This audit ready checklist exists because of one uncomfortable truth: most companies fail ISO and HSE audits not because of poor operations — but because of missing, outdated, or incomplete documentation.
The systems are usually fine. The work is usually being done safely and correctly. What lets organisations down, audit after audit, is that the paperwork proving it does not exist, is out of date, or cannot be found when the auditor asks for it.
This audit ready checklist gives you the 5 documents every company must have before an ISO or HSE audit — and a 60-second self-check to find out where your gaps are before an auditor finds them for you.
WHY DOCUMENTATION FAILURES ARE THE #1 AUDIT RISK
An auditor’s job is not to test whether your operations are good in theory. It is to test whether you can prove — with documented evidence — that your management system is functioning as described.
This distinction catches organisations out constantly. A site can be operating safely, producing quality output, and managing risk sensibly — and still fail an audit because:
→ The risk assessment was never formally documented
→ The internal audit programme exists informally but has no records
→ The legal compliance register has not been updated in two years
→ Corrective actions were closed without evidence of verification
→ Document version control cannot show which procedure was active on a given date
None of these are operational failures. All of them are audit failures. This audit ready checklist addresses exactly these five gaps.
THE AUDIT READY CHECKLIST — 5 DOCUMENTS EVERY COMPANY MUST HAVE
Document 1 — Risk Assessment
Every ISO management system standard — 9001, 14001, 45001, 22000, 27001 — requires a documented, current risk assessment. This is consistently the first document an auditor will ask to see.
Your audit ready checklist for risk assessment:
→ Risk assessment is documented — not just discussed informally
→ Risk methodology is defined: likelihood, severity, and scoring criteria
→ All significant activities, processes, and hazards are covered
→ Risk treatment decisions are recorded with responsible owners
→ The assessment has been reviewed within the last 12 months — or sooner if conditions changed
→ Residual risk has been formally accepted by an appropriate authority
Use our step-by-step risk assessment guide if you need to build or refresh this document before your next audit.
Document 2 — Internal Audit Records
An internal audit programme that exists only as an intention — rather than a documented, evidenced process — is one of the most common findings across every ISO standard.
Your audit ready checklist for internal audit records:
→ An internal audit programme/schedule is documented for the current cycle
→ Audits have actually been conducted — not just planned
→ Audit findings are formally recorded, not just discussed verbally
→ Internal auditors are independent of the areas they audit
→ Previous audit findings have been closed with evidence — not just marked complete
If your internal audits are not catching the gaps an external auditor will find, read our internal audit guide — it covers exactly why internal audits so often miss what matters.
Document 3 — Legal Compliance Register
Every management system standard requires organisations to identify applicable legal and regulatory requirements — and demonstrate ongoing compliance with them. A missing or outdated legal register is a near-automatic nonconformity.
Your audit ready checklist for the legal compliance register:
→ All applicable national, regional, and sector-specific legislation is listed
→ The register explains HOW the organisation complies with each requirement — not just that the law exists
→ Compliance has been formally evaluated — not just assumed
→ The register has been reviewed and updated within the last 12 months
→ Responsibility for monitoring legal updates is clearly assigned
Build or refresh yours using our legal compliance register guide.
Document 4 — Corrective Action (CAPA) Records
Nonconformities happen in every organisation. What separates a mature management system from a weak one is whether corrective actions are properly investigated, implemented, and verified — with documented evidence at every stage.
Your audit ready checklist for CAPA records:
→ All nonconformities and incidents are formally logged — not handled informally
→ Root cause analysis is documented — not just immediate cause
→ Corrective actions have assigned owners and target dates
→ Closed actions include evidence that effectiveness was verified — not just a completion tick
→ Recurring issues are identified and addressed at a systemic level
See our corrective action (CAPA) guide for the full process auditors expect to see.
Document 5 — Document Control Records
The final item on this audit ready checklist is the one that underpins all the others: can you prove that the procedures, policies, and records in use are the current, approved versions?
Your audit ready checklist for document control:
→ All controlled documents have version numbers and revision dates
→ Obsolete documents are clearly marked or removed from circulation
→ Approval records exist for every current document
→ Personnel are using the current version — not an outdated copy saved locally
→ A document register or index exists showing what is controlled and where it lives
Our document control guide covers the 6 critical steps to get this right before your next audit.
THE 60-SECOND SELF-CHECK
Before your next audit — internal or external — answer these five questions honestly:
Can you locate your current risk assessment in under 2 minutes?
Can you show internal audit records from the past 12 months?
Is your legal compliance register dated within the last year?
Can you show a closed corrective action with verified effectiveness — not just a closure date?
Can you confirm every controlled document in use today is the current approved version?
If you answered “no” or “not sure” to any of these — that is your highest-priority gap to close before your next audit.
WHY THIS MATTERS MORE FOR MULTI-STANDARD ORGANISATIONS
If your organisation holds — or is pursuing — more than one ISO certification simultaneously, all 5 documents in this audit ready checklist apply across every standard you hold. A single risk assessment process, a single internal audit programme, and a single legal compliance register can often serve multiple ISO management system standards at once when properly integrated.
See our QHSE integration guide for how to combine these five core documents across ISO 9001, ISO 14001, and ISO 45001 into a single, audit-ready system — instead of maintaining three separate, duplicated sets.
THE BOTTOM LINE
This audit ready checklist is short by design — five documents, five checks, one honest self-assessment. But these five areas account for the overwhelming majority of nonconformities raised across every ISO and HSE audit, regardless of sector or standard.
The good news: none of these require a rebuild of your management system. They require disciplined documentation of work that, in most cases, is already happening. Close these five gaps and you remove the most common reasons audits fail.
Run the 60-second self-check today. Fix what is missing before your next audit finds it for you.
👉 Visit the Standards Unlimited shop for ready-to-use risk assessment templates, internal audit checklists, legal compliance registers, and CAPA tools built for ISO and HSE audit readiness.
#AuditReadyChecklist #ISOAudit #InternalAudit #ISOCompliance #AuditPreparation #ManagementSystem #ISODocumentation #QualityManagement #ComplianceChecklist #AuditReadiness