Preparing for an ISO certification audit

A certification audit is not a test you can cram for. The auditor is looking for evidence that the management system has been running for a while, which means most of the preparation happens months earlier, in the internal audits, the management review and the corrective actions you have already closed. What the final weeks can do is make sure that evidence is complete, findable and consistent. This guide explains what each audit in the cycle is for, what auditors typically ask to see and how to use the last twelve weeks.

How the certification cycle works

Certification bodies operate under ISO/IEC 17021-1, which sets the rules for how they audit and certify management systems. Your certification body should itself be accredited by a national accreditation body; check this before you sign, because an unaccredited certificate may not be accepted by your customers.

The cycle usually runs like this:

Audit	Purpose	Typical timing
Stage 1	Readiness review: scope, documented information, site, planning of internal audits and management review	A few weeks to a few months before stage 2
Stage 2	Evaluates implementation and effectiveness across the scope; leads to the certification decision	After stage 1 issues are resolved
Surveillance	Samples the system to confirm it is maintained	Typically at least once a year; the first usually within 12 months of the certification decision
Recertification	A fuller audit of the whole system before the certificate expires	Usually in year three

Certificates are usually valid for three years. Audit duration depends on headcount, number of sites, complexity and the standard; certification bodies use published rules to calculate it, so your quote should state the number of audit days for each stage.

What stage 1 is looking for

Stage 1 is partly a document review and partly a conversation about whether you are ready. It may be on site or partly remote. The auditor will usually want to understand:

• Scope. What is covered: sites, activities, products or services, and any exclusions or non-applicable requirements, with the reasons.
• Context. The issues, interested parties and risks you identified, and how they shaped the system.
• Documented information. The policy, objectives, the processes and the procedures you have chosen to document. For ISO/IEC 27001, the statement of applicability and the risk treatment plan get particular attention.
• Readiness for stage 2. Whether internal audits and management review have been planned and, in most cases, carried out.
• Site conditions. Enough of the operation to plan stage 2 sensibly.

Stage 1 ends with a report listing concerns that could be graded as nonconformities at stage 2. Treat every one of them as an action, with an owner and a date before stage 2, because the stage 2 auditor will check.

What stage 2 and surveillance test

Stage 2 is the main event. The auditor works through the processes in scope, interviews people at every level and samples records to see whether the system is implemented and effective. Expect the audit plan to cover leadership, each operational process, support processes, and the evaluation and improvement clauses.

Surveillance audits are shorter and sample part of the system each time, but some areas are typically covered at every visit: internal audits, management review, the handling of complaints, the status of corrective actions from previous audits, and the use of the certification mark. A recertification audit looks at the system as a whole again, including how it has performed over the three years.

The records auditors ask for first

Whatever the standard, three sets of records come up at almost every audit, because they show whether the system checks and corrects itself.

Internal audit records (ISO 9001 clause 9.2). The internal audit programme, showing how it was built from risk and previous results; the audit plans and reports; evidence that auditors were impartial and competent; and the findings raised. An internal audit programme that finds nothing over a year is itself a warning sign. See planning a risk-based audit programme.

Management review records (clause 9.3). Minutes or a report showing that top management reviewed all the required inputs, including audit results, customer feedback, process performance, the status of actions and risks, and recorded decisions on improvement, changes and resources. A missing input or a review with no decisions is a common finding.

Nonconformity and corrective action records (clause 10.2). For each nonconformity: what happened, the correction, the cause, the action taken and the review of effectiveness. Auditors frequently pick a closed action at random and follow it end to end. See checking a corrective action worked.

Behind all three sits clause 7.5 on documented information: records should be identifiable, controlled, retrievable and protected. If it takes twenty minutes to find last year’s management review minutes, the auditor will notice.

Integrated and multi-site audits

If you hold or are seeking more than one certificate, such as ISO 9001 with ISO 14001 or ISO 45001, many certification bodies will run them as an integrated audit. Because the standards share the harmonized structure, clauses such as internal audit, management review and corrective action can often be audited once for all of them, which usually reduces the total audit days compared with separate audits. In return, the auditor expects your records to show that the shared processes genuinely cover every standard: one internal audit programme that includes environmental and safety processes, and one management review that covers the inputs each standard asks for.

For organisations with several sites, certification bodies typically sample sites rather than visiting all of them every time, under rules that depend on how similar the sites are and how centrally the system is controlled. Expect the auditor to ask how the central function knows each site is following the system. Internal audits at every site, and a programme that shows when each was last visited, are the most direct answer.

A 12-week countdown

This plan assumes the system has been running for some months, with internal audits under way. Compress it for a surveillance visit; extend it if internal audits have not yet covered the full scope.

Weeks to go	Focus	Key tasks
12	Confirm the basics	Confirm dates, scope and audit days with the certification body. Check the programme covers every process and clause in scope before stage 2
10–11	Close the audit gaps	Complete any outstanding internal audits. Bring forward audits of high-risk processes not yet covered
8–9	Work the actions	Review every open nonconformity. Push actions to implementation; schedule effectiveness checks that can complete in time
6–7	Management review	Hold the review with all required inputs, including internal audit results. Record decisions and resources
5	Mock audit	A short audit by someone independent of the process, focused on records an auditor will sample
4	Records check	Sample five closed actions and five audit reports for completeness. Check document versions and approvals
3	Brief people	Short briefings by area: what the auditor may ask, where records are, how to answer honestly
2	Logistics	Room, access, PPE, guides for each area, a list of who is available when
1	Final review	Confirm the audit plan with the certification body. Resolve anything the mock audit raised

Avoid two traps in the final weeks. Do not rewrite procedures wholesale just before the audit; changes made too late have no records to show they work. And do not close actions on paper to tidy the numbers; an open action with a credible plan is better evidence than a closed one with nothing behind it.

On the day and after

At Kestrel Metals, a fictional fabrication business, the quality manager R. Patel acts as guide for the opening and closing meetings, and each process owner hosts the auditor in their own area. A few practices help:

• Answer the question asked, and show the record rather than describing it.
• Do not guess. “I don’t know, but K. Lewis runs that and can show you” is a better answer than an improvised one.
• Keep a note of what was asked, sampled and raised, area by area.
• Raise disagreement at the time, with evidence, rather than after the closing meeting.

After the audit, respond to nonconformities within the certification body’s deadline. Major nonconformities usually need correction and corrective action accepted, and sometimes verified on site, before certification is recommended; minor ones usually need an accepted plan. See major vs minor nonconformity for how grades are applied.

If you keep the programme, findings and actions in Orisynx, audit summary, finding trend and remediation status reports can be prepared ahead of the visit as a starting point for the management review and the auditor’s sampling. Certification itself is a decision for your certification body, and the evidence that leads to it is built up over the whole year.