Most businesses that fail a certification audit do not fail on the standard. They fail on evidence. The system was fine; nobody could prove it had been running.
A certification audit comes in two parts, and understanding the difference between them removes most of the anxiety.
What happens at stage 1
Stage 1 is a readiness review. The assessor is checking whether there is any point turning up for stage 2. They will look at your documented system, your scope, your internal audit records and your management review, and they will form a view on whether the system is actually operating or has been written the week before.
It is usually shorter than people expect, often half a day to a day for a smaller business, and it is frequently done remotely. The output is a report listing anything that needs sorting before stage 2. Treat that report as a gift. It is the only free look at the examiner's marking scheme you will get.
The most common stage 1 finding is that the management system describes a business that does not exist. Procedures reference departments that were reorganised two years ago, or a job title nobody holds. That happens when a system is bought off the shelf and never adapted.
What happens at stage 2
Stage 2 is the real assessment. The assessor samples your processes and looks for objective evidence that the system is working as described. They will talk to people who are not you. They will ask a machine operator what they do if something goes wrong, and they will compare the answer to your procedure.
This is the part that surprises people. Certification is not a document review. It is an examination of whether your organisation does what it says it does, and the assessor gets at that by asking ordinary staff ordinary questions.
The evidence to have ready
There is a short list that comes up in almost every audit, whichever standard you are going for:
- Internal audit records. A full cycle covering every clause and every part of the business in scope, with findings raised and closed.
- Management review minutes. Dated, with the required inputs covered and decisions actually recorded. "We discussed it" is not a decision.
- Objectives with real measurements against them. Not aspirations. Numbers, with the current position stated.
- Competence and training records for the people doing the work in scope, up to date.
- Evidence of corrective action on something that actually went wrong, showing root cause rather than just a fix.
- A legal or other requirements register that has been reviewed within the last twelve months, for the standards that need one.
If you can produce those six things without going for a hunt, you are in a strong position before anyone arrives.
The mistakes that cause avoidable findings
Running the internal audit the week before. An assessor can tell. Internal audits dated within days of the certification visit, all closed the same afternoon, all with no findings, tell a story. Spread them across the year and let them find things.
Having no findings at all. An internal audit programme that never raises anything is not evidence of a perfect business. It is evidence of an audit programme that is not looking. Assessors read it that way too.
Over-documenting. More procedures mean more promises, and every promise is something an assessor can check you against. A twelve-page procedure for something that takes ten minutes will generate findings that a one-page procedure would not.
Nobody outside management knowing the system exists. If your quality policy is in a folder and nowhere else, and the assessor asks three people what it means for their job, you have a problem that no amount of paperwork fixes.
Scope that does not match reality. If your certificate scope says one site and you operate from three, that gets found, usually by an offhand comment from someone on the shop floor.
What happens if something is raised
Findings are normal. A stage 2 audit with a couple of minor non-conformances is an ordinary outcome and does not stop certification. You respond with a corrective action plan, and once the assessor accepts it the certificate is issued. Our guide to closing out a non-conformance covers what they expect in that response.
A major non-conformance is more serious and usually needs evidence of the fix before the certificate is issued, sometimes with a follow-up visit. It is still recoverable. It is not a failure, it is a delay.
The week before
Do three things. Walk the site and look at it as a stranger would. Tell your staff the audit is happening, what it is for, and that being honest with the assessor is the right answer to every question. And make sure whoever is hosting the assessor has cleared their diary properly, because the single most common cause of a bad audit day is the one person who knows the system being pulled into something else.
If you want the system built and the evidence in place before any of this starts, that is what our ISO consultancy service does. The aim is that your team can answer for the system on the day without anyone holding their hand, because a system that needs a consultant in the room to get through its own audit is one you will be paying for every year. We also help you choose a certification body.
‹ Back to all articles