Chapter 47: Audits, Nonconformances, and Certification Process Questions

What's the difference between a Stage 1 and Stage 2 audit, and what should we prepare for each?

A Stage 1 (documentation) audit happens first, usually a few weeks before Stage 2. The auditor reviews your quality manual, procedures, work instructions, and resource plans—everything on paper. They check whether your system *could* work: Do you have procedures for everything required? Are responsibilities clear? Is your quality manual coherent?

Stage 1 typically takes 0.5 to 1 day for a small plant and flags any obvious gaps you need to fix before Stage 2.

Stage 2 (implementation) audit happens 1 to 3 months later and is the real test. The auditor walks the floor, talks to staff, reviews actual records, and verifies that your system works as documented. They pull last month's inspection records. They ask a machinist about your first-piece inspection process. They check whether preventive maintenance actually happened.

If Stage 1 revealed gaps, you've had time to fix them. Stage 2 typically lasts 2 to 3 days depending on your operation's size and complexity.

Prepare for Stage 1 by ensuring your procedures are complete and make sense. Prepare for Stage 2 by making sure your team actually *follows* those procedures and keeps records. The auditor isn't looking for perfection—they're looking for evidence that your system works in practice.

If we get a major nonconformance, does that mean we fail certification?

Not automatically, but a major nonconformance blocks your certification temporarily. Here's how it works: If an auditor finds a major gap (e.g., no procedure for handling nonconforming product, or management review hasn't happened in over a year), they issue a major nonconformance. You then have 30 days to submit evidence that you've fixed it.

They review the evidence. If they're satisfied, you get your certificate. If not, you don't get certified in that cycle and have to schedule a follow-up audit (at your cost).

A minor nonconformance is a gap that doesn't block certification. It might be incomplete records, a procedure that's outdated, or training documentation that's missing dates. You commit to fixing it (usually within 1 to 3 months) and show evidence at your first surveillance audit. Most plants get 1 to 3 minor nonconformances during Stage 2. It's normal.

What matters is how quickly you address it. The best strategy is simple: During your internal audits (which you run before the official audit), audit yourself as rigorously as the certification body would. If you find gaps during an internal audit, you control the timeline to fix them. If the auditor finds them, you're on a deadline and potentially losing certification revenue in the meantime.

What are surveillance audits, and when do they happen?

Once you're certified, your certification body audits you again every 12 months (surveillance audits) and every 3 years (recertification audit). Surveillance audits typically take 0.5 to 1 day and check that you're maintaining your system. The auditor reviews records from the past 12 months, talks to staff, and verifies that you haven't drifted from your documented processes.

Many plants relax after certification because the pressure's off. That's a mistake. Surveillance audits can result in nonconformances too. We've seen plants lose certification renewals because they skipped management reviews, stopped doing internal audits, or ignored documented procedures during a shift-change period.

The auditor is looking for consistency. They want to see that your system is alive—being used, reviewed, and improved—not just a binder on the shelf.

We're approaching our 3-year recertification. What should we expect, and how do we prepare?

Your recertification audit is essentially another Stage 2: typically 2 to 3 days, covering documentation, implementation, records, and staff interviews. The scope and intensity are similar to your initial Stage 2 audit. Many plants assume it's lighter because they already have certification—it's not.

The auditor is checking whether your system has been maintained and whether you've made meaningful improvements since your last recertification.

Prepare by running a comprehensive internal audit 6 to 8 weeks beforehand. Review the auditor's reports from your last three surveillance audits and address any trends or repeat findings. Update your quality manual if there have been significant organizational or process changes. Most importantly, ensure your team is engaged and trained on the current procedures.

Staff turnover is common in the 3-year cycle—if new people don't know why the system exists or how it works, that'll show during the audit.