ISO 9001 Checklist: What to Check, What Evidence to Keep
Review the quality controls behind your everyday work, from customer requirements to delivery and improvement. Use 31 practical ISO 9001:2026 checks to identify what is in place, what needs evidence and what to do next.
Answer first. Enter your name, company and email at the end to receive your free report.
In this guide
Start with one real piece of work
This checklist is for business owners, operations managers and quality teams building a first quality management system (QMS), reviewing an existing one or preparing an internal audit. Follow a recent order or service from the customer’s request through planning, purchasing, delivery and feedback. Ask the people involved to show how decisions were made and which records they kept.
- Compare what your system says should happen, what people actually do and what the evidence shows. A blank template does not demonstrate that an activity happens.
- Record the evidence examined, the gap, the person responsible and the next action. Use a representative sample rather than assuming one well-kept file reflects every location or project.
- Use the applicable standard and actual business requirements when planning a formal audit. These 31 checks are an initial review of important activities, not an exhaustive clause-by-clause audit.
Shared checks: scope and leadership
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause ISO 9001 · 4.3Does each selected management system have a scope that matches your actual activities, locations and responsibilities?
Evidence to look for: Current scope statements and a representative work example for every selected system. Include activities under your control or influence and review any claimed non-applicability.
Next action: Review each scope with management and process owners; resolve omitted activities or responsibilities before relying on the assessment.
Clause ISO 9001 · 4.1–4.2Do you review the internal and external issues and interested-party requirements affecting each selected system?
Evidence to look for: A considered review of relevant business conditions, workers, customers, regulators and other interested parties, with responsibility for keeping it current.
Next action: Review the relevant issues and requirements separately for each selected system and feed changes into planning.
Clause ISO 9001 · 4.1–4.2Have you assessed climate change and relevant interested-party climate requirements for each selected system?
Evidence to look for: A reasoned relevance assessment and actions where relevant, such as supply disruption, environmental conditions or worker exposure to heat. The same conclusion need not apply to every system.
Next action: Assess climate considerations for every selected system and address relevant issues in its controls and planning.
Clause ISO 9001 · 5.1, 5.3Does leadership take responsibility, assign clear roles and provide resources for each selected system?
Evidence to look for: Recent decisions, allocated resources, clear responsibilities and follow-up showing leadership involvement across all selected systems.
Next action: Agree accountable owners, decision authority, resources and follow-up for unresolved system issues.
Shared checks: competence and information
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause ISO 9001 · 7.2Can you demonstrate that people affecting each selected system are competent for their work?
Evidence to look for: Role-specific competence requirements, relevant experience or training, and evaluation of development actions, including people working under your control.
Next action: Identify competence gaps, take suitable development action and verify performance on the task.
Clause ISO 9001 · 7.5Can people find current controlled information and retrieve protected records for every selected system?
Evidence to look for: Identifiable versions, approvals, access controls, retention and retrieval arrangements, verified at the point of use. A blank template alone is not implementation evidence.
Next action: Check documents and completed records in each system; resolve obsolete copies, missing approvals or retrieval problems.
Clause ISO 9001 · 7.4Are relevant communications for every selected system planned and delivered to the right people?
Evidence to look for: Decisions on what, when, with whom and how to communicate, plus examples of accurate internal and relevant external communications.
Next action: Clarify communication responsibilities and verify that affected people receive understandable, reliable information.
Shared checks: review and improvement
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause ISO 9001 · 9.1Do you evaluate performance and effectiveness for each selected system using reliable information?
Evidence to look for: Suitable monitoring and evaluation methods, useful trends, reliable measurement where needed and decisions made from the results for every selected system.
Next action: Agree useful measures, validate the information and act on the results rather than only collecting data.
Clause ISO 9001 · 9.2Have internal audits checked the requirements and implementation of every selected system?
Evidence to look for: A documented audit programme with objectives, scope, criteria, impartial auditors, completed findings and follow-up. An integrated audit identifies which standards and processes were examined.
Next action: Plan and complete audits covering every selected system, considering process importance, changes and previous findings; follow up actions.
Clause ISO 9001 · 9.3Has management reviewed each selected system and recorded decisions and follow-up?
Evidence to look for: Completed reviews using the relevant performance, changes, audit findings and stakeholder information for each system, with decisions on improvement, changes and resources.
Next action: Bring the required system-specific information to management and record decisions, owners, resources and follow-up.
Clause ISO 9001 · 10.2Do nonconformity and corrective-action processes investigate causes and verify effectiveness across the selected systems?
Evidence to look for: Examples showing immediate correction, causes, consideration of similar issues, corrective actions and effectiveness reviews. One closed item does not demonstrate all systems operate this way.
Next action: Investigate recurring or significant problems, address causes and verify results after suitable subsequent work.
Clause ISO 9001 · 10Can you demonstrate continual improvement in each selected system?
Evidence to look for: Implemented improvements linked to performance, audits, feedback or reviews, with results demonstrating their effect.
Next action: Select relevant improvements, assign owners and compare outcomes before and after implementation.
ISO 9001: quality planning and people
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause ISO 9001 · 4.4Are QMS processes, their interactions and controls understood and maintained?
Evidence to look for: A process description or map showing inputs, outputs, owners, controls and measures, supported by an actual order or service example.
Next action: Trace a piece of work end to end and clarify process ownership, handovers and effectiveness measures.
Clause ISO 9001 · 5.1Does leadership actively promote a quality culture and ethical behaviour?
Evidence to look for: Leadership decisions and everyday practices showing honest reporting, appropriate escalation of quality concerns and consistent quality expectations under delivery pressure.
Next action: Agree expected behaviours, support people raising quality concerns and review whether management decisions reinforce them.
Clause ISO 9001 · 5.2Is the quality policy aligned with your business context and strategic direction?
Evidence to look for: An approved policy supporting the business direction, customer requirements and quality objectives, with evidence it is communicated and applied.
Next action: Review the policy against the current strategy and context, then explain its practical implications to the team.
Clause ISO 9001 · 6.2Are quality objectives measurable, assigned, monitored and reviewed against actual results?
Evidence to look for: Quality objectives and plans linked to the policy and relevant work, with measures or verifiable criteria, owners, resources, timing and evaluation of results. Measurable does not necessarily mean a numeric target.
Next action: Define how achievement will be verified, assign actions and resources, monitor progress and update objectives when needed.
Clause ISO 9001 · 6.1Have you identified and addressed risks that could prevent the QMS achieving its intended results?
Evidence to look for: Appropriate controls for delivery risks such as supplier failure or repeated rework, integrated into processes and evaluated for effectiveness.
Next action: Prioritise relevant quality risks, implement proportionate controls and evaluate whether the actions worked.
Clause ISO 9001 · 6.1Do you separately identify and act on opportunities to improve quality and beneficial business outcomes?
Evidence to look for: Considered opportunities such as better handovers, new capabilities or improved customer service, with decisions, planned actions and evaluated results.
Next action: Identify worthwhile opportunities, agree actions and resources, and evaluate the benefits achieved.
Clause ISO 9001 · 6.3Are QMS changes planned, communicated and reviewed for their effects?
Evidence to look for: A recent change considering its purpose, consequences, resources, responsibilities, system integrity, communication and subsequent results.
Next action: Plan the next change before implementation, inform affected people and review its effectiveness.
Clause ISO 9001 · 7.1Are people, infrastructure and working conditions adequate for reliable quality outcomes?
Evidence to look for: Capacity, equipment and maintenance decisions, suitable working conditions and action on constraints affecting product or service conformity.
Next action: Review resource constraints with process owners and provide suitable resources and maintenance.
Clause ISO 9001 · 7.1.5Can you trust the monitoring and measuring resources used to verify product or service conformity?
Evidence to look for: Fitness for purpose and calibration or verification where required, identified status, and review of previous results if resources prove unreliable.
Next action: Identify acceptance-check resources, establish necessary controls and investigate previous work where results may be invalid.
Clause ISO 9001 · 7.1.6Is necessary organisational knowledge available and maintained when people or processes change?
Evidence to look for: Accessible knowledge for critical tasks, lessons from experience, and arrangements for acquiring and preserving knowledge when key people leave or work changes.
Next action: Identify knowledge held by only one person, make it accessible and plan how to acquire missing knowledge.
Clause ISO 9001 · 7.3Do people understand their contribution to quality culture, ethical behaviour and QMS effectiveness?
Evidence to look for: People can explain quality expectations, their contribution, how to raise concerns, and the effects of failing to meet requirements using real work examples.
Next action: Brief people on practical quality and ethical expectations, then check understanding through actual work.
ISO 9001: delivery and customer outcomes
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause ISO 9001 · 8.2Do you confirm customer and applicable product or service requirements before committing to work?
Evidence to look for: Reviewed quotes or contracts covering requirements, obligations, capability, delivery, customer communication and agreed changes.
Next action: Check a recent order for differences between what was promised, understood and delivered.
Clause ISO 9001 · 8.3Where you design products or services, do you control inputs, reviews, verification, validation and changes?
Evidence to look for: A design example showing inputs, outputs, reviews, checks for conformity and intended use, and authorised changes.
Next action: Trace a design decision and verify that outputs meet both the inputs and intended use.
Clause ISO 9001 · 8.4Do you control external providers according to their effect on quality?
Evidence to look for: Provider selection and evaluation criteria, communicated requirements, acceptance checks, performance monitoring and resulting decisions.
Next action: Review a critical supplier or subcontractor, clarify requirements and check whether the controls are effective.
Clause ISO 9001 · 8.1, 8.5Is work delivered under controlled conditions with identification, traceability and validation where needed?
Evidence to look for: A work example with instructions, competent people, process controls, acceptance status and relevant traceability or validation of results that cannot be checked afterwards.
Next action: Walk through a current job and address missing controls, including processes whose output cannot be fully verified later.
Clause ISO 9001 · 8.5Do you protect outputs and external property, manage delivery changes and address post-delivery responsibilities?
Evidence to look for: Handling, storage and handover controls, protection of customer or provider items and information, authorised changes, and relevant service or warranty follow-up.
Next action: Review where items or information can be damaged, lost or misused; confirm change authority and post-delivery arrangements.
Clause ISO 9001 · 8.6Are outputs checked against acceptance criteria and authorised before release?
Evidence to look for: Completed acceptance checks and traceable release authority, including appropriately authorised exceptions.
Next action: Clarify release criteria and authority and retain evidence for a completed product or service.
Clause ISO 9001 · 8.7Can you identify and control defective outputs or service failures before unintended use or delivery?
Evidence to look for: A problem example showing identification, containment, disposition, authority, concessions where applicable and checks after correction.
Next action: Establish how to flag and contain a failure, decide its disposition and verify corrected outputs.
Clause ISO 9001 · 9.1.2Do you evaluate customers’ perceptions and act on recurring concerns?
Evidence to look for: Relevant feedback from complaints, conversations, surveys or reviews, analysed and used in decisions. No complaints alone is not sufficient evidence.
Next action: Seek representative customer feedback and investigate recurring concerns.
Which ISO 9001 documents and records do you need?
Think in two practical groups: information that guides work, and records that show what happened. The amount and format of documentation should fit your business and the applicable requirements. ISO does not prescribe a separate document with every title listed in an online checklist.
- Start with your scope, quality policy and objectives, then sample records of competence, customer requirement reviews, supplier evaluation, acceptance checks, audits, management review and corrective action. Consider design, measurement and traceability records where relevant.
- Open a document where staff use it. Confirm that it is approved, current and easy to identify. Retrieve a completed record and check that you can tell what happened, when and who made the decision.
- A quality manual may help organise your system. Choose a useful format for the documented information required by the published standard and your actual processes; an online list of document names does not establish what your business needs.
Example: turn a repeated error into a corrective action
Imagine a service business repeatedly sending incorrect job reports. Fixing each report resolves the immediate mistake, but the error returns. A review finds that staff copy an old report because the current version is hard to find. A useful action plan would:
- Identify affected reports and correct them, communicating with customers where needed.
- Investigate why the old version remained available and whether other teams have the same problem.
- Agree one controlled location for the current report, remove superseded working copies and clarify who maintains it.
- Explain the revised process to affected staff. Review a suitable sample of subsequent reports to check whether the error has stopped.
- Keep the issue, correction, cause investigation, changes and follow-up results together. This is an illustrative example: the response and timing must reflect the actual problem.
What should you do after the checklist?
Start with issues that could affect customers, release incorrect work or leave an important process uncontrolled. Ask process owners to verify uncertain answers. Assign practical actions with an owner, target date and a clear description of completion.
- Keep the immediate correction separate from work to prevent recurrence.
- Check effectiveness after enough subsequent work has taken place to evaluate the improvement.
- Bring unresolved issues and resource decisions to management. The self-check report helps organise your findings; your team still needs to verify the answers.
Which ISO 9001 edition does this checklist use?
This checklist is a practical initial review based on ISO 9001:2026, published on 16 September 2026. It includes quality culture and ethical behaviour, policy alignment with strategy, distinct consideration of risks and opportunities, and the existing climate considerations. It is not an exhaustive clause-by-clause audit. Confirm applicable certification transition arrangements with your certification body.
- Already certified? Use this review to organise your current evidence and unresolved actions. Blue Safe’s transition readiness service can help you plan updates to your existing system.
ISO 9001 transition readiness
Already certified to ISO 9001:2015?
Review your current QMS now, then plan the definitive upgrade against the published new edition and applicable transition arrangements.
Frequently asked questions
Will completing this checklist make my business ISO 9001 certified?
No. It helps identify areas to investigate and improve. Certification involves an independent assessment against the applicable standard. Self-reported answers are not that assessment.
Can a small business use this checklist?
Yes. Begin with the work you actually carry out, the responsibilities people hold and the records you use. ISO 9001 applies to organisations of different sizes and sectors.
What if I am not sure of an answer?
Select “Not sure” in the self-check. The report will identify something to verify, rather than claiming a confirmed nonconformity. Ask the responsible person to show the activity and evidence.
Can I exclude questions that do not apply?
The tool allows a reasoned “Not applicable” answer for selected conditional checks. It records your judgement for review; it does not approve an exclusion. Consider actual responsibilities, including outsourced work, and check the standard.
How do I get my report?
Answer the questions, then enter your name, company and email. View your results after submitting and receive a copy by email. Your phone number is optional. The report includes your answers, areas needing attention and suggested actions.
How does Blue Safe help me implement the actions?
Blue Safe supports controlled documents, audits, corrective actions and management-system evidence. Businesses with an existing certified system can also discuss transition readiness and planned document updates.
Next step
Use this guide to check your current evidence, then move the work into a controlled system with documents, forms, registers, and review actions.
Start the free ISO 9001 self-check