ISO 9001 Checklist: What to Check, What Evidence to Keep
Review the quality controls behind your everyday work, from customer requirements to delivery and improvement. Use 28 practical checks to identify what is in place, what needs evidence and what to do next.
Answer first. Enter your name, company and email at the end to receive your free report.
In this guide
Start with one real piece of work
This checklist is for business owners, operations managers and quality teams building a first quality management system (QMS), reviewing an existing one or preparing an internal audit. Follow a recent order or service from the customer’s request through planning, purchasing, delivery and feedback. Ask the people involved to show how decisions were made and which records they kept.
- Compare what your system says should happen, what people actually do and what the evidence shows. A blank template does not demonstrate that an activity happens.
- Record the evidence examined, the gap, the person responsible and the next action. Use a representative sample rather than assuming one well-kept file reflects every location or project.
- Use the applicable standard and actual business requirements when planning a formal audit. These 28 checks are an initial review of important activities, not an exhaustive clause-by-clause audit.
Clause 4: Context and scope
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 4.3Does your QMS scope describe the products, services and activities it covers?
Evidence to look for: A current scope statement covering your actual activities and locations, with reasons for any requirements considered not applicable.
Next action: Confirm the scope with management and process owners; review any non-applicability decisions.
Clause 4.1–4.2Have you identified the business issues and interested-party requirements that affect quality?
Evidence to look for: A review of customer expectations, relevant obligations, supplier dependencies, staffing constraints and business changes.
Next action: Identify which issues and requirements can affect delivery, and assign someone to keep them under review.
Clause 4.1–4.2, Amd 1:2024Have you considered whether climate change affects your QMS and relevant interested-party requirements?
Evidence to look for: A reasoned relevance decision and, where relevant, consideration of disrupted supplies, temperature-sensitive work or customer climate requirements.
Next action: Review climate relevance with process owners and address relevant issues through your planning. A finding that climate is not relevant still needs a considered basis.
Clause 4.4Can your team explain how work moves between processes and who owns each handover?
Evidence to look for: A process description or map showing inputs, outputs, controls, owners and measures, supported by an actual job example.
Next action: Follow one job from enquiry to completion and clarify ownership, checks and handovers.
Clause 5: Leadership
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 5.1Does management act on quality issues and provide the resources needed to address them?
Evidence to look for: Decisions on recurring defects, customer needs or resource problems, followed by completed actions.
Next action: Bring a current quality issue to management and agree the decision, resources, owner and follow-up.
Clause 5.2Is your quality policy relevant to your business and understood by the people who use it?
Evidence to look for: An approved current policy and staff who can explain how it relates to their work.
Next action: Review the policy and use practical work examples when explaining it to the team.
Clause 5.3Do people know who may approve work, handle quality problems and report QMS performance?
Evidence to look for: Clear responsibilities that match how decisions are made in practice.
Next action: Clarify decision authority, escalation points and cover for absent key people.
Clause 6: Planning
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 6.1Have you acted on risks and opportunities affecting consistent delivery?
Evidence to look for: Controls for issues such as a sole supplier or repeated rework, and a review of whether those controls helped.
Next action: Address significant delivery risks and agree how you will evaluate the actions.
Clause 6.2Are quality objectives measurable, assigned and reviewed against actual results?
Evidence to look for: A defined target, baseline, responsible person, resources, timing and progress results.
Next action: Replace vague goals with measurable targets and arrange regular progress reviews.
Clause 6.3Are changes to the QMS planned before they affect staff or customers?
Evidence to look for: A recent process or system change that considered consequences, resources, responsibilities and continuity.
Next action: Review the next change before implementation and agree controls, communication and follow-up.
Clause 7: Support
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 7.1.1–7.1.4, 7.1.6Are people, equipment, working conditions and business knowledge adequate for reliable delivery?
Evidence to look for: Capacity planning, maintenance, suitable working conditions and accessible knowledge for critical tasks.
Next action: Address resource constraints and knowledge held by only one person.
Clause 7.1.5Can you trust the monitoring and measuring resources used to check product or service conformity?
Evidence to look for: Fitness for purpose; calibration or verification where necessary, resource status and action when previous results may be unreliable.
Next action: Identify resources used for acceptance checks and establish necessary controls; assess previous work if results may be invalid.
Clause 7.2Can you demonstrate that people doing quality-critical work are competent?
Evidence to look for: Role requirements and relevant competence evidence, including evaluation of training or other development actions.
Next action: Compare required and current competence, close gaps and check performance on the actual task.
Clause 7.3–7.4Do staff understand quality expectations and receive relevant changes in time?
Evidence to look for: Staff can explain their contribution, the effects of errors and where updates and quality concerns are communicated.
Next action: Brief affected staff and check understanding through a real work example.
Clause 7.5Can staff find current approved documents and retrieve protected, completed records?
Evidence to look for: Identifiable versions, approvals, access arrangements, withdrawn obsolete copies and retrievable records.
Next action: Check a document at its point of use; confirm control, access, retention and recovery arrangements.
Clause 8: Operation
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 8.1–8.2Do you confirm customer and applicable product or service requirements before committing to work?
Evidence to look for: A reviewed quote or contract covering capability, requirements, obligations, delivery and agreed changes.
Next action: Check a recent order for differences between what was promised, understood and delivered.
Clause 8.3Where you design products or services, do you control inputs, reviews, checks and changes?
Evidence to look for: A design example with inputs, outputs, review, verification, validation and authorised changes.
Next action: Trace a design decision and retain evidence that its output meets the inputs and intended use.
Clause 8.4Do you select, instruct and review suppliers and subcontractors according to their effect on quality?
Evidence to look for: Selection criteria, communicated requirements, acceptance checks and supplier performance decisions.
Next action: Start with a supplier whose failure affects delivery; define expectations and review the results.
Clause 8.5.1–8.5.2Is work performed under controlled conditions, with identification and traceability where required?
Evidence to look for: A job record showing instructions, competent people, checks and acceptance status; traceability and process validation where relevant.
Next action: Walk through a live job and address missing controls, including work whose results cannot be checked afterwards.
Clause 8.5.3–8.5.5Do you protect work and relevant customer property, and manage applicable obligations after delivery?
Evidence to look for: Handling, storage and handover controls; protection of customer items or information where held; relevant service or warranty follow-up.
Next action: Review where things can be damaged, lost or misused and put suitable protection and follow-up in place.
Clause 8.5.6–8.6Are delivery changes reviewed and completed outputs approved against acceptance criteria?
Evidence to look for: Authorised changes and completed acceptance checks identifying who approved release or an agreed exception.
Next action: Clarify release and change authority and retain the acceptance evidence for a completed job.
Clause 8.7Can your team identify and control defective work or service failures before unintended use or delivery?
Evidence to look for: A problem record showing containment, disposition, decision authority and checks after correction.
Next action: Establish how to flag and contain a problem, who decides the response and how corrected work is checked.
Clause 9: Performance evaluation
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 9.1.1, 9.1.3Do you analyse quality performance and use the findings to make decisions?
Evidence to look for: Trends in delivery, rework, supply or service errors, together with decisions made from the results.
Next action: Select useful process measures and review trends with the people who can act on them.
Clause 9.1.2Do you monitor customers' perceptions of your products or services?
Evidence to look for: Relevant feedback such as complaints, interviews or reviews, analysed and acted on.
Next action: Seek useful customer feedback and investigate recurring concerns; an absence of complaints is not the whole picture.
Clause 9.2Have planned internal audits checked requirements and how the QMS actually operates?
Evidence to look for: An audit programme and completed audit records with scope, criteria, objective auditors, findings and follow-up.
Next action: Plan audits around process importance, changes and previous results, then track findings to action.
Clause 9.3Has management reviewed QMS performance and recorded the resulting decisions?
Evidence to look for: A completed review covering required inputs and decisions about improvements, changes and resources, with follow-up.
Next action: Bring relevant performance and audit information to management and record decisions, owners and actions.
Clause 10: Improvement
Check what happens in practice. These evidence examples are suggestions to help you investigate; they do not prescribe a separate document for every activity.
Clause 10.2Do corrective actions address causes and include a check that they were effective?
Evidence to look for: The problem, immediate correction, cause analysis, consideration of similar problems, actions and effectiveness results.
Next action: Investigate a recurring problem and check results after enough subsequent work to evaluate the improvement.
Clause 10.1, 10.3Can you show improvements made from analysis, audits, feedback or management review?
Evidence to look for: A change linked to an identified opportunity, with results showing its effect.
Next action: Select one improvement, assign an owner and compare results before and after the change.
Which ISO 9001 documents and records do you need?
Think in two practical groups: information that guides work, and records that show what happened. The amount and format of documentation should fit your business and the applicable requirements. ISO does not prescribe a separate document with every title listed in an online checklist.
- Start with your scope, quality policy and objectives, then sample records of competence, customer requirement reviews, supplier evaluation, acceptance checks, audits, management review and corrective action. Consider design, measurement and traceability records where relevant.
- Open a document where staff use it. Confirm that it is approved, current and easy to identify. Retrieve a completed record and check that you can tell what happened, when and who made the decision.
- A quality manual may help organise your system, but ISO 9001:2015 does not specifically require a document called a quality manual. Check the official documented-information guidance linked on this page.
Example: turn a repeated error into a corrective action
Imagine a service business repeatedly sending incorrect job reports. Fixing each report resolves the immediate mistake, but the error returns. A review finds that staff copy an old report because the current version is hard to find. A useful action plan would:
- Identify affected reports and correct them, communicating with customers where needed.
- Investigate why the old version remained available and whether other teams have the same problem.
- Agree one controlled location for the current report, remove superseded working copies and clarify who maintains it.
- Explain the revised process to affected staff. Review a suitable sample of subsequent reports to check whether the error has stopped.
- Keep the issue, correction, cause investigation, changes and follow-up results together. This is an illustrative example: the response and timing must reflect the actual problem.
What should you do after the checklist?
Start with issues that could affect customers, release incorrect work or leave an important process uncontrolled. Ask process owners to verify uncertain answers. Assign practical actions with an owner, target date and a clear description of completion.
- Keep the immediate correction separate from work to prevent recurrence.
- Check effectiveness after enough subsequent work has taken place to evaluate the improvement.
- Bring unresolved issues and resource decisions to management. The self-check report helps organise your findings; your team still needs to verify the answers.
Which ISO 9001 edition does this checklist use?
This checklist uses ISO 9001:2015 and Amendment 1:2024. The amendment addresses climate considerations in organisational context and relevant interested-party requirements. As checked on 8 September 2026, ISO lists the next edition as under publication. Confirm current publication status and applicable transition arrangements with your certification body.
- Already certified? Use this review to organise your current evidence and unresolved actions. Blue Safe’s transition readiness service can help you plan updates to your existing system.
ISO 9001 transition readiness
Already certified to ISO 9001:2015?
Review your current QMS now, then plan the definitive upgrade against the published new edition and applicable transition arrangements.
Frequently asked questions
Will completing this checklist make my business ISO 9001 certified?
No. It helps identify areas to investigate and improve. Certification involves an independent assessment against the applicable standard. Self-reported answers are not that assessment.
Can a small business use this checklist?
Yes. Begin with the work you actually carry out, the responsibilities people hold and the records you use. ISO 9001 applies to organisations of different sizes and sectors.
What if I am not sure of an answer?
Select “Not sure” in the self-check. The report will identify something to verify, rather than claiming a confirmed nonconformity. Ask the responsible person to show the activity and evidence.
Can I exclude questions that do not apply?
The tool allows a reasoned “Not applicable” answer for selected conditional checks. It records your judgement for review; it does not approve an exclusion. Consider actual responsibilities, including outsourced work, and check the standard.
How do I get my report?
Answer the questions, then enter your name, company and email. View your results after submitting and receive a copy by email. Your phone number is optional. The report includes your answers, areas needing attention and suggested actions.
How does Blue Safe help me implement the actions?
Blue Safe supports controlled documents, audits, corrective actions and management-system evidence. Businesses with an existing certified system can also discuss transition readiness and planned document updates.
Next step
Use this guide to check your current evidence, then move the work into a controlled system with documents, forms, registers, and review actions.
Start the free ISO 9001 self-check