ISO 900 Sample Internal Audit Checklist Section 5
4.1 General Quality System Requirements
Has the organization established, documented, implemented and maintained a quality management system in accordance with the ISO 9001 Requirements
Is the Quality Management System (QMS) continually improving?
Does the organization:
1) Identified the process needed for the QMS throughout ISO9001 the organization?
2) Determined the proper interaction between the process ISO9001 Is there a flow chart that shows the process flow for the entire organization?
3) Determined and document criteria and methods to ensure ISO9001 that the operations and process control are effective?
4) Have resources and information necessary to support ISO9001 the operation and maintenance of their process.
5) Measure, monitor and analyze their processes?
6) Implement corrective and preventive actions needed to achieve the planned results as documented in the quality plans?
7) Does the company have documentation to show continuous improvement of their process?
Does the organization have documentation in accordance with the requirements of the ISO 9001 Standard
How does the company control quality processes that are performed outside of the ISO approved facility?
4.2 Documentation Requirements
4.2.1 General
Does the QMS documentation system include:
1) Quality Manual?
2) Documented company quality policy and quality objectives?
3) Documented level 1 and level 2 procedures as required by ISO 9001?
4) Document how the company can effectively plan, operate and control its processes?
5) Creation and management of Records that demonstrate compliance the ISO standard?
4.2.2 Quality Manual
Has a quality manual been created and maintained the includes:
1) The scope of the quality management system and any justification for exclusion to the standard (such as obsolete product lines)?
2) Description of the interaction between the process of the quality management system (usually in the form of a flow chart showing product flow from design and order to delivery and service)?
3) The procedures required by the ISO standard or references to the required procedure control numbers (usually the general statements are in the quality manual and the detailed procedures are separate documents)?
4.2.3 Control of Documentation
Are all QMS documents (manuals, procedures, data sheets, work instructions, records, and procedures) controlled (including revision control, controlled access to originals, control of distributed copies)?
Does the company have a document control procedures that including:
1) Notification of the ISO approval body prior to implementation of any change to a agency controlled document?
2) Approval, update and distribution processes for changes to all quality documents (May be part of the ECO procedure)?
3) Ensure that the current revision documents (with no confusion about the current revision) are available at the point of use?
4) Ensure that the documents remain legible and easily identifiable?
5) A process for controlling documents of external origin
6) Control of obsolete documents to assure they are not used in current production.
4.2.4 Control of Records
Does the company create and maintain records ?
Does the company have records to provide evidence that the QMS is effective (examples include management review records, corrective and preventive actions logs, customer survey or feedback records)?
Has a documented procedure been written to define the following record control mechanisms:
Identification and retrieval?
Storage and protection?
Retention time and Disposition?
This check list will cover management commitment, customer focus, quality policy and management review. This section will require participation from the top management and from the quality representative. The quality representative should be the best source for information about the management reviews.
Question / Reference Documents / Notes
5.0 Management Responsibility
5.1 Management Commitment
Has top management provided evidence of its commitment to the development and maintenance of the QMS including
a) Communication of the importance of meeting the customer regulatory and legal requirements.
b) maintaining and communicating the quality policy.
c) Ensuring that quality objectives are established and routinely evaluated.
d) Routinely (once per year minimum) conducting management reviews of the QMS.
e) Ensuring the QMS is given adequate resources.
5.2 Customer Focus
How does top management ensure that customer requirements are determined and their needs are meet?
What program exists to increase customer satisfaction?
5.3 Quality Policy
How does top management ensure that the quality policy:
a) meets the need of the organization
b) Continuously improves
c) Is communicated and understood throughout the organization ( Has the entire organization been trained on the QMS)
d) is periodically reviewed
5.4 Planning
5.4.1 Quality Objectives
Are the Quality objectives consistent with the quality policy?
Are the quality objectives measurable ?
Are quality objective set for appropriate levels of the organization?
5.4.2 Quality Management System Planning
How has top management assured that the resources needed to achieve the quality objectives are identified and planned?
If the output from planning objectives documented (ex. work instructions, procedures, quality manual, quality plans, etc)?
5.5 Responsibility Authority and Communication
5.5.1 How has top management ensured that the responsibilities and Authority are defined and communicated within the organization (Org Charts and/or Quality responsibly defined in training records)?
5.5.2 Management Representatives
Has top management assigned member of management who have the responsibility and authority ( and which document defines these tasks):
Ensuring that processes are established, implemented and maintained (usually engineering and quality personnel)?
Reporting to top management on the status of the QMS including areas that need improvement (usually presenter of the QMS status in the management review meeting)?
Promote the critical nature of meeting the customer’s requirements in every level of the organization (usually the quality or customer service manager)?
5.5.3 Internal Communication
How does top management ensure that communication of quality issues is communicated throughout the organization (what process or document defines this flow)?
5.6 Management Review
Does Management review the QMS at planned intervals to ensure the effectiveness of the plan ?
Are records of the management review kept maintained as quality records?
Are the minimum requirements for a management review described in a procedure?
Does the management team meet at least once per year?
5.6.2 Management Review Input
Does the management review include the all of the following sources for quality information:
Customer feedback? What procedure describes how customer feedback is gathered and presented?
Result of both internal and external audits (including findings and follow-up items)?
Action items from previous management review meeting?
Corrective and preventive actions?
Any significant items that could affect the QMS (changes in personnel, training requirements, new products, etc...)?
Product conformity and process performance metrics?
5.6.3 Management Review Output
Is the feedback from the management review tracked to ensure that quality is continuously improving (maybe using corrective and preventive actions system)?
Are the outputs from the management review given the proper resources for corrective and preventive action?
This audit check sheet covers section 6 of the standard so it is focused on Human resources. It is a very short piece of the overall requirements but training is heavily audited area. The standard requires all employees to be trained OR qualified. All employees should be trained on their standard operating procedures, the use of the quality system, and how to be audited. This checklist also covers Infrastructure and work environment. This audit may require the attendance of the management representative, personnel, and a production or service manager
Question / Reference Documents / Notes
6.1 Human Resources
Are all employees who effect the quality of product or services qualified or trained to ensure consistent output?
Has the organization provided appropriate training to satisfy the customer requirements?
What quality records show training requirements (does the requirement include a training interval)?
What records show that training is completed?
Has the company provided quality awareness training for employees of the importance of quality, the quality system, and the importance of meeting the quality objectives and the customer requirements?
Are records maintained to prove that all employees are either trained or qualified to perform their job in accordance with quality standards?
6.2 Infrastructure
How does the organization maintain equipment used to control the quality of the products and services?
How does the organization control hardware and software used in the production of product?
How does the organization assure that the building and environment are maintained in order to provide consistent quality?
6.3 Work Environment
How does the organization assure that the environment is sufficient to provide consistent product conformity?
This check sheet includes questions on product realization (production) and order entry including all customer contacts. It also includes design control, purchasing control, inventory control and control of measuring equipment.
Because the checklist touches so many areas and will require interviewing so many different people, you may want to split this audit between different people or different days. You will need to get access to production personnel, design engineers, purchasing personnel, order entry and inventory people.
Question / Reference Documents / Notes
7 Product Realization
7.1 Planning
Is the planning of product realization process integrated into the entire quality system? (specifically management review)
Are the following being reviewed during the product planning:
a) Quality objective, Product specification
b) The need for additional processes, resources, and documentation
c) Requirements for verification, validation, monitoring, inspection, and test requirements
d) Are record maintained for all stages of the development process
7.2 Customer Related Processes
Has the organization determined the:
a) Requirements specified by the customer including delivery and post-delivery activities (training and installation, support, etc)
b) Requirements not specified by the customer but necessary to use the product for its intended purpose (proper application, safe operation, integration with other products )
c) Regulatory and statutory requirements related to the product
d) Any additional requirements determined by the organization (limitations, warranty, special requirements)
7.2.2 Review of the requirements related to the product
Are the requirements reviewed prior to commitment to the customer (acceptance of contracts or change orders)
Does the company have the following information prior to commitment:
a) Full product specification
b) Contract or order requirements difference from previous orders
c) Ability of the organization to meet the customer requirements
Are the order review and actions from the order review recorded and maintained as a quality record?
Is the critical order information 100% complete prior to acceptance?
Are changes to the product requirement (including change orders) communicated to all appropriate levels of the organization?
7.2.3 Customer Communication
What system does the company use for customer communication of:
a) Product specifications and information (salesmen, web site, spec sheets)
b) Inquiries, contracts, change orders and new orders
c) Customer feedback including customer complaints (like Corrective and Preventive Actions)
7.3 Design and Development
Are product design and development activities planned and controlled? Using what documents?
Does the design and development plan (sometimes called a quality plan) include:
a) Different stages of development
b) Design reviews at appropriate stages
c) Verification of the design to the design specifications
d) Validation (official sign-off) of the design against the critical specifications
e) Responsibilities and authorities of personnel involved in the design process
How are the interfaces between different groups defined and managed to ensure proper communication?
Is the planning output updated as the design progresses (ex: revision control of specification)
7.3.2 Design and Development Inputs
Are inputs relating to the product design requirement defined documented and maintained as a record (sometimes call a design specification)?
Does the design and development input include:
a) Functional and performance requirements?
b) Applicable statutory, regulatory, and legal requirements?
c) Applicable information for previous designs (are they learning from their mistakes)?
d) Other requirement essential to design and development
Are the design inputs review for overall integrity, quality and completeness (design review)?
Are incomplete, conflicting and ambiguous requirements correct?
7.3.3 Design and Development Outputs
Are the outputs of the design and development process in a form that allows for verification against the design and development inputs?
Does the design and development output:
a) Meet or exceed the design and development input (
b) Include appropriate information for fabrication, purchasing, production and service of the product?
c) Contain and reference product acceptance criteria
d) Specify the product characteristics that are essential for the safe and proper use (limitation)?
7.3.4 Design and Development Reviews
Are systematic reviews completed at suitable stages in accordance with the design and development plan?
Do design reviews evaluate the ability of the design to meet the ?design specification??
Do design reviews identify problems and propose necessary corrective actions?
Do design reviews include appropriate representatives from all the areas affected by the design?
Are results of design reviews maintained as quality records?
7.3.5 Design Verification
Is the design verified against the product design specifications?
Are the verification results maintained as quality records?
7.3.6 Design Validation
Is the design validated by qualified personnel?
Is the design validation performed to confirm that the product meets the design specification?
Is validation testing completed prior to delivery of the product?
Are the results of the validation testing maintained as quality records?
7.3.7 Design Control
Are design specification changes identified and recorded?
Do design changes include evaluation of effects on subcomponents and existing products in the field?
Are design specification changes reviewed, verified and validated before implementation?
Are design specification changes recorded and maintained as a quality record?
7.4.1 Purchasing Control
How are the purchasing processes controlled to ensure that the purchased products and services conform to the specifications or requirements? What is the procedure number?
How are critical safety-related parts or key components and services given special attention?
Are suppliers selected and evaluated based on their ability to supply conforming product?
How does the organization establish criteria for selection and evaluation of suppliers?
Are supplier periodically re-evaluated to determine their compliance with the requirement of the company?
Are evaluations maintained as quality records?
Are copies of corrective actions sent to suppliers maintained as quality records?
7.4.2 Purchasing Control
Does the purchasing information describe the requirements for approval of products, procedures and equipment?
Does the purchasing information describe the requirements for a quality management system (including ISO 9000 or equivalent)?
How are the specifications for purchased parts and services checked prior to communication to the supplier?
7.4.3 Verification of Purchased Product
Are inspection and incoming testing requirements specified to ensure that purchased parts conform to the specification (Give an example)?
Are inspection and incoming testing requirements specified in the purchasing information whenever the inspection or incoming testing is completed by the supplier (Give an example)?
7.5.1 Control of Production and Service Provision
Is information about the product requirements available to production and service personnel?
Are work instructions used where required?
Is suitable equipment available to production and service personnel?
Is monitoring / measuring equipment available to production and service personnel?
Is information about the release, delivery and post delivery (installation and service) available to production and service personnel?
7.5.2 Validation of Processes for production and service provision
Does the company validate products and service to assure no latent failures?
Are process validated against the quality plan?
Are criteria for review and approval of production and service processes defined?
Is production and service equipment approved for use?
Are production and service personnel qualified for the appropriate processes?
Are record requirements established as part of the quality plan?
Are plans made for re-validation if required?
7.5.3 Identification and Traceability
Is the product uniquely identified throughout the product realization (production process)?
Is the product status (conforming/non-conforming) identified with respect to measurement and monitoring requirements?
When traceability is required, is the product uniquely identified and controlled?
Is the unique identification information maintained as a quality record?
7.5.4 Customer Property
Does the company ever maintain customer property (including units return for service)?
Does the company exercise care with customer property while it is in the control of the organization?
Is customer property identified, verified, and protected?
If the customer property is lost, damaged or found unsuitable for use, is the condition recorded, reported to the customer, and is this information maintained as a quality record?
7.5.5 Preservation of product
How is the product preserved during internal processing and delivery?
Is the product identified during processing?
Do preservation activities include handling, packaging, storage, and protection?
Are preservation activities applied to component and sub-assemblies?
7.6 Control of Measuring and Monitoring Devices
Has the company determined the monitoring and measurement requirements needed to ensure conformity of the product to the requirements?
Have processes been established (and documented) to ensure that monitoring and measurement are carried out in a consistent manner?
Is measurement and monitoring equipment calibrated or verified at specified intervals prior to use?