1
Risk management
Is the risk register current? Are important risks identified, controls assigned and review dates being followed? Have workers contributed where appropriate?
Practical audit guide for NZ small business
Internal Audit Checklist NZ
A simple compliance audit checklist to help you check whether your risks, records, incidents, training, complaints and corrective actions are actually being managed.
Important: A formal internal audit programme is not a universal legal requirement for every NZ small business. Specific audit requirements may arise from legislation, contracts, licences, certification standards or sector-specific obligations.
What is an internal audit?
An internal audit is a structured check of your own business systems. It compares what should be happening with what is actually happening, using evidence such as records, registers, documents, observations and discussions with workers.
The useful question is not just “Do we have a policy?” Ask: “Can we show that the process is understood, followed, recorded and reviewed?”
Small business internal audit checklist
Use these areas as a starting point, then add any requirements specific to your industry, contracts, licences or certification.
2
Incidents & near misses
Are incidents recorded consistently? Are serious or recurring events investigated and actions followed through? Are any statutory notification obligations understood?
3
Training & competency
Can the business show who needs training, licences or competency checks? Are expiry dates and refresher requirements monitored?
4
Policies & document control
Are important procedures current, approved and accessible? Can staff identify the current version rather than an obsolete copy?
5
Complaints & customer issues
Are complaints recorded, acknowledged, investigated where necessary and closed with clear outcomes? Are recurring themes reviewed?
6
Corrective actions / CAPA
Do significant findings have an owner and due date? Are overdue actions visible? Is effectiveness checked after completion?
7
Required business records
Are the records required for your activities being kept accurately and for the appropriate period? Check employment, safety, operational and sector-specific records relevant to your business.
8
Privacy & information
Is responsibility for privacy clear? Is personal information collected, stored, accessed and disposed of appropriately for the business?
9
Licences, certifications & inspections
Are required licences, permits, equipment checks or certifications current? Are upcoming expiries visible before they become a problem?
10
Previous audit findings
Were previous findings actually resolved? Check evidence of completion rather than relying only on a status marked “closed”.
Example internal audit record
| Audit Area | Question | Evidence | Result | Action | Owner | Due |
|---|---|---|---|---|---|---|
| Risk Management | Is the risk register current? | Risk Register reviewed | Needs Improvement | Review overdue high-risk items | Operations Lead | 25 Sep |
| Training | Are required competencies current? | Training Register + certificates | Conforming | None | — | — |
| Corrective Actions | Are overdue actions followed up? | CAPA Register | Nonconforming | Escalate two overdue actions and set review dates | Manager | 20 Sep |
Use evidence, not assumptions
Document review
Registers, procedures, forms, licences, training records, meeting records and previous reports.
Sample records
Check a small sample of real transactions or events to see whether the stated process was followed.
Observation
Look at how work is actually performed rather than relying only on written procedures.
Worker discussion
Ask the people doing the work how the process operates and whether controls are practical.
What to do with audit findings
An audit has little value if findings disappear into a report. Convert meaningful gaps into tracked actions.
| Finding | Suggested response |
|---|---|
| Conforming | No corrective action required. Record the evidence checked. |
| Opportunity for improvement | Consider an improvement action if it adds practical value. |
| Needs improvement | Assign an action, owner and due date proportionate to the risk. |
| Nonconforming / significant gap | Address immediate risk if needed, investigate the cause and track corrective action to verified closure. |
For significant or recurring findings, use a structured corrective-action process. See our CAPA Template NZ guide.
Build a simple compliance system instead of scattered spreadsheets
The NZ Quality & Compliance Starter Pack brings practical registers and compliance tools together for small businesses without the cost of a large software platform.
Frequently asked questions
What is an internal audit?
An internal audit is a structured review of whether a business's processes, records and controls are in place and operating as intended.
Does every New Zealand small business need formal internal audits?
No. Formal internal auditing is not a universal legal requirement for every NZ small business. Requirements can arise from particular regulations, contracts, certification standards, licences or sector obligations.
What should a small business internal audit check?
Useful areas include risks, incidents, training, documents, complaints, corrective actions, required records, licences and whether previous actions were completed effectively.
Can I download a free internal audit checklist?
Yes. This page includes a free Excel Internal Audit Checklist for small New Zealand businesses, with fields for evidence, findings, actions, owners, due dates, completion evidence and verification.
How often should an internal audit be completed?
Use a frequency proportionate to your risks, obligations and rate of change, while also following any specific legal, contractual, sector or certification requirements that apply.
Disclaimer: This page provides general quality and compliance information and is not legal advice. Requirements vary according to your activities, sector, contracts, licences and certification framework.