A certification audit is not an exam to be crammed for the night before. It is an independent check that your management system is in place, working and producing results. Good preparation is mostly about making sure the system is genuinely running — and that you can show it.
Understand what the audit involves
For accredited certification, certification bodies work to the international requirements in ISO/IEC 17021-1. The initial audit is normally carried out in two stages:
| Stage 1 | Stage 2 | |
|---|---|---|
| Purpose | Check readiness | Evaluate implementation and effectiveness |
| Typical focus | Scope, documented information, understanding of requirements, legal requirements, planning of internal audit and management review | Interviews, observation and records across processes, sites and shifts in scope |
| Outcome | Areas of concern to resolve before stage 2 | Findings; certification recommendation once any major nonconformities are closed |
After certification, surveillance audits take place at least annually, and a recertification audit is held before the certificate expires, normally at the end of a three-year cycle.
Eight weeks before: check the fundamentals
- Scope — Does the scope statement accurately describe the sites, activities and products or services covered?
- Policy and objectives — Are they approved, communicated and measured? Can you show trend data?
- Risks and opportunities — Is there a current register with actions and owners?
- Legal and other requirements — Is the list complete and up to date, with evidence of compliance evaluation (especially for ISO 14001 and ISO 45001)?
- Documented information — Are procedures current, approved and actually followed? Remove obsolete versions from the workplace.
Four to six weeks before: complete the internal checks
- Internal audit — Every clause and every process in scope should have been audited, by people who are not auditing their own work. See Internal Audits vs. Certification Audits.
- Management review — Top management should have reviewed all the required inputs (audit results, objectives, customer or stakeholder feedback, performance, risks, resources, improvement opportunities) and recorded decisions.
- Corrective actions — Findings from internal audits should be analysed for root cause, with actions taken and their effectiveness checked.
Two weeks before: records and readiness
Gather the evidence your system produces. Depending on the standard, typical records include:
- Training and competence records; awareness evidence
- Calibration certificates for measuring equipment
- Supplier evaluation and monitoring
- Inspection and test results, release records
- Customer complaints and satisfaction data
- Incident, near miss and emergency drill records (ISO 45001)
- Monitoring data and compliance evaluation (ISO 14001)
- Risk assessment, Statement of Applicability and control evidence (ISO/IEC 27001)
Check the audit plan from the certification body: who will be interviewed, when, and which sites or shifts are included. Make sure those people are available.
Prepare your people — honestly
- Brief staff on the purpose of the audit and what the auditor may ask: What is your role? How do you know you are doing it right? What do you do when something goes wrong?
- Encourage honest answers. "I don't know, but I would check the work instruction here" is a good answer. Scripted answers are easy to spot and undermine confidence.
- Appoint guides who know the processes and can locate records quickly.
On audit day
- Start on time; attend the opening meeting with top management present.
- Answer the question asked; show evidence rather than describing it.
- If the auditor raises a concern, make sure you understand it — ask for the requirement and the evidence.
- Keep a note of observations as they arise so nothing is a surprise at the closing meeting.
After the audit: handling findings
Certification bodies typically classify findings as major or minor nonconformities, and may also record observations or opportunities for improvement.
- Correction fixes the immediate problem.
- Corrective action removes the root cause so it does not recur.
- Submit your response within the deadline your certification body sets. Major nonconformities must be resolved — and often verified — before certification can be granted.
Key takeaways
- Run the system for long enough to produce real records before the audit.
- Complete a full internal audit and a management review first.
- Prepare people to explain their work honestly, not to recite scripts.
- Treat findings as free improvement advice — and fix root causes, not just symptoms.
Sources & further reading
- ISO/IEC 17021-1:2015 — Requirements for bodies providing audit and certification of management systems — ISO
- Certification — ISO — ISO
Links open the original publisher's page. Summaries on this page are written by Certsure; for the authoritative text of any standard, refer to the official publication.
