ISO 9001 Stage 1 and Stage 2 audits: what auditors check, day by day

What each stage checks

At Stage 1 the auditor asks whether your quality management system is ready to be audited. At Stage 2 the auditor asks whether it works: whether what you planned is done across the whole scope and delivers the results you set.

Both stages are required by ISO/IEC 17021-1, the international standard for bodies that audit and certify management systems, against which accreditation bodies assess certification bodies. That is why accredited bodies in Manila and London run an initial ISO 9001 audit on the same pattern. Selecting a body is covered in choosing an ISO 9001 certification body, and the full route to the certificate in the certification process guide.

Stage 1: the readiness review

ISO/IEC 17021-1 sets out what Stage 1 must achieve. Read as a checklist, it tells you what the auditor will ask for.

The certification body must tell you beforehand which Stage 1 activities will be on site; site conditions are hard to judge from documents, so expect some time at your premises. Stage 1 ends with documented conclusions on your readiness and any areas of concern that could become nonconformities at Stage 2. It is not a gap analysis: the auditor names concerns but does not design the fix.

Between the stages

The certification body must take your need to resolve those concerns into account when setting the interval, and may revise its Stage 2 arrangements because of them. Close each with evidence. You receive the audit plan and the names of the audit team in advance, and the dates are agreed with you; a valid objection to a team member obliges the body to reconstitute the team.

Stage 2: implementation and effectiveness

Stage 2 evaluates implementation, including effectiveness, at your site or sites. ISO/IEC 17021-1 requires it to cover at least:

• conformity with all the ISO 9001 requirements within your scope;
• monitoring, measuring, reporting and review of performance against key objectives and targets;
• meeting applicable statutory, regulatory and contractual requirements;
• operational control of your processes;
• internal audit and management review;
• management responsibility for your policies.

Effectiveness is the difference. A followed procedure shows implementation; a process that achieves its planned results, or whose shortfalls are noticed and acted on, shows effectiveness. Auditors test it by following consequences: a complaint to its corrective action and on to whether the problem returned.

A typical Stage 2, day by day

The certification body sets Stage 2 audit time from your effective personnel, process complexity and sites, under accreditation rules; the cost guide explains those drivers. This illustration assumes three days, one auditor and one site; your audit plan sets the real order.

Top management comes first because policy, objectives and management review frame everything else; if leadership cannot explain the system's purpose, each process audit tends to find the same gap. Each auditor normally has a guide from your side, and observers must be agreed with the certification body beforehand.

How auditors sample the evidence

ISO/IEC 17021-1 requires evidence to be gathered by appropriate sampling and verified through interviews, observation of processes and activities, and review of documents and records. In practice:

• The auditor chooses the sample from lists you provide: orders, complaints, suppliers, training records.
• Trails cross departments, from enquiry to invoice, because problems collect at the hand-offs.
• Answers are checked against records and, where possible, the work itself.

Sampling cuts both ways: a clean audit does not prove every process conforms, and one finding does not condemn a whole process. For multi-site organisations, accreditation rules also govern which sites are visited. The questions auditors typically put are in our audit questions guide.

How findings are raised

A nonconformity is recorded against a specific requirement of ISO 9001, with a clear statement of what is wrong and the objective evidence behind it. The auditor discusses it with you to confirm the evidence is accurate and understood; that is the time to produce a record the auditor has not seen, not to bargain over the grade. The auditor must not suggest the cause or the solution, a restraint that protects the certificate's impartiality.

• Major nonconformity: affects the capability of the system to achieve its intended results.
• Minor nonconformity: does not affect that capability.
• Opportunity for improvement: not a nonconformity, recorded where the scheme allows, and never a way to soften one.

Differences the audit team leader cannot resolve are recorded and referred to the certification body. Closing nonconformities is covered in our nonconformities guide.

The closing meeting, the report and the decision

The closing meeting presents the conclusions, including the recommendation on certification. You must also be told that the evidence came from a sample, how findings are reported and graded, how nonconformities affect certification, the deadline for your correction and corrective action plan, the certification body's next steps, and how complaints and appeals work. The written report belongs to the certification body; it states whether the system conforms and is effective, records unresolved issues and carries the recommendation.

The recommendation is not the decision. Competent people at the certification body who did not conduct the audit decide, after confirming that the audit information is sufficient, that corrections and corrective actions for every major nonconformity have been reviewed, accepted and verified, and that plans for minor ones have been accepted. A major nonconformity not verified within six months of the last day of Stage 2 means another Stage 2. Certification then starts a three-year cycle, covered in our surveillance and recertification guide.

Stage 1 and Stage 2 audits: questions buyers ask