Internal Audit ISO 9001, ISO 14001 and OHSAS 18001: A Complete Guide

An internal audit helps an organisation check whether its management systems work as planned. It shows what the business does well and where it needs to improve. When a company manages quality, environmental, and workplace safety requirements together, an integrated audit can make the process easier. An Internal Audit ISO 9001 / ISO 14001 / OHSAS 18001 checklist helps auditors review processes, records, risks, and controls in a structured way. It can help identify gaps before they lead to poor quality, environmental harm, or workplace injuries.

Each standard has a different focus. ISO 9001 covers quality management. ISO 14001 covers environmental management. OHSAS 18001 was a standard for occupational health and safety management, but ISO 45001 has replaced it.

Therefore, organisations should check which standards and requirements apply to their current management systems. With eAuditor Audits & Inspections, teams can support their audit process through digital checklists, documented findings, and corrective-action tracking where available.

What Is an Integrated Internal Audit?

An integrated internal audit reviews two or more management systems during a coordinated audit process. Instead of running separate audits for every requirement, an organisation can review shared processes together while still checking the needs of each standard.

For example, a company may review document control, staff training, risk management, operational controls, and corrective actions in one audit. The auditor then checks how these processes support quality, environmental performance, and worker safety.

An integrated audit can help organisations:

• Reduce repeated audit work.
• Use staff time more effectively.
• Identify gaps across different management systems.
• Improve coordination between departments.
• Keep audit records in a consistent format.
• Track corrective actions in one organised process.

However, an integrated audit must still cover the requirements of each applicable standard. Combining audits should not mean skipping important checks.

Understanding the Three Standards

ISO 9001: Quality Management

ISO 9001 provides requirements for a quality management system. It helps organisations deliver products and services that meet customer and applicable regulatory requirements.

An ISO 9001 internal audit may review:

• Customer requirements and satisfaction.
• Quality objectives and performance.
• Documented information.
• Staff competence and training.
• Supplier and purchasing controls.
• Production or service delivery.
• Inspection and monitoring.
• Nonconformities and corrective actions.
• Continual improvement.

For example, an auditor may check whether staff follow the approved production process and whether the organisation handles defective products correctly.

The aim is to determine whether the quality management system meets applicable requirements and achieves its intended results.

ISO 14001: Environmental Management

ISO 14001 provides requirements for an environmental management system. It helps organisations manage their environmental aspects, meet applicable compliance obligations, and improve environmental performance.

An ISO 14001 internal audit may review:

• Environmental aspects and impacts.
• Environmental objectives and plans.
• Legal and other compliance obligations.
• Waste management.
• Energy and resource use.
• Chemical storage and handling.
• Spill prevention and response.
• Operational controls.
• Environmental monitoring.
• Emergency preparedness.
• Corrective actions and improvement.

For example, an auditor may check whether a facility stores hazardous materials correctly and maintains records of waste handling.

The audit should consider the organisation’s actual activities, environmental impacts, and compliance obligations.

OHSAS 18001: Occupational Health and Safety

OHSAS 18001 was a management system standard designed to help organisations control occupational health and safety risks. ISO 45001 has replaced it as the current international occupational health and safety management system standard.

An organisation reviewing an older OHSAS 18001 system may need to check:

• Hazard identification and risk assessment.
• Occupational health and safety objectives.
• Worker training and competence.
• Consultation and participation arrangements.
• Operational controls.
• Personal protective equipment.
• Incident reporting and investigation.
• Emergency preparedness.
• Legal and other requirements.
• Corrective action and continual improvement.

For organisations using ISO 45001, the audit should follow the applicable ISO 45001 requirements rather than treating OHSAS 18001 as the current standard.

Before planning the audit, confirm the organisation’s certification status, applicable standard editions, and any transition obligations.

Why Is an Integrated Internal Audit Important?

A well-planned internal audit helps management understand whether its systems are effective and where improvement is needed.

1. Check compliance with requirements

First, auditors compare actual practices with the applicable standard requirements, internal procedures, and relevant obligations. This helps the organisation identify gaps and plan suitable action.

2. Improve process performance

Next, auditors look at whether processes work as intended. They may identify repeated errors, unclear responsibilities, ineffective controls, or missing records.

3. Reduce operational risks

An integrated audit can reveal risks that affect several parts of the business. For example, poor chemical storage may create environmental, health and safety, and product quality concerns.

4. Strengthen accountability

Clear audit findings help managers understand what needs to change. Assigned responsibilities and due dates also help teams follow up on unresolved issues.

5. Support continual improvement

Finally, audit results help management identify trends, review objectives, and improve procedures. Regular audits make it easier to see whether corrective actions have solved the original problem.

An internal audit does not guarantee compliance or certification. It provides evidence that helps the organisation assess and improve its management systems.

Internal Audit ISO 9001 / ISO 14001 / OHSAS 18001 Checklist

Use the following master checklist as a starting point. Adapt it to the organisation’s activities, applicable standard editions, risk profile, and documented procedures.

A. Management System and Leadership

• Are the management system policies documented and approved?
• Are quality, environmental, and occupational health and safety responsibilities clear?
• Are objectives defined and reviewed?
• Are roles and authorities communicated to relevant staff?
• Are the management systems aligned with the organisation’s business activities?
• Are risks and opportunities considered during planning?
• Are management reviews conducted as required?
• Are previous audit findings reviewed?
• Are resources available to maintain the systems?
• Are improvement opportunities recorded and addressed?

B. Document Control and Records

• Are current policies and procedures available to staff?
• Are documents reviewed and approved before use?
• Are outdated versions removed from points of use or clearly controlled?
• Are records legible, identifiable, and retrievable?
• Are retention periods defined where needed?
• Are changes to documents controlled?
• Are staff using the correct forms and instructions?
• Are external documents controlled where relevant?
• Are audit records protected from loss or unauthorised changes?
• Are records retained according to organisational requirements?

C. Competence, Training, and Awareness

• Have the required skills for each role been identified?
• Do workers have suitable training and experience?
• Are training records maintained?
• Do employees understand the relevant management system policies?
• Do workers understand the consequences of not following required procedures?
• Are contractors informed of relevant site rules?
• Is training effectiveness evaluated where appropriate?
• Are additional training needs identified and addressed?

D. ISO 9001: Quality Management

• Are customer and product or service requirements identified?
• Are customer complaints recorded and reviewed?
• Are quality objectives monitored?
• Are operational processes defined and controlled?
• Are purchasing and supplier controls appropriate?
• Are incoming materials checked where required?
• Are production and service activities performed under controlled conditions?
• Are inspection and testing records maintained where applicable?
• Are measuring devices controlled and calibrated or verified as required?
• Are nonconforming outputs identified and controlled?
• Are corrective actions taken when problems occur?
• Are customer feedback and performance trends reviewed?

E. ISO 14001: Environmental Management

• Have relevant environmental aspects and impacts been identified?
• Are significant environmental aspects determined using defined criteria?
• Are applicable environmental obligations identified and reviewed?
• Are environmental objectives documented and monitored?
• Are waste streams identified and managed correctly?
• Are hazardous substances stored and labelled appropriately?
• Are spill prevention and response controls in place?
• Are emissions, discharges, or other impacts monitored where required?
• Are energy and resource use reviewed where relevant?
• Are environmental incidents recorded and investigated?
• Are emergency response arrangements suitable for environmental incidents?
• Are environmental compliance records maintained?

F. Occupational Health and Safety Management

• Have workplace hazards been identified?
• Are risks assessed using the organisation’s approved method?
• Are controls selected and implemented to reduce risks?
• Are workers consulted on relevant health and safety matters?
• Are safe work procedures available and followed?
• Are required permits and authorisations controlled?
• Are machine guards and other protective measures in place?
• Is PPE suitable and available where required?
• Are workplace inspections conducted?
• Are incidents and near misses reported and investigated?
• Are emergency plans communicated and tested where required?
• Are corrective actions reviewed for effectiveness?

For organisations using ISO 45001, include checks for its specific requirements, such as worker consultation and participation, and align the audit with the applicable edition. For legacy OHSAS 18001 systems, use the relevant historical requirements only where appropriate.

G. Operational Control and Supplier Management

• Are operational processes carried out under defined conditions?
• Are relevant quality, environmental, and safety controls communicated?
• Are suppliers evaluated using appropriate criteria?
• Are contractor risks assessed and managed?
• Are purchasing requirements clearly defined?
• Are changes to processes reviewed before implementation?
• Are equipment maintenance requirements followed?
• Are outsourced processes controlled where relevant?
• Are operational records available for review?
• Are deviations reported and addressed?

H. Emergency Preparedness

• Have foreseeable emergencies been identified?
• Are emergency procedures documented and accessible?
• Are relevant staff trained in their emergency roles?
• Are alarms and emergency equipment inspected as required?
• Are evacuation routes accessible?
• Are spill response arrangements suitable for the site?
• Are emergency exercises conducted where required?
• Are lessons from drills and actual incidents recorded?
• Are emergency plans updated when risks or site conditions change?

I. Monitoring, Measurement, and Evaluation

• Are relevant performance indicators defined?
• Are quality objectives monitored?
• Is environmental performance measured where required?
• Are health and safety performance indicators reviewed?
• Are measurement methods suitable for their intended purpose?
• Are monitoring records maintained?
• Are missed targets investigated?
• Are trends reviewed by the responsible managers?
• Are compliance evaluations completed at planned intervals?
• Are the results communicated to relevant people?

J. Nonconformities and Corrective Actions

• Are audit findings clearly recorded?
• Are nonconformities investigated where appropriate?
• Are immediate corrections made when needed?
• Are root causes considered for significant or recurring issues?
• Are corrective actions assigned to responsible people?
• Are completion dates defined?
• Is the effectiveness of corrective action checked?
• Are repeated problems reviewed for common causes?
• Are management system documents updated when necessary?
• Are lessons shared with relevant teams?

K. Internal Audit Programme

• Is there a planned internal audit programme?
• Does the programme consider process importance, changes, and previous audit results?
• Are audit criteria and scope defined?
• Are auditors competent for the work they perform?
• Is audit objectivity and impartiality maintained?
• Are findings supported by evidence?
• Are audit results reported to relevant management?
• Are corrective actions followed up?
• Are audit records retained?
• Is the audit programme reviewed for effectiveness?

How to Conduct an Integrated Internal Audit

A structured process helps auditors gather reliable evidence and report useful findings.

Step 1: Define the audit scope

First, decide which sites, departments, processes, and standards the audit will cover. Identify the applicable editions and any additional internal or legal requirements.

For example, an audit may cover purchasing, production, waste management, maintenance, and occupational health and safety at one manufacturing site.

Step 2: Review documents before the audit

Next, review relevant policies, procedures, risk assessments, environmental registers, training records, previous findings, and performance reports.

This preparation helps auditors focus on areas that need closer attention.

Step 3: Prepare the audit checklist

Select questions that match the audit scope. Group them by standard or process, and identify the evidence needed to demonstrate conformity.

A shared question may support more than one management system. However, auditors should record which requirements the evidence addresses.

Step 4: Conduct interviews and site inspections

Speak with employees and process owners. Observe work activities and review relevant records.

Do not rely only on written procedures. Check whether actual practices match the documented process.

Step 5: Record objective evidence

Record what the auditor observed, reviewed, or confirmed. Keep findings factual and specific.

For example, instead of writing “supplier control is poor,” identify the missing evaluation record, the relevant process, and the applicable audit criterion.

Step 6: Classify and report findings

Use the organisation’s approved method to classify nonconformities, observations, and improvement opportunities. Explain the evidence and the requirement that was not met.

Do not label every observation a nonconformity. The classification should reflect the evidence and applicable audit criteria.

Step 7: Agree on corrective actions

Ask the responsible process owner to investigate the cause and propose suitable action. Set realistic completion dates and assign accountability.

Step 8: Verify effectiveness

Once actions are complete, check whether they address the cause and prevent recurrence. Close the finding only when the required evidence supports closure.

Common Internal Audit Mistakes

Auditing documents without checking actual work

A procedure may look correct but not reflect daily practice. Auditors should compare records with interviews and direct observations.

Using the same questions for every department

Different processes have different risks and requirements. Tailor the checklist to the scope and activities being audited.

Ignoring standard-specific requirements

Integrated audits can save time, but each standard has distinct requirements. Check them individually and make sure the audit covers the full applicable scope.

Writing vague findings

A finding such as “improve safety” does not explain the problem. Record the evidence, requirement, and gap clearly.

Focusing only on nonconformities

Audits should also assess whether processes are effective and identify useful improvements. However, improvement suggestions must not replace the need to address genuine nonconformities.

Failing to follow up

A corrective action is not complete simply because someone marked it done. Verify that it has addressed the issue and that the risk is controlled.

Best Practices for an Effective Integrated Audit

• Plan according to risk: Give more attention to important processes, significant environmental aspects, and higher-risk work.
• Use competent auditors: Make sure auditors understand the relevant standards and processes.
• Maintain impartiality: Auditors should remain objective and avoid auditing their own work where this would compromise impartiality.
• Use evidence-based findings: Support conclusions with records, interviews, and observations.
• Coordinate shared processes: Review common controls together while covering each standard’s distinct requirements.
• Keep records clear: Document the audit scope, criteria, evidence, findings, and actions.
• Involve process owners: Discuss findings with the people responsible for the process.
• Address root causes: Choose actions that prevent recurrence, not just quick fixes.
• Verify effectiveness: Check whether corrective actions work in practice.
• Review the audit programme: Use results and changes in the organisation to improve future audits.

How eAuditor Audits & Inspections Supports Integrated Internal Audits

Managing several standards can involve many checklists, records, and follow-up tasks. A digital audit process can help organisations keep these activities structured and easier to review.

With eAuditor Audits & Inspections, teams can configure digital checklists to support their integrated internal audit programme.

Create standard-specific checklists

Build separate checklists for ISO 9001, ISO 14001, and the applicable occupational health and safety standard. Alternatively, create process-based checklists that cover shared requirements while retaining clear links to the relevant audit criteria.

Record evidence and findings

Auditors can record results during the audit. Depending on the features enabled, they may add comments and supporting evidence to explain findings and provide context.

Support corrective-action tracking

Where the relevant action-management features are enabled, teams can assign actions, set due dates, and monitor progress. This helps responsible managers review unresolved findings and confirm that follow-up occurs.

Standardise audits across sites

Organisations can use common checklist structures across locations while adjusting questions to suit local operations and risks. This can support consistency without assuming every site has identical requirements.

Review audit history

Digital records can help managers review past results, recurring issues, and action status. These records can support management reviews and continual improvement when combined with appropriate analysis.

Important: eAuditor Audits & Inspections supports audit documentation and follow-up workflows. It does not automatically certify compliance, determine whether a management system meets every standard requirement, or replace a competent auditor. The organisation remains responsible for selecting the correct audit criteria, evaluating evidence, and making sound audit conclusions.

Explore the eAuditor template library for resources that may help you build digital audit checklists.

Benefits of an Integrated Internal Audit Checklist

A well-planned integrated audit can support several business goals.

• Less duplicated effort: Shared processes can be reviewed together where appropriate.
• Clearer findings: Standardised checklists help auditors document gaps consistently.
• Better risk visibility: Teams can identify issues that affect several management systems.
• Improved accountability: Assigned actions clarify who must address each finding.
• Stronger recordkeeping: Digital records can help organise audit evidence and results.
• More informed management reviews: Audit trends can help managers prioritise improvements.
• Continual improvement: Follow-up checks help teams evaluate whether changes work.

The results depend on competent auditors, suitable audit planning, accurate evidence, and effective corrective actions.

Frequently Asked Questions

1. What is an internal audit for ISO 9001, ISO 14001, and OHSAS 18001?

It is a planned review of an organisation’s management systems against the applicable requirements. It checks whether processes are implemented, maintained, and effective within the audit scope.

2. Can all three standards be audited together?

Yes, an organisation can conduct an integrated audit where the audit programme and scope support it. However, the audit must still cover the distinct requirements of each applicable standard.

3. Is OHSAS 18001 still a current standard?

No. ISO 45001 replaced OHSAS 18001 as the international occupational health and safety management system standard. Organisations should confirm their current certification status and applicable transition requirements.

4. What should an integrated internal audit checklist include?

It should cover audit planning, document control, competence, quality management, environmental management, occupational health and safety, operational controls, emergency preparedness, performance evaluation, and corrective actions.

5. Who can conduct an internal audit?

A competent person with suitable knowledge of the audit criteria and process may conduct it. The organisation should also maintain objectivity and impartiality in accordance with its audit procedures and applicable requirements.

6. How often should internal audits be conducted?

The organisation should establish an audit programme based on factors such as process importance, changes, risks, previous results, and applicable standard requirements. The programme should define suitable audit intervals.

7. What is the difference between a correction and a corrective action?

A correction addresses a detected problem. Corrective action addresses its cause to prevent recurrence. For example, replacing a missing record may correct the immediate issue, while improving the record-control process may help prevent it from happening again.

8. What happens when an auditor finds a nonconformity?

The auditor records the evidence and applicable requirement. The responsible team then addresses the issue, investigates the cause where appropriate, implements corrective action, and provides evidence for follow-up.

9. Can eAuditor Audits & Inspections manage integrated audit checklists?

eAuditor can support configurable digital checklists and inspection records. Depending on enabled features, teams can also document findings and track corrective actions. The organisation must still define the correct criteria and evaluate compliance.

10. Does passing an internal audit guarantee ISO certification?

No. An internal audit provides evidence about the management system within its scope. Certification decisions are made through the relevant external certification process, and an internal audit cannot guarantee certification.

Final Thoughts

An integrated internal audit helps organisations review quality, environmental, and occupational health and safety processes in a coordinated way. It can reduce duplicated work, highlight shared risks, and support continual improvement.

Start by confirming the applicable standards and editions. Then, define the audit scope, prepare a relevant checklist, gather objective evidence, and record findings clearly. Most importantly, follow up on corrective actions and verify that they work.

eAuditor Audits & Inspections can support the process with digital checklists, documented findings, and corrective-action workflows where available. When these tools are combined with competent auditors and a risk-based audit programme, organisations can manage their internal audits more consistently.

Related eAuditor Resources

• eAuditor Template Library — Explore resources for building digital audit and inspection checklists.
• Safety Audits Checklist — Review structured safety audit practices.
• General Workplace Health and Safety Checklist — Explore workplace health and safety inspection topics.
• Chemical Risk Assessment Form — Review a related approach to documenting chemical hazards and controls.