicate to all parties on the quality requirements, quality procedures to all employees of the company to ensure improvement and implementation of procedures?
      • Is there internal communication established and carried out for each individual level?

Management Review

1. 1. • Does top management review the effectiveness of the quality management systems at least once a year? Are records kept for the management review?
      • Does the review input and output conform to the standard requirements? How to ensure valid information is collected for management review?
      • Who is/are involve in its continued suitability and effectiveness in satisfying the requirements of ISO 9001 standard?
      • How is a determination as to the effectiveness of the quality management system made?
      • How is the management review recorded (documented)?
      • When was last management review? May I see it?

Human Resources

1. 1. • Do the company implement processes / procedures to ensure that the training needs for the employees are met?
      • What action is in place for improving the competency of personnel, and employee awareness programs.
      • Are there activities to ensure that the employees in the organization are a capable and competent for the current and future needs for the organization?
      • Are there objective evidence on the effectiveness of training that are evaluated on specific training provided?
      • Does the HR process look at the competence of personnel from recruitment to deployment right up till the staff leave the organization (e.g. qualification or education of staff upon recruitment, training of staff for the right job, etc)?
      • Are the effectiveness of the training evaluated?

Infrastructure

1. 1. • Does the company provide adequate supports for the product requirements?
      • Are buildings, work places, and utilities provided?
      • Is process equipment set up to meet the product requirements?
      • Are supporting services such as transportation, training in place to ensure conformance to product requirements?
      • Is the infrastructure for example, buildings, workspace and associated utilities, equipment and supporting services such as transport etc appropriate to achieve conformity to product requirements?
      • Are these infrastructures maintained?

Work Environment

1. 1. • Does the management ensure that the work environment promote motivation, satisfaction, development and performance of the people in the organization?
      • Is the work environment suitable so as to achieve conformity to product or service

Planning for Product Realization

1. 1. • Does the company determine the quality objectives related to the product requirements?
      • Does the company in planning product realization, determine the required verification, validation, monitoring, inspection, and test activities specific to the product and the criteria for product acceptance?
      • Are the processes planned to achieve the product requirements?
      • Are monitoring and inspection activities in place?
      • Are these activities recorded to provide evidence of implementation?
      • The identification and preparation of records.

Determination of requirements related to the products

• Does the organization determine
• Requirement specified by the customer?
• Requirement not stated by customer?
• Statutory and regulatory requirements related to the product / service?
• Any other additional requirements?

Review of the requirements related to the product

• What is your system for receiving incoming orders / contracts? Are personnel (phone operators, mailroom personnel, fax room personnel, etc.) instructed as to how to recognize orders and where to direct them?
• Is there an established process to ensure that the product requirements are communicated and understood by the company?
• The review of requirements shall be carried out prior to the supply of the product. Is there such a review to ensure that product requirements are defined?
• Are contract / order requirements differing from previously expressed requirements are resolved?
• Does the company have the capability to meet the order requirements?
• Are the records on the review kept?
• How do you communicate contract requirements to the necessary functions (design, production, etc.)? How are special contract requirements communicated to the necessary functions?
• When product requirements are changes, is there a procedure to change the related document to inform people on the change of the product requirements?
• When the customer provides no documentary evidence of the product requirements, the product requirements shall be confirmed by the organization before supplying the products. Are there any measures in this aspects?

Customer Communication

• Are there arrangements within the organization for communicating to the customers with respect to product information, enquiries including amendment?
• Is there a channel for customer feedback, including customer complaints?
• What controls are in place to ensure that amendments to contracts are correctly transferred to functions concerned? Can you demonstrate that system to me using an example where this was necessary?
• Is there arrangements for communicating with customers on Product information?
• Enquiries, contracts or order handling, including amendments?
• Customer feedback, including customer complaints?

Planning / Design and development planning

• Are there any efforts or resources allocated for the design and development of the products?
• Are the design activities controlled through planning on?
• The design and development stages
• The review, verification and validations for each of the stages
• The responsibilities for design and development for each of the stages?

Raw Material Plans / Design and development inputs

• Are records provided to indicate that functional and performance requirements are determined prior to the design?
• Is the statutory / regulatory requirement considered / included in the product requirements?
• Are the experiences from previous design work utilized?
• Are the design input reviewed to ensure that there is no conflicts, ambiguity among them?

R.M Plans / Design and Development Outputs

• Are the requirements for the design output define to ensure that:
• Output meets the input requirements
• Provide adequate information for purchasing, production and servicing
• Contain or reference product acceptance criteria
• Specify characteristics that are essential for safe and proper use of the products

Design and development review and verification

• Are records and participants defined for the review of the design and development activities?
• Evaluate the ability of the results in meeting the product and organization requirements
• Identify problems and provide solutions to the problems
• Records of verification that the design output meet input requirements
• shall be kept. Are the design verification carried out?

Control of design and development changes

• Validation of the design shall be planned prior to the use of the products and records shall be kept. Are design validation activities carried out?
• Design changes shall be verified and approved before implementation. Are there activities to ensure these?
• Are the actions to evaluate the impact of the design changes recorded and is the review evidence on the design changes kept?

Purchasing Process

• Does the company review and approve its documents / messages sent to the suppliers?
• Does the organization select and evaluate the suppliers in terms of their ability to supply materials / services to meet the product requirements?
• Are suppliers evaluated and selected on the basis of their ability to meet organization requirements (including the quality management system and any specific quality – assurance requirements)?
• Where is the type and extent of control exercised by the organization over the suppliers defined (documented)? Is this dependent upon the type of product and the impact of subcontracted product on the quality of the final product?
• Are the evaluation / selection criteria applied to suppliers of critical and/or custom products different from those applied to suppliers of standard catalog items (distributors)?
• Is the evaluation / selection criteria applied to suppliers of products / raw materials different from those applied to suppliers of services (e.g., calibration or testing services)?
• Are calibration services subcontracted to meet the requirements of clause 7.6?
• Do you use a “Vendor Rating System”? If so, where is there system defined?
• How does a suppliers become disqualified? Where is this defined?
• May I see qualification records for the auditor who visited this suppliers? (If applicable)
• Are records maintained for each acceptable supplier?
• Do you use an “Approved Suppliers List”? who suppliers your “Approved Suppliers List” to you? How do you know this one is the most current revision? Who is responsible for its upkeep?
• If calibration services are subcontracted, how are the requirements of section 7.6, as a minimum, invoked? (Is the quality management system standard to be applied specifically stated?)

Purchasing information

• Does the company provide purchasing documents that describe the products to be purchased and include information on?
• Requirements of approval
• Requirements for qualification of personnel
• Quality Management Systems requirements?
• Who reviews and approves a purchase order? How can one identify the individual who approved this one?
• Are review parameters defined? (Are verification requirements specified?)
• When complex requirements exist, are other departments included in the review and approval process?
• Do you issue documents (e.g., product specifications, drawings, and workmanship standards) to subcontracted? If so, how are these documents controlled?
• Are substitutions allowed from your suppliers? Who approves and authorizes substitutions?
• If substitutions are allowed, what instructions are given to your suppliers regarding whom to contact for approval or authorization? How are they given?

Verification of purchased products

• Does the company have processes and activities to verify or inspect materials to ensure that the purchased products meet specified requirements?
• Does the customer intend to verify the materials at suppliers’ premises, has this information been included in the purchasing documents sent to the supplier?
• Where applicable, how do you ensure that where you verify purchased product at a supplier’s premises, the verification arrangements, and the method of product release are specified in the purchasing documents?
• When specified in a contract, how do you communicate to your supplier that your customer or the customer’s representative is afforded the right to verify at the supplier’s premises that subcontracted product conforms to specified requirements? Where is this procedure defined?
• How do you ensure that, when specified in a contract, your customer or the customer’s representative is afforded the right to verify at your premises that subcontracted product conforms to specified requirements? Where is this procedure defined?

Control of production and service provision

• Availability of information on product requirements
• Availability of work instructions
• Implementation of monitoring and measurements
• Implementation of release, delivery and post delivery activities?

Validation of processes of production

• Does the company validate the products prior to delivery to ensure that the processes that cannot be validated after the processes have been carried out?
• The validation of the special processes shall include:
• Defined criteria for the validation and approval of the processes
• Approval of equipment and qualification of personnel
• Use of specific methods
• Requirements of records
• Revalidation

Identification and tractability

• How is this product / service identified? Where is this defined (documented)?
• Does the company identify the product status throughout its production processes?
• Hoe is product identification and tractability maintained from receipt and during all stages of processes?
• Where and, to the extent that tractability is a specified requirement, how is the need for tractability communicated to respective process function? Can you show me an example for how this works? How and where is tractability recorded? May I see an example?
• Is the monitoring / measurement status, such as rejects, accepts, waived identified?
• Are there any specific requirements for tractability of the products?

Customer Property

• What are the customer property received and handled by the organization?
• Are these customer properties handled in appropriate manner?
• Is customer property examined upon receipt to check for, correct quantity? correct identity? any transit damage?
• How is discrepancy reported to the customer?
• How is customer property identified to differentiate it from other product? Where is this defined (documented)?
• How is customer property stored? How are special storage and maintenance requirements communicated from the customer to those responsible for its storage and maintenance?
• Who is responsible for the stage and maintenance of customer property? Where is this authority defined?
• Is customer property periodically inspected to detect signs of deterioration? Verify that proper storage conditions are being maintained? Identify product that has exceeded its storage time limitations (expiration date)?
• If customer property is lost, damaged, or otherwise unsuitable for use, how is each instance recorded and reported to the customer? Where is this documented?
• Who is responsible for reporting customer property that is lost, damaged, or otherwise unsuitable for use to the customer?

Preservation of products

• Is there handling, packaging, storage and protection and protection of the final products / services prior to customer usage?
• What methods have you adopted / developed for handling products / services that prevent damage or deterioration? Where is this defined (documented)?
• What criteria are used in assessing the condition of product in stock in order to detect deterioration? Do any records substantiate that this has occurred?
• How are packing, packaging, and marking processes (including material used) controlled to the extent necessary to ensure conformance to specified requirements? What evidence supports that this control is in place and effective?
• How do you arrange for the protection of the quality of product / service after final inspection and test? Where contractually specified, does this protection extend to include delivery to destination? (e.g.; use of approved suppliers)? How can this be verified?

Control of monitoring and measuring devices

• Does the company determine and provide monitoring and measuring devices to provide evidence of conformity of the products to requirements?
• Who is responsible for determining the measurements to be made and the accuracy required? How is this determined? Where is this documented?
• Who is responsible for selecting the appropriate inspection, measuring, and test equipment and ensuring that it is capable of the necessary accuracy and precision? Where is this documented?
• Who is responsible foe identifying all inspection, measuring, and test equipment that can affect product quality? Does this include employee-owned equipment? Who ensures that this equipment is calibrated and adjusted at prescribed intervals, or prior to use?
• How is inspection, measuring, and test equipment that has exceeded its calibration due date identified and handled?
• Does your calibration system defined the process employed for the calibrated of inspection, measuring, and test equipment, including details?

Equipment Details

• Equipment type?
• Unique identification?
• Location?
• Frequency of checks (calibration interval)?
• Check method – (calibration procedure)?
• Acceptance criteria?
• Action to be taken when results are unsatisfactory?
• Where is this defined (documented)?
• Are these devices:
• Calibrated or verified at defined intervals against national and international standards. Where no such standard exist, is the basis used for calibration documented? How can this be verified?
• Adjusted and re-adjusted as necessary
• Safeguarded from unwanted adjustments
• Protected from damage and deterioration during handling, maintenance and storage?

Equipment Maintenance

• Show the calibration status?
• How do you safeguard inspection, measuring and test facilities, including both test hardware and test software, from adjustments that would invalidate the calibration setting? (Do you require the use of tamper-resistant seals? Do you “write-protect” or “password-encrypt” test software?)
• How do you ensure that the environmental conditions are suitable for the calibrations, inspections, measurements, and test being carried out? Is there any documented evidence to support this?
• Does the company validate past test results if there is a failure of the measuring / monitoring devices?
• What calibration records does your calibration system require you to maintain?

Measurement, analysis and improvement

• Does the company use appropriate methods to demonstrate conformity of the products, conformity of the quality management systems to requirements and continually improve the effectiveness of the quality management system?
• What are these methods?
• Does the company monitor information relating to customer perceptions as to whether the company has met customer requirements?
• The methods for obtaining such information shall be defined?
• Who is responsible for maintaining and managing your internal audit program?

QMS

• Does the company conduct internal audit at planned interval on the conformance of the quality systems?
• How are internal audits scheduled? (on the basis of status and importance of the activity?)
• What criteria do you use for determining the effectiveness of the quality management system?
• Have training and qualification requirements for auditors been defined and documented? Are records available that detail the training and qualification of each internal auditor?
• Is a formal schedule for internal quality audits prepared and authorized? May I see it? How can I verify that this schedule is being followed?
• Are the results of internal audits recorded? How can I verify that all of the applicable requirements of ISO 9001:2000 have been audited?
• Are auditors selected and trained so that they do not audit their own work?
• Is the procedure for the internal audit documented? Does the procedure include the necessity of corrective actions after the audits?
• How do you ensure that management personnel responsible for the are audited take timely corrective action on deficiencies found during the audit? How do you define the word “timely”?
• When do you conduct follow-up audit activities that verify and record the implementation and effectiveness of the corrective action taken? How is this documented?
• Does the company keep records of audit and follow up verification of the corrective actions?
• How are the results of the audits input to management review activities?

Monitoring and measurement of product

• Are the planned results for each of the processes defined?
• Are there methods to track and monitor these planned results areas?
• Does the activities include
• Does the company define the measurements of product characteristics at various stages of the production process or service provision process?
• Is evidence / records of conformance kept?
• Do such records indicate the authority for release of products?
• Are there measures to ensure that only products conforming to all the requirements are dispatched to the customers?

Control of nonconforming product

• Are the procedures to ensure that the nonconforming products are in control to prevent inadvertent uses?
• Is there a procedure are properly document. To define authority and responsibility for the disposition of nonconforming products?
• How do you ensure that product which does not conform to specify requirements is preventing from unintends use or installation?
• How do you provide for identification, documentation, evaluation, segregation (when practical), disposition of nonconforming product, and for notification to the functions are concern?
• Who is authorized and responsible for review and the disposition of nonconforming product? Where is this define (Filling)?
• Are the records for the disposition for the nonconforming products kept including the concession (waiver) of the products?
• Does the procedure specify clearly that corrected nonconforming products shall be re-verified for conformance?
• Is the repair of rework instructions accessible and utilized by the appropriate personnel?
• When required by contract, how do you report the proposed used or repair of product that does not conform to specified requirements for concession to the customer or customer’s representative?
• How do you ensure that customer authorization is received prior to shipping nonconforming material?
• How is the description of nonconformity that has been accepted, and any repairs, recorded to denote the actual condition?

Analysis of data

• Does the company collect and analyses data to monitor and improve quality management system?
• The data analyzed shall include:
• Customer satisfaction
• Conformance of product requirements
• Trend of product characteristics including opportunities for preventive actions
• Suppliers?

Corrective action

• Does the organization have a documented procedure on corrective actions on customer complaint and product nonconformity?
• Does the procedure address:
• Reviewing nonconformity
• Determining the causes
• Evaluating the needs for actions
• Determining the actions needed and implement the actions
• Records of the results
• Reviewing of the corrective actions taken?
• How do you ensure the effective handling of customer complaints and reports of product nonconformity?
• Who is responsible for investigation of the cause of nonconformity relating to product, process, and quality system, and recording the results of the investigation? Where is this documented?
• Who is responsible for determination of the corrective action is conducts?. To eliminate the causes of nonconformity? Where is this  require to define it?
• Who is responsible for the application of controls to ensure that corrective action is timely conduct and that it is effective? How is this demonstrate?

Preventive action

• Does the organization have a documented procedure on corrective actions on customer complaints and product nonconformity?
• Does the procedure address:
• Reviewing nonconformity
• Determining the causes
• Evaluating the needs for actions
• Determining the actions needed and implement the actions
• Records of the results
• Reviewing of the corrective actions taken?
• How do you ensure the effective of customer complaints and reports of product nonconformity?
• Who is responsible for investigation of the cause of nonconformity relating to product, process, and quality system, and recording the results of the investigation? Where is this documented?
• Who is responsible for determination of the corrective action that require to eliminate the cause of nonconformity? Where is this define?
• Who is responsible for the application of controls, to ensure that corrective action is conducting at time. And Its effectiveness and demonstration are conduct properly?
• What have you defined as “appropriate” sources of information (such as processes and work operations that effect product quality, concessions, audit results, quality records, service reports and customer complaints) to detect, analyze, and eliminate potential causes of nonconformity?
• Who is responsible for determination of the steps that require to deal with any problems requiring preventive action? How is this determination?
• Who is responsible for initiation of preventive action and application of controls to ensure that it is effective?
• How is the “effectiveness” of preventive action are determine & measure for QMS?
• How is relevant information on actions is perform as well submit to management review?. What form does this take? How can I verify this?