ISO 9001 audit questions: what certification auditors actually ask, who they ask, and the evidence that answers them

How certification auditors ask their questions

What does an ISO 9001 certification auditor ask? Mostly open, practical questions about how the work really runs: "show me", "walk me through", "what happens when". They go to the people who do the work, from the managing director to the storekeeper, and each answer is checked against a record or against what the auditor sees. ISO/IEC 17021-1, the standard certification bodies are accredited to, names three methods of gathering evidence: talking to people, watching the work, and reading documents and records.

Auditors join the three into trails: an amended order from last month leads into production, then to the operator who made it and, later that day, to the operator's training record in HR. Planning and sampling are explained in our guide to Stage 1 and Stage 2 audits.

Questions for top management, process owners and the quality lead

These interviews test whether the system is managed or merely administered, and whether leaders, process owners and the quality lead can show it without reaching for a file.

Questions for operations staff, purchasing and HR

Most interviews happen where the work is done, and people are asked to show rather than tell. The operator met in the morning becomes the competence record requested in the afternoon.

How to prepare people without scripting them

The aim is people who can explain their own work and show its records, not people who recite.

• Explain, then have them explain back. Brief each team on what the policy and objectives mean for its work, then ask each person to say it in their own words.
• Practise with open questions. A colleague from another department asks "walk me through" and "show me" at the workstation; the goal is fluency, not the right phrase.
• Make records findable. Everyone should open their own records without help, in Effivity, a job file or a logbook.
• Teach four habits. Hear the whole question, answer it and stop, show rather than describe, and say "I would check" when that is true.
• Brief the logistics. Guides, the timetable, the areas and shifts to be visited, and the auditors' safety briefing.

Tell people the auditor is assessing the system, not them. Nervous people over-explain, and over-explaining turns a correct answer into an inconsistent one.

What not to do in front of the auditor

• Rehearsed answers. When five people recite the policy in identical words, the auditor knows it was taught and asks what no script covers: "show me where that happened last month."
• Hiding records or steering the route. The auditor chooses the sample. A complaint file kept out of sight, once found, casts doubt on everything else; the same problem disclosed, with its corrective action under way, shows the system working.
• Manufacturing records in the final week. A year of supplier evaluations dated in the same week is noticed, and turns a missing-record finding into a question of integrity.
• Answering for someone else. A manager, guide or consultant who steps into a staff interview suggests the system lives with a few people.
• Arguing. Disagree with evidence, calmly, on site. The audit team leader must try to resolve differences and record any left open, and the certification body has an appeals process; our guide to ISO 9001 nonconformities covers challenging a finding.

How Sterling's mock audit works

Near the end of implementation, after your internal audit and management review, Sterling's expert and experienced consultants run a mock audit as a certification audit is run: a plan, an opening meeting, interviews at every level, workplace observation, record trails and a closing meeting.

Two things differ. Each finding is graded as a certification body would grade it and closed with your team, with evidence, before the real audit. And people hear how they answered, so coaching replaces scripts.

ISO 9001 audit questions: questions buyers ask