ISO 9001 common mistakes: the ten that fail audits, why they happen, and the fix for each

What failing an ISO 9001 audit actually looks like

Few organisations hear the word "fail" at a closing meeting. Failure is quieter: Stage 1 finds the system not ready and Stage 2 slips, or Stage 2 raises major nonconformities and the certificate waits until each is verified as resolved. If one is still unverified six months after Stage 2, Stage 2 is repeated.

In our experience, the ten mistakes below cause most of those outcomes; the nonconformities guide covers grading and closure, the Stage 1 and Stage 2 guide the audit days.

Mistakes 1 to 3: documents, leadership and planning

1. Procedures that describe the ideal, not the work

• Why: they were written at a desk or from a template and never tested against the job.
• In the audit: the auditor reads a procedure, then asks the people doing the work to show it. Enough differences put process control itself in doubt.
• Fix: write procedures with the people who run each process and test them on a real job. The documentation guide sets out what is required.

2. The system belongs to one person

• Why: certification is handed to a quality coordinator or the consultant, and managers treat quality as that person's job.
• In the audit: auditors often start with top management. If the coordinator answers every question on objectives and review decisions, leadership evidence is thin; ISO 9001:2026 also expects leaders to promote quality culture and ethical behaviour.
• Fix: top management owns the objectives and chairs the review; process owners explain their own processes.

3. Planning written once and filed

• Why: the risk register and objectives were produced for the document set, often from a generic list, then shelved.
• In the audit: the auditor asks where a real event, such as a lost customer, appeared in your planning, and for each objective's current figure. The 2026 edition also gives risks and opportunities separate actions (6.1.2, 6.1.3).
• Fix: process owners hold their risks and opportunities; every objective has a number, an owner and a date, reviewed monthly.

Mistakes 4 to 6: competence, records and suppliers

4. Competence assumed, not evidenced

• Why: experienced people are trusted to know the job, so nobody defined competence for each role or kept the proof.
• In the audit: the auditor samples people who inspect, approve or release work, asks for evidence of competence (7.2), then asks what the quality policy means to them (7.3).
• Fix: criteria for each role and evidence for each person. The training guide sets out who needs what.

5. Records scattered, versions uncontrolled

• Why: work runs on e-mail, shared drives and personal spreadsheets, and printed copies are never withdrawn.
• In the audit: a record from months ago cannot be produced, or a workstation holds a superseded specification. Both are findings under documented information (7.5).
• Fix: one controlled home for documents and records, with owners, versions and retention. In a Sterling engagement that is Effivity, included with the engagement, at no additional cost.

6. Suppliers and outsourced work outside the system

• Why: long-standing suppliers are trusted on relationship alone, and outsourced processes are not seen as part of the system.
• In the audit: the auditor traces a purchase to its supplier and asks how it was selected and what changed after the last rejected delivery. Outsourced work with no defined control is a finding under 8.4.
• Fix: criteria for selection and re-evaluation, and controls in proportion to what each supplier can affect.

Mistakes 7 to 9: internal audit, management review and corrective action

These are the system's own checks; when they work, they catch mistakes 1 to 6 first.

7. An internal audit designed to find nothing

• Why: it is squeezed into the fortnight before Stage 2, run by whoever wrote the procedures and treated as an exam.
• In the audit: the certification body checks that the programme covered the whole scope, that nobody audited their own work and that findings were acted on (9.2).
• Fix: every process covered, by trained auditors independent of the area. The internal audit guide explains how.

8. A management review with no decisions

• Why: the meeting becomes a presentation of charts, with attendance recorded and nothing concluded.
• In the audit: the auditor reads the record for the required inputs and, above all, the outputs: decisions on improvement, changes to the system and resources (9.3).
• Fix: a standing agenda, and decisions recorded with owners and dates. See the management review guide.

9. Correction without corrective action

• Why: under pressure, fixing the instance feels like fixing the problem: order re-sent, operator retrained, file closed.
• In the audit: the auditor picks a closed complaint and asks what caused it and how you know it has not recurred. A recurrence turns the corrective action process itself into the finding (10.2).
• Fix: act on the cause, not only the instance, and close the action once it is shown to work.

Mistake 10: booking Stage 2 before the system has a history

• Why: a tender, a customer or the budget year sets the date, not the state of the system.
• In the audit: Stage 1 checks that internal audits and management review have been planned and performed and that the system is ready. A few weeks of records ends the process there, or leaves Stage 2 little to sample.
• Fix: work back from the evidence: records from every process, a full internal audit and management review, findings closed. The timeline guide covers the operating period.

The shortcuts that cost more than they save

We understand the appeal. A tender closes in six weeks and someone offers to make the problem disappear. Three offers recur, and each moves the ten mistakes rather than removing them.

• The template manual. Procedures with your logo on the cover are mistake 1 in a ring binder. The auditor interviews your people, not the binder.
• The certificate from an unaccredited body. It looks the same on the wall and fails when a customer checks the accreditation behind it, usually with a contract at stake. See how to verify a certificate and choose a certification body.
• The date promised on the first call. A certification date is the output of a plan, and nobody can plan before seeing your processes, sites and records.

Our own practice is simple: a realistic range in the proposal, then a firm audit date agreed once the gap analysis shows what has to change. Not the quickest route to paper; the route to a certificate that stands up when a customer checks it.

ISO 9001 common mistakes: questions buyers ask