Chapter 51: Days 61–90: Operation, Internal Audit, and Pre-Certification Readiness

The final month separates the manufacturers who will pass audit from those who'll get stacks of non-conformities.

Running Your First Internal Audit Cycle

By Day 70, you need to have conducted at least two internal audits—one of the documented processes and one of the management system as a whole. This is not optional if you want to pass the external audit.

You have two options here:

1. DIY with an internal auditor (usually from quality or operations): Requires someone on your team to get trained in internal audit techniques. Cost: low. Risk: they might miss things or be too lenient. Timing: You'd need to get them trained by Day 55 at the latest.
2. Bring in an external auditor for the internal audit (consultant or certification body pre-audit service): Cost: medium. Benefit: identifies gaps before the real audit. Timing: Can be scheduled on your timeline.

For most Canadian manufacturers on a 90-day timeline, option 2 makes sense. A pre-audit by a consultant acting as the internal auditor gives you a dry run, identifies non-conformities you can fix, and builds team confidence.

How to structure it: Schedule a two-day internal audit for Day 70–71. Auditor reviews documentation, interviews staff, and observes processes. By Day 75, you should have a report with findings and a corrective action plan. By Day 85, all corrective actions should be verified. By Day 88, you're calling the certification body to book Stage 1.

The Pre-Audit Readiness Checklist: 15 Items That Matter

Two weeks before your Stage 1 audit, work through this. If you miss more than two of these, delay the audit by 30 days. It's cheaper than failing and retesting.

1. Documentation Control: All procedures and work instructions have revision dates and are version-controlled.
2. Records of Training: Employee training records show everyone involved in QMS-critical processes has been trained and understands their role.
3. Management Commitment Evidence: Documentation showing the owner/director has approved the QMS, allocated resources, and held at least one management review meeting.
4. Internal Audit Completion: At least two internal audits completed with findings and corrective actions documented.
5. Management Review Meeting: At least one management review held (quarterly or semi-annually), documented with attendees, agenda, and action items.
6. Risk Assessment: Documentation showing you've identified risks to your business and your QMS, and have controls in place.
7. Supplier Quality: Evidence that you've evaluated key suppliers for capability and quality performance (documented supplier reviews or audits).
8. Process Measurements: Data showing you measure your core processes—on-time delivery, defect rates, inspection results, customer complaints. Not perfection—just measurement.
9. Nonconformities and Corrections: At least 3–5 documented NCRs or customer complaints processed through your corrective action system, with verification that actions worked.
10. Control of Externally Provided Processes: If you outsource anything (plating, heat treat, assembly, logistics), documented requirements, reviews, and acceptance criteria for those suppliers.
11. Design Input/Output (if applicable): For any manufacturers who design products, documented evidence that design input requirements are captured, communicated, and reviewed against output.
12. Customer Feedback: Evidence of how customer feedback (complaints, returns, requests) is captured and fed into management review.
13. Competence and Awareness: Documentation that staff understand the QMS, their roles in it, and why it matters.
14. Top Management Visibility: The owner or senior leader has toured the QMS implementation, asked questions, and shown visible support.
15. Audit Schedule and Corrective Action Plan: A forward-looking document showing planned audits for the next 12 months and a corrective action plan for any items still open.

The auditor isn't looking for perfection or the largest document set. They're looking for evidence that you have a system, you use it, and management is in control. The checklist above proves all three.