10 examples of Internal Audit Checklist and its explanation

An internal audit checklist is a list of examination questions prepared by the auditor before the audit is carried out, used to make sure every important aspect of a process is genuinely examined and nothing is missed.

In general, checklist is a list of points ticked off one by one to make sure everything has been done or checked. In the context of audit, those points take the form of questions, and every answer must be supported by evidence.

This article contains an internal audit form format that can be directly adapted, 10 internal audit checklist examples along with the questions and evidence to request, a version for ISO 9001 audits, and the benefits of using it.

Definition of Checklist Internal Audit

Checklist audit is a list of questions or items prepared to guide the audit process in examining whether operational, financial, or procedural practices conform to established standards. Its function is to help the auditor identify potential problems, non-conformities, and areas requiring improvement.

It needs to be distinguished from other audit documents it is often confused with. Checklist contains the questions asked during the examination, while the internal audit work program contains the overall engagement plan — objectives, scope, schedule, and team allocation. A checklist is a field work tool; a work program is the engagement framework.

The ISO 9001:2015 standard itself does not explicitly require the preparation of an checklist internal audit checklist, but using one is highly recommended because it greatly benefits the smoothness and depth of the audit.

Internal Audit Form Format

A checklist is only useful once its answers can be traced back to evidence. That is why an internal audit form generally has the following columns. This structure can be directly adapted into a spreadsheet or audit application.

The Results column should ideally provide an N/Aoption, because not every question is relevant to every unit. The Auditor's Notes column should be filled with a document number or the name of the source person, not just a conclusion — that is where the audit trail is formed.

Benefit of Checklist Internal Audit

1. Helps the Auditor Remember Questions

In a single engagement, the auditor examines many processes and procedures, so the questions that need to be asked of the auditee pile up. Writing them down in advance makes the auditor appear more prepared and the examination run more coherently.

2. Ensures Every Point Is Examined

Checklist makes sure every requirement or clause relevant to the auditee is genuinely examined. Care taken in preparing it determines how complete the audit's coverage is.

3. Captures Interaction Between Processes

One process often involves many departments. The procurement of goods and services process, for example, involves submission, purchasing, finance, the board of directors, all the way to the warehouse. A checklist ensures the handover points between departments are also examined, not just the process within a single unit.

4. Maintains Depth of Examination

Without a checklist, an audit can easily stop at a yes-or-no answer. With layered questions, the examination digs down to the evidence. For example, for a quality policy:

• Has a quality Policy been established?
• Does the policy meet the requirements of ISO 9001:2015 clause 5.2.1? Note: must include a commitment to meeting applicable requirements and a statement of continual improvement.
• Has the quality policy been communicated to all employees, and how? Note: sample a few employees, then ask them about the content of the company's quality policy.
• Is the quality policy evaluated periodically?

10 Examples Checklist Internal Audit

Here are ten areas commonly included in a company's internal audit checklist, complete with the questions and evidence to request for each area.

1. Compliance with Company Policy

Verifying whether internal policies have been implemented, are understood, and are updated as needed.

• Are all company policies clearly documented and authorized?
• Do employees understand and follow the policy?
• When was the policy last reviewed, and who approved it?
• Evidence: dated policy document, communication attendance list, review minutes.

2. Risk Management

Evaluating the extent to which the company identifies and manages risks that could cause harm.

• Has the company identified its key risks?
• Are mitigation measures implemented and effective?
• Who is the risk owner for each key risk, and how is monitoring reported?
• Evidence: risk register, risk assessment results, follow-up monitoring report.

3. Operational Process

Ensuring the process runs according to standard while also looking for inefficiencies that can be improved.

• Does every process step comply with the established standard?
• Are there steps that can be simplified or combined?
• Does the current SOP actually reflect the practice really carried out in the field?
• Evidence: SOP document, field observation, process time records.

4. Financial Control

Checking whether transactions are recorded accurately and transparently and comply with reporting standards.

• Are transactions recorded accurately and on time?
• Do financial reporting procedures comply with applicable accounting standards?
• Is there segregation of duties between the party who authorizes, records, and holds assets?
• Evidence: sample of journal entries and supporting documents, authority matrix, bank reconciliation.

5. Human Resources

Checking HR management from recruitment through performance evaluation.

• Are recruitment and training processes carried out according to policy?
• Is the performance evaluation system applied fairly and documented?
• Is employee data and employment contracts up to date?
• Evidence: recruitment files, training records, performance evaluation forms, sample contracts.

6. Information Security

Checking the extent to which the security system protects important data from internal and external threats.

• Is the data security policy implemented and adhered to?
• Are access rights reviewed periodically and revoked when an employee transfers or leaves?
• Is data backup tested for recovery, not just run?
• Evidence: access rights list, review log, backup recovery test records.

7. Regulatory Compliance

Ensuring the company complies with the laws and regulations of its sector and documents evidence of compliance.

• Does the company comply with all regulations applicable in its sector?
• Are licenses and certifications still valid?
• Have external audit findings previously been followed up?
• Evidence: licensing documents, external audit reports, findings follow-up matrix.

8. Quality and Production Management

This area is the one most frequently asked about for production department audits. The focus is ensuring products meet quality standards and that there is a mechanism for handling non-conforming products.

• Is there an effective quality control system at every production stage?
• Are defective products identified, separated, and handled according to procedure?
• Are measuring instruments and machines calibrated on schedule?
• How are customer complaints traced back to the production process?
• Evidence: quality inspection records, non-conforming product reports, calibration certificates, complaint register.

9. Environment, Health, and Safety (HSSE)

Evaluating compliance with safety procedures and periodic training for employees.

• Are work safety protocols consistently followed?
• Is safety training held regularly and recorded?
• Are incidents and near misses reported and followed up?
• Evidence: training attendance list, incident register, K3 inspection results, PPE documentation.

10. Documentation and Archives

Ensuring documents are properly managed from storage and access through to archiving.

• Are all important documents kept safe?
• Is there an access and archiving procedure that is followed?
• Is a document retention period set and complied with?
• Evidence: master document list, retention schedule, archive borrowing log.

Checklist ISO 9001 Internal Audit

For quality management system audits, the checklist is structured following the ISO 9001:2015 clauses instead of functional areas. The commonly used structure:

• Clause 4 — organizational context, internal and external issues, interested parties, scope of the quality system.
• Clause 5 — leadership, quality policy, roles and responsibilities.
• Clause 6 — planning, addressing risks and opportunities, quality objectives.
• Clause 7 — support: resources, competence, awareness, communication, documented information.
• Clause 8 — operation, process control, external providers, non-conforming products.
• Clause 9 — performance evaluation, customer satisfaction, internal audit, management review.
• Clause 10 — improvement, non-conformity, and corrective action.

Each clause is broken down into layered questions like the quality policy example above, then filled into the same form format.

See also: Internal Quality Audit: 2 Stages of Implementation, Examples, and Benefits

FAQ About Checklist Internal Audit

Sort Checklist Faster Internal Audits with Audithink

Rebuilding a checklist from scratch for every engagement takes time, and the answers are often disconnected from their supporting evidence. Audithink, internal audit management software for companies and state-owned enterprises in Indonesia, providing reusable checklist templates, linking every answer to uploaded evidence, and monitoring follow-up on findings in one platform.

See Audithink's features or schedule a demo to see how it works.

Consultation with the Audithink Team to discuss your company's internal audit needs.