ISO 9001:2026 internal audit checklist in Excel, written as the questions an auditor actually asks

How this one is different

A checklist of yes-or-no questions produces a page of yeses. This one asks for evidence by clause, in the four question shapes that get answers, records what was sampled, and feeds a findings register that flags a repeat when the same clause was found before.

How to use it

1. Pick the process and the clauses in scope for this audit on the plan tab.
2. Work the question bank for those clauses; write the evidence seen, not a tick.
3. Record each finding in the register with the clause, the type (major, minor, observation, OFI) and an owner.
4. Watch for the REPEAT flag: the clause was found at the last audit and the fix did not hold.
5. Track correction, corrective action and effectiveness verification as three separate columns, with days open.
6. Take the register to management review as the audit results input.

Who it is for

For the quality manager or internal auditor running an ISO 9001 audit program, especially the first one against the 2026 edition. Not for a certification body auditor; it is the internal view.

30-day refund, no questions. Files are Excel (.xlsx); no macros.

The method

Four question shapes do most of the work.

"Do you have a documented procedure for calibration?" has one useful answer and one useless one, and you will almost always get the useless one. An internal audit checklist built from yes/no questions tells you nothing.

Ask instead: show me the calibration status of the last three instruments used on this process. Now you are looking at evidence rather than listening to a claim, and the answer tells you about records, labeling, recall discipline and point-of-use control at once. Four question shapes do most of the work. Show me — whether control reaches the point of work. Walk me through — the real sequence, including the undocumented steps. What if — whether the process depends on one person. How would you know — whether any detection exists at all.

The question that finds the most: ask people what they do that is not in any procedure. Asked without a clipboard, this produces more useful findings than any record sample. Every workaround someone describes is a place where the documented process failed to survive contact with the work. Be careful what you do with the answer — if describing a workaround gets someone's colleague written up, you will not get another honest answer in that building for years. Findings go against the process, never the person.

And classify honestly. Everything-is-an-OFI means the auditor avoided the difficult conversation. Everything-is-a-major means nobody takes the next one seriously. A minor raised for the third cycle running is not a minor; the pattern is the finding.

Read next: Internal Audit Program Kit · ISO 9001:2026, what changed · Management Review Pack

What you download

One file, three tabs.

Yellow cells are yours; white cells calculate. It arrives filled in with the series’ fictional plant so every flag and chart has something to show; clear the yellow cells and start.