The Certification Audit — Stage 1 and Stage 2 Explained

The Certification Audit — Stage 1 and Stage 2 Explained

This is it. After months of planning, building your QMS, training staff, and conducting internal audits, the registrar auditor arrives. They'll spend 2-3 days observing your organisation, reviewing documentation, and interviewing staff.

They're asking one central question: Does this organisation have a quality management system that meets ISO 9001:2015, and is it actually working?

This chapter walks you through what to expect—both Stage 1 and Stage 2 audits—how to prepare, what auditors are looking for, and how to respond if they find non-conformances.

Understanding the Two-Stage Process

The registrar's certification audit happens in two phases:

Stage 1 Audit (Desk and Readiness Review)

When: Typically 2-4 weeks before Stage 2

Duration: 1-2 days on-site

What They Do:

• Review your documentation (QMS manual, procedures, work instructions, policies)
• Interview management about your QMS
• Tour the facility to understand your scope
• Identify any obvious gaps between your documentation and ISO 9001

  What They're Looking For:

• Is your QMS documented?
• Do procedures align with ISO 9001?
• Are management committed?
• Are there any glaring non-conformances we should know about now (rather than discovering during Stage 2)?

  Possible Outcomes:

• Clear: No issues identified. Proceed to Stage 2 as scheduled.
• Observations: Minor issues noted (e.g., "Policy wording could be clearer," "One procedure is missing"). Typically not blocking; can be addressed before Stage 2.
• Non-Conformances: Significant gaps found (e.g., "No evidence of management review," "Procedures don't match actual work"). Usually requires delay to Stage 2 to allow remediation.

Stage 2 Audit (Full Compliance Audit)

When: Typically 2-4 weeks after Stage 1

Duration: 2-3 days on-site (varies by organisation size and complexity)

What They Do:

• Review all major processes in detail
• Interview staff at all levels
• Observe work actually happening
• Review quality records and evidence
• Evaluate whether the QMS is effectively achieving its objectives

  What They're Looking For:

• Are documented procedures being followed?
• Are people competent to do their jobs?
• Are records maintained (evidence the QMS is working)?
• Are customers satisfied?
• Is the QMS actually preventing non-conforming product from reaching customers?

  Possible Outcomes:

• Certified: Excellent. You receive your ISO 9001 certificate valid for 3 years.
• Certified with Observations: Minor improvements noted (e.g., "Non-conformance procedure could include more detail on effectiveness verification"). Doesn't block certification, but registrar will expect improvement at next annual audit.
• Non-Conformances: Issues found that prevent certification. Common reasons: procedures not being followed, no evidence of required activities, insufficient controls. You'll have 30-60 days to address, then Stage 2 completion audit is scheduled.

Pre-Audit Preparation

You can't cram for a compliance audit. But you can prepare intelligently.

4-6 Weeks Before Stage 1

Week 1-2: Readiness Assessment

• Conduct an internal audit of your entire QMS (think of it as a dress rehearsal)
• Identify gaps that an external auditor would find
• Prioritise closing any non-conformances

  Week 2-3: Documentation Review

• Quality manager reviews all procedures and work instructions
• Ensure consistency (no contradictions between procedures)
• Ensure they reflect current practice
• Update any outdated procedures
• Ensure all critical procedures are documented (don't leave major gaps)

  Week 3-4: Records Review

• Locate quality records for the past 6-12 months
• Ensure they're organized and retrievable
• Verify that records show the QMS is working (audits completed, management reviews held, non-conformances addressed, training records current)
• Look for gaps (e.g., "No management review records for Q2"). If missing, schedule a management review and complete it before Stage 1.

  Week 4-5: Stakeholder Briefing

• Brief leadership on what to expect
• Prepare key people for interviews (operations manager, quality manager, supervisor, production staff)
• Explain that auditors are looking for honest answers, not perfect answers
• Remind staff to be truthful; lying is worse than admitting a process could be better

  Week 5-6: Registrar Coordination

• Confirm Stage 1 date with registrar
• Provide facility access details
• Ask registrar for their specific audit plan (which processes will they focus on?)
• If there are areas you're concerned about, mention them (gives you a chance to explain or address before formal audit)

1-2 Weeks Before Stage 1

Final Documentation Review:

• Print key procedures and make them available to the audit team
• Ensure the QMS manual (if you have one) is current
• Prepare an organisational chart showing roles and responsibilities
• Prepare a facility map showing departments and processes

  Records Preparation:

• Organise quality records logically (by date, by process, by type)
• If records are digital, ensure auditors can access them
• Prepare a summary of records available (so auditors know what exists)

  Team Briefing:

• Conduct a short meeting (15-30 minutes) with key staff
• Explain who the auditors are and why they're coming
• Ask them to be prepared to explain their work and answer questions
• Remind them: be honest, be professional, but don't over-explain or get defensive

  Facility Preparation:

• Ensure the facility is clean and organised (auditors aren't looking for perfection, but chaos raises questions)
• Post your quality policy visibly
• Ensure procedures/work instructions are accessible at work stations
• Make sure safety signage is up and equipment is well-maintained (it speaks to your overall discipline)

1 Week Before Stage 1

Confirm Details:

• Confirm audit date/time with registrar
• Ensure someone will greet the auditor
• Arrange meeting rooms for interviews and document review
• Ensure internet access for the auditor (they often need to access registrar systems)

  Final Briefing:

• Brief the audit opening meeting participants (typically CEO/General Manager and quality manager)
• They should know:
• The auditor's name and background
• The audit scope (which processes will be focused on)
• The expected timeline
• What will be discussed (document review, facility tour, interviews)

  Mentally Prepare:

• Remember: an audit is an opportunity to demonstrate your QMS, not a gotcha exercise
• You've done the work; the audit just verifies it

During Stage 1: What Happens

Opening Meeting

The auditor meets with your leadership:

• Introduces themselves and their background
• Explains the audit scope (ISO 9001 standard, your stated scope, specific processes they'll focus on)
• Outlines the timeline
• Explains that they're looking for objective evidence—documentation, records, observation
• Answers questions

Your Opening (2-3 minutes):

Leadership briefly explains:

• Your organisation's purpose and main products/services
• Your QMS scope
• A brief history of the QMS (new? mature?)
• Your expectations (e.g., "We're ready for audit; we've done a lot of internal preparation")

Document Review

The auditor reviews:

• Quality policy
• Quality objectives
• QMS manual (if you have one)
• Key procedures
• Audit plan and scope documentation

  What they're checking:

• Does the policy exist and commit to quality and improvement?
• Are procedures documented for all major processes?
• Does documentation align with ISO 9001?
• Are procedures internally consistent?

Your role: Make documents easily accessible. Answer questions about why you've structured something a certain way. Don't over-explain; be concise.

Facility Tour

The auditor walks your facility, observes work, and notes:

• Is work happening as documented?
• Are procedures posted and accessible?
• Is equipment well-maintained?
• Is the environment conducive to quality?
• Do staff seem to understand what they're doing?

Your role: Provide context. If something looks chaotic, explain why and what you're doing about it. Don't pretend perfection; auditors respect honesty.

Interviews

The auditor interviews key people:

• CEO/General Manager: "Tell me about your quality policy and commitment. How do you ensure quality is prioritised?"
• Quality Manager: "Walk me through the QMS. What are the key processes? How do you ensure they're working?"
• Production Supervisor: "What are your responsibilities for quality? How do you know if something's not right? What do you do about it?"
• Operator/Inspector: "Walk me through your job. What procedures do you follow? What training have you had?"

  What they're listening for:

• Do people understand their roles?
• Do people understand how their work affects quality?
• Can people explain their procedures?
• Are people engaged or defensive?

  Tips for interviewees:

• Be honest. If you don't know something, say so.
• Speak from your experience. Don't parrot company jargon.
• If you're asked about a procedure you follow, walk the auditor through it as if you're doing it
• It's okay to say "I'm not sure about that; let me have QMS owner answer that"

Closing Meeting

The auditor summarizes findings from Stage 1:

• What went well
• Any observations or minor issues
• Any non-conformances (if found)
• Next steps

You'll receive a written Stage 1 report within 1 week.

Between Stage 1 and Stage 2 (2-4 Weeks)

If Stage 1 findings were minor (observations, no non-conformances):

• You can address them if you wish, but they don't block Stage 2
• Focus on preparing for Stage 2

  If Stage 1 identified non-conformances:

• You have 30-60 days to address them
• You'll need to demonstrate corrective action before Stage 2 proceeds
• This might involve: updating procedures, conducting training, implementing controls, providing evidence
• Registrar may request documentation of corrective action before Stage 2

Preparing for Stage 2 (2 weeks before)

Do a Final Internal Audit:

Auditors audit against what you've documented. Make sure current operations match current documentation.

Prepare Records:

• Gather 6-12 months of quality records (inspection reports, non-conformance logs, audit reports, management review minutes, training records)
• Organise them logically
• Prepare a summary of what records you maintain

  Brief Your Team:

• Stage 2 is a deeper dive. The auditor will spend more time observing and interviewing
• Staff should be prepared to explain their work, reference procedures, discuss quality issues they've encountered
• Keep interactions professional but relaxed; the auditor is trying to understand how you work, not trick anyone

  Prepare Key Documents for Easy Reference:

• Copies of critical procedures (procurement, production, quality control, non-conformance handling)
• Organisational chart showing roles and responsibilities
• Quality objectives and progress to date
• Internal audit schedule and recent audit reports
• Management review minutes from the past year

During Stage 2: What Happens

Stage 2 is longer and more detailed than Stage 1.

Opening Meeting (Same as Stage 1)

Auditor explains scope, timeline, and expectations.

Process Auditing

The auditor dives deep into each major process. They follow the flow of a product or service through your system:

Example: For a manufacturing organisation:

Process 1: Order-to-Production (Clauses 8.1, 8.2, 8.5)

• Interview: How do customer orders arrive? How do you ensure you understand requirements?
• Document Review: Review 5-10 recent orders. Do they show feasibility review? Are customer specs clearly documented? Are they communicated to production?
• Observation: Watch an order enter the system. See how it flows to planning and production.
• Interview Production: Ask how they know what to make. Can they find the customer spec?

  Process 2: Procurement (Clause 8.4)

• Interview: How do you select suppliers? How do you communicate requirements?
• Document Review: Approved supplier list, supplier agreements, recent POs, incoming inspection reports
• Observation (if time permits): Tour receiving area, observe incoming inspection

  Process 3: Production (Clause 8.5)

• Interview: Operators, supervisors. How do you follow procedures? What training have you had?
• Document Review: Work instructions, production schedules, equipment maintenance logs, calibration records
• Observation: Walk the line. Observe production setup, in-process checks, final inspection
• Ask operators questions: "What does this drawing mean? How do you know if something's wrong? What do you do if you find a defect?"

  Process 4: Quality Control (Clause 8.5, 8.6, 8.7)

• Interview: Inspectors. Walk me through your inspection process.
• Document Review: Inspection procedures, acceptance criteria, inspection records, non-conformance logs
• Observation: Watch an inspection. See how it's done.

  Process 5: Non-Conformance and Corrective Action (Clause 10.2)

• Document Review: Non-conformance reports from the past year. Do they show:
• Clear description of the problem?
• Root cause analysis?
• Corrective action taken?
• Verification that corrective action worked?
• Interview: Ask staff "What do you do if you find a defect?" "Who do you report to?" "How is it investigated?"

  Process 6: Internal Audits (Clause 9.2)

• Document Review: Audit plan, audit reports, findings, corrective actions
• Interview: Internal auditors. How do you conduct audits? What have you found?

  Process 7: Management Review (Clause 9.3)

• Document Review: Management review minutes from the past year. What data was reviewed? What decisions were made? Were decisions implemented?
• Interview: Senior management. How often do you review QMS performance? What have you decided to change based on reviews?

  Process 8: Competence and Training (Clause 7.2, 7.3)

• Document Review: Training records, competence assessments, job descriptions
• Interview: Staff. What training have you had? How do you know if you're doing your job correctly?

Interview Techniques

The auditor might ask:

• Open-Ended: "Walk me through how you do X process."
• Specific: "I reviewed this order. Can you show me where the feasibility review is documented?"
• Follow-Up: "You mentioned the supplier sends a cert with each shipment. Can you show me one?"
• Verification: "You said staff are trained on this procedure. Can you show me the training record?"
• Observation: "I observed you doing X. Can you explain that step?"

  How to respond:

• Answer the question asked; don't over-explain
• Be honest. If something's not being done perfectly, say so
• Provide evidence if asked. "I said we train on procedures—here are the training records"
• Ask for clarification if you don't understand: "Are you asking about Stage 1 procedure or the current procedure?"

Sampling

Auditors don't review every record and observe every operation. They sample:

• 5-10 recent customer orders (out of maybe 200 per year)
• 20-30 inspection records (out of maybe 500 per year)
• 3-5 non-conformance reports (out of maybe 8 per year)

They're looking for patterns. If sampled records show procedure compliance and quality thinking, they're satisfied. If they see problems in the sample, they'll ask more questions and review more records.

Closing Meeting

The auditor summarizes findings:

• Conformities: Areas where the QMS is working well
• Observations: Minor improvements suggested (not blocking certification)
• Non-Conformances: Issues that prevent certification (usually procedural non-compliance or lack of control)

  Possible outcomes:

• Certified: No non-conformances. You're issued a certificate valid for 3 years.
• Certified with Non-Conformances: Usually relates to procedural compliance. You have 30 days to correct (or longer by agreement). A brief follow-up audit may be scheduled to verify closure.
• Not Certified: Significant non-conformances (major process gaps, lack of leadership commitment, no evidence of functioning QMS). You won't be certified; can reapply after addressing issues.

Common Non-Conformances Found

Based on our experience with Canadian organisations, here are the most common issues registrars find:

1. Procedure Non-Compliance

Issue: Procedures are documented, but people aren't following them.

Example: "Your non-conformance procedure says findings should be reviewed within 2 days. I reviewed 5 NCRs; three were reviewed after 5+ days."

Fix: Understand why non-compliance is happening. Is the procedure unrealistic? Is there inadequate communication? Is there inadequate supervision? Address the root cause, not just the symptom.

2. Missing or Inadequate Documentation

Issue: Critical documentation doesn't exist or is incomplete.

Example: "Your supplier procedure doesn't document how you evaluate suppliers before approval. How do you ensure suppliers meet your requirements?"

Fix: Document what you're doing (or start doing it if it's not happening).

3. Lack of Records/Evidence

Issue: Activities required by the standard (training, audits, management review) aren't documented.

Example: "You say staff are trained on safety procedures. Where are the training records?"

Fix: Create and maintain the required records going forward. For past activities, document them retroactively if possible.

4. No Evidence of Effectiveness

Issue: An activity happens, but you don't verify it's working.

Example: "You have an internal audit procedure, but I don't see evidence that you're tracking whether corrective actions from audits actually resolved the issues."

Fix: Add a verification step (e.g., auditor conducts a follow-up audit to confirm corrective action was effective).

5. Insufficient Control

Issue: A critical process lacks adequate controls.

Example: "Your production procedure doesn't specify acceptance criteria for incoming material. How do you know if material is acceptable?"

Fix: Define acceptance criteria, document them, and implement inspection/verification.

6. Unclear Responsibility

Issue: It's unclear who's responsible for something.

Example: "When a non-conformance is found, who's responsible for investigating it? Your procedure doesn't specify."

Fix: Add clear responsibility language: "The Quality Manager is responsible for initiating a non-conformance investigation within 24 hours."

7. Management Not Engaged

Issue: Leadership hasn't bought in to the QMS.

Example: "I interviewed the CEO. They couldn't explain the quality policy or discuss QMS performance data."

Fix: This is harder to fix quickly. Requires leadership engagement. Management review, communication, and visible commitment are critical.

After Stage 2: Closing Out

If you receive a certificate with no non-conformances:

• Congratulations! Your certificate is valid for 3 years.
• You'll be scheduled for annual and semi-annual surveillance audits to ensure ongoing compliance
• Use this momentum to continue improvement

  If you receive non-conformances:

• You have 30 days (or longer by agreement) to provide evidence of corrective action
• Submit documentation to your registrar
• Registrar verifies corrective action is adequate
• You're then issued the certificate

  If you're not certified:

• You'll need to address the significant issues
• Typically, you'd reapply for audit after 3-6 months of remediation

Tips for a Successful Audit

1. Be Honest

If something's not perfect, say so. Auditors expect continuous improvement, not perfection.

2. Provide Evidence

When asked "How do you ensure X?", provide documentation or demonstrate it. Don't just tell the auditor.

3. Involve the Team

When staff are interviewed, they should understand the context and be prepared. But don't coach them on what to say; let them speak authentically.

4. Ask for Clarification

If you don't understand a question, ask. "Are you asking about the procedure itself, or how we implement it?"

5. Respond to Observations

If the auditor makes an observation (e.g., "Your procedure could be clearer"), listen. You don't have to argue; you can just acknowledge it.

6. Don't be Defensive

If the auditor finds a gap, don't blame circumstances or other departments. Acknowledge it and explain how you'll fix it.

7. Plan Follow-Up

If non-conformances are found, immediately plan how you'll address them. Have a tentative action plan ready to discuss with the auditor in the closing meeting.

Your Certification Audit Checklist

Before your Stage 1 audit, you should have:

• Complete QMS documentation (policies, procedures, work instructions)
• All required records maintained (training, audits, management reviews, non-conformances)
• At least one complete internal audit cycle completed
• All internal audit findings corrected
• At least one management review completed with documented decisions and actions
• Staff trained on procedures and aware of their QMS roles
• Facility organised and well-maintained
• Leadership briefed on what to expect and their roles
• Key documents organised and easily retrievable
• Quality records summary prepared for auditor

Preparing for your certification audit?

PinnacleQMS helps organisations prepare for ISO 9001 audits. From pre-audit readiness assessments through audit preparation and follow-up, we ensure you're ready and confident when the registrar arrives. Contact us to discuss your audit readiness.

Next: Chapter 9: After Certification — Surveillance Audits and Continual Improvement.