Auditing

What a first ISO audit actually looks like

Stage 1, stage 2, findings and what happens after. A plain description of the certification audit for organizations going through it for the first time.

ML Consultancy2 min read

A person using a tablet beside a laptop showing dashboards

The first certification audit is more predictable than it feels. It runs in two stages, the auditor is working to a defined scope, and almost everything that is going to be asked can be anticipated.

The ten main clauses of ISO 9001:2015, from scope and normative references through to improvement — What the auditor works through, clause by clause.

Stage 1

A readiness check, usually shorter and sometimes remote. The auditor confirms the scope is right, the documented system exists, the legal requirements have been identified, internal audits have run, and management review has happened. Stage 1 findings are not failures — they are the list of things to close before stage 2. Treat them as the gift they are.

Stage 2

The full assessment, on site. The auditor samples: they pick processes, follow them end to end, and look for evidence that what is written is what happens. Expect them to talk to operators and supervisors, not only the management representative. Expect them to ask to see records chosen at random rather than prepared in advance.

Findings

A major nonconformity means a required element is absent or has broken down — certification waits until it is fixed and verified. A minor means a single lapse against a requirement that otherwise works; it needs a corrective action plan with a cause. An observation or opportunity for improvement is advisory and carries no obligation, though it often predicts next year's finding.

Preparing without theatre

The instinct is to tidy. A better use of the time is to run a genuine internal audit and act on what it finds, because that is the evidence the external auditor is looking for. A site with open findings it is visibly working through reads better than one with an empty register.

Brief the people who will be asked. Not with answers — with context: what the audit is, what the auditor may ask, and that "I don't know, but I know who does" is a perfectly good answer. The worst outcome is a confident wrong answer from someone trying to be helpful.

Afterwards

Certification runs on a three-year cycle with surveillance audits in between, so the system has to survive contact with normal operations. The organizations that find year two easy are the ones that stopped treating the system as an audit exercise somewhere during year one.

Keep reading

PharmaContamination control starts with a wider view.The company brief connects contamination control, employee safety and operational performance.AuditingA clearer starting point for your next audit.Understand the scope of an audit and the value of a focused review.TrainingTraining shaped around the organization.A look at MLC’s approach to environment, health, fire and safety learning.

All articles →