Chapter 8: Stage 1 and Stage 2 Certification Audit Preparation for Automotive Suppliers

Stage 1 (documentation review, 1-2 days on-site) verifies QMS readiness; Stage 2 (3-5 days for a typical 150-person plant) tests implementation through floor walks, document sampling, employee interviews, and management presentations. Automotive suppliers face two layers: the ISO 9001 audit itself, plus the IATF 16949 transition audit that typically follows within 12 months. PinnacleQMS clients pre-audit 30-60 days before Stage 2 with a 25-question internal audit covering document control, process control, internal audits, customer satisfaction, and management review. First-attempt pass rate stays at 98% across 250+ certifications when the pre-audit closes findings before the registrar arrives.

The certification audit is not a single event. It is a sequence of milestones running roughly 90 days, each with its own deliverable, its own owner, and its own failure mode. Automotive suppliers who treat the audit as a one-week sprint at the end almost always surface late nonconformities. The suppliers who pass cleanly start at T-90 days with registrar selection and walk a structured countdown to the moment the lead auditor steps onto the shop floor. The checklists below mirror what PinnacleQMS deploys across automotive Tier 1 and Tier 2 plants from Windsor to Monterrey.

T-90 days: registrar selection and audit scoping

The registrar choice locks in the auditor pool, the certificate logo, and the IATF transition pathway. Automotive customers (Ford, GM, Stellantis, Toyota, Honda) require ANAB-accredited certificates for supplier eligibility, so registrar selection is not interchangeable.

1. Confirm the registrar holds active ANAB or equivalent IAF MLA-signatory accreditation under iaf.nu — verify the accreditation certificate is current, not expired or suspended.
2. Confirm the registrar is also IATF-recognized if a 12-month IATF 16949 transition is planned, so the same registrar can carry the audit forward without a switch.
3. Request three competing quotes — typical Stage 1 + Stage 2 cost for a 150-person automotive plant runs USD 14,000-22,000 plus auditor travel.
4. Lock the audit scope statement in writing: legal entity name, physical address, NAICS codes, design responsibility (yes/no), and excluded clauses (typically 8.3 if no design).
5. Calculate audit-day duration using IAF MD 5 mandatory tables — 150 employees in low-complexity manufacturing equals 7-8 auditor-days across Stage 1 + Stage 2.
6. Confirm lead auditor qualifications — automotive scope requires an auditor with documented APQP, PPAP, and core-tools experience, not just generic ISO 9001 credentials.
7. Sign the registrar contract no later than T-75 to lock the audit dates; popular registrars book six to eight weeks ahead.
8. Notify key automotive customers in writing that certification is scheduled, including the registrar name and target certificate date.
9. Assign an internal audit-coordinator role — usually the Quality Manager — with calendar authority to release shop-floor staff for interviews on audit days.
10. Open a shared audit-prep folder (process, customer, supplier, and HR documents) so every owner can upload evidence into one location.

T-60 days: pre-audit (the 25-question internal audit)

The pre-audit is a dress rehearsal run by an internal lead auditor (or a PinnacleQMS consultant acting as registrar surrogate) using a structured 25-question script. Each question maps to an ISO 9001:2015 clause and the most common Stage 2 nonconformity pattern. Findings are logged, assigned, and closed before T-30.

Document control (Clauses 7.5.1, 7.5.2, 7.5.3) — questions 1-5:

1. Pull five controlled documents at random from three different processes — does each show current revision number, approval signature, and effective date?
2. Pull one obsolete document from the master list — is it physically retained as "obsolete" with retention period defined, or removed from points of use?
3. Walk to three workstations and pick the work instruction posted at the station — does the revision match the master list entry maintained by document control?
4. Open the customer-specific requirements (CSR) folder for the top automotive customer — is the latest CSR rev logged, distributed, and acknowledged by affected process owners?
5. Pick one external document (a supplier drawing, a regulatory standard) — is it identified, controlled, and revision-tracked separately from internal documents?

   Process control (Clauses 8.1, 8.5.1, 8.5.2) — questions 6-10:

6. Pull one production order on the floor — does it carry the current control plan, FMEA reference, and PPAP-approved process parameters?
7. At a CNC or molding machine, ask the operator to demonstrate a setup verification per the documented setup procedure — is the first-piece check signed and retained?
8. Pull the most recent SPC chart from a critical characteristic — is Cpk above the customer-required threshold (typically 1.33 or 1.67), and are out-of-control reactions documented?
9. Identify a part with traceability requirements — can the operator trace lot, shift, machine, and operator within five minutes from a finished-goods sample?
10. Verify gauge calibration on three measurement devices in active use — calibration sticker current, traceable to NIST, MSA Gage R&R within tolerance?

    Internal audit (Clause 9.2) — questions 11-15:

11. Pull the annual internal-audit schedule — does it cover every QMS clause and every shift at least once per year?
12. Pull the three most recent audit reports — are findings classified (major, minor, OFI), with target close dates and verified effectiveness?
13. Confirm audit-team independence — auditors cannot audit their own work area; verify cross-functional rotation.
14. Pull internal-auditor qualification records — minimum 16 hours ISO 9001:2015 training plus witnessed audit experience documented?
15. Open the longest-overdue corrective action — is escalation documented, or has it stalled silently past target date?

    Customer satisfaction (Clauses 9.1.2, 8.2.1) — questions 16-20:

16. Pull customer scorecards from the top three automotive accounts — current PPM, delivery rating, warranty trend logged and trended?
17. Pull the three most recent customer complaints (8D reports) — root cause documented to systemic level, not just operator error?
18. Verify read-across action — has each 8D's containment and corrective action been applied to similar parts and processes, with evidence?
19. Pull the customer-portal screen for the top OEM account — open issues, chargebacks, controlled-shipping levels (CSL1/CSL2) all addressed?
20. Pull the most recent customer satisfaction survey or QBR minutes — actions assigned, owners named, dates tracked to closure?

    Management review (Clause 9.3) — questions 21-25:

21. Pull the most recent management-review minutes (within the last 12 months) — does the agenda cover every Clause 9.3.2 input topic?
22. Verify top-management attendance — plant manager, operations director, quality director, and process owners all present and signing the minutes?
23. Trace one management-review output (a resource decision, a target adjustment) to its execution evidence — was it actually done?
24. Pull the QMS performance dashboard reviewed at management review — are quality objectives quantified, trended, and assessed against target?
25. Confirm management-review frequency — minimum annual, but quarterly is the automotive norm and the IATF expectation.

A pre-audit score of 22-25 out of 25 with no major nonconformities clears the supplier for Stage 2. Anything below 22 triggers a 30-day corrective-action push.

T-30 days: corrective actions on pre-audit findings

1. Convert every pre-audit finding into a CAPA record with clause reference, root cause (5-Why minimum), containment, corrective action, and verification owner.
2. Assign each CAPA a target close date no later than T-10, leaving 10 days for effectiveness verification before Stage 1.
3. Run a daily 15-minute CAPA stand-up between Quality Manager and process owners — slipping actions get escalated to the plant manager same day.
4. For document-control findings, batch-update the controlled-document master list and re-issue affected work instructions; verify points-of-use within 48 hours.
5. For process-control findings, run a re-validation at the affected workstation — first-piece, in-process, and final inspection signatures all retained as evidence.
6. For internal-audit findings, schedule a follow-up audit on the affected clause and document the closure audit report.
7. Brief the audit-coordinator and lead auditor on every closed finding so the same gap is not re-discovered by the registrar.
8. Update the management-review log with a special interim review documenting the pre-audit, the findings, and the closures.

T-7 days: Stage 1 documentation packet

The registrar's Stage 1 auditor reviews documents off-site (or on-site Day 1) before walking the floor. A clean packet shortens Stage 1 and signals readiness.

1. Quality Manual (or equivalent QMS documented information) referencing every Clause 4-10 element.
2. Scope statement matching the registrar contract verbatim.
3. Process map showing all QMS processes, sequence, and interaction (Clause 4.4).
4. Quality policy signed by top management with current date.
5. Quality objectives table with metric, target, current, owner, and review frequency.
6. Master list of controlled documents (current revisions only).
7. Master list of QMS records with retention periods.
8. Internal-audit program for the current year plus all completed reports.
9. Last 12 months of management-review minutes with attendees and actions.
10. Risk and opportunities register (Clause 6.1) with treatment status.
11. Customer-specific requirements log for every active automotive customer.
12. Organizational chart showing the QMS responsibilities and the management-system owner.

Stage 1 audit day (what to expect)

1. Opening meeting (30 minutes) — introductions, scope confirmation, audit plan walk-through.
2. Documentation review (3-4 hours) — the auditor reads the packet against the iso.org standard text.
3. Site tour (1-2 hours) — high-level walk of receiving, production, inspection, shipping; no detailed interviews.
4. Readiness assessment — the auditor confirms whether the QMS is mature enough to proceed to Stage 2.
5. Stage 1 findings recorded as "areas of concern" — these are not nonconformities yet, but they signal what Stage 2 will probe.
6. Closing meeting — Stage 1 conclusion (proceed / proceed-with-caution / not-ready) and Stage 2 audit plan finalization.
7. The supplier receives a written Stage 1 report within 5-10 business days.
8. Any Stage 1 area of concern must be closed before Stage 2 begins — typically a 30-60 day gap between stages.

Stage 2 audit day-by-day (3-5 day typical schedule)

A 150-person automotive plant draws a 4-day Stage 2 audit. Hour-by-hour rhythm matters because every minute of auditor time is billable and every gap fills with another sample request.

1. Day 1, 08:00-09:00 — Opening meeting, audit plan confirmation, introduction of process owners, safety briefing.
2. Day 1, 09:00-12:00 — Top-management interviews: Clauses 4 (context), 5 (leadership), 6 (planning), 9.3 (management review).
3. Day 1, 13:00-17:00 — Sales / customer-related processes (Clause 8.2): contract review, customer-specific requirements, customer satisfaction.
4. Day 2, 08:00-12:00 — Design and development (Clause 8.3) if in scope; otherwise, expanded production walk-through with operator interviews.
5. Day 2, 13:00-17:00 — Purchasing and external-provider control (Clause 8.4): supplier approval, incoming inspection, supplier scorecards.
6. Day 3, 08:00-12:00 — Production and service provision (Clause 8.5): work instructions, traceability, identification, preservation, control of changes.
7. Day 3, 13:00-17:00 — Monitoring and measurement (Clauses 7.1.5, 8.6, 9.1): calibration, in-process inspection, final inspection, MSA, SPC.
8. Day 4, 08:00-12:00 — Internal audit (9.2), nonconformity and corrective action (10.2), control of nonconforming output (8.7).
9. Day 4, 13:00-15:00 — Auditor team caucus, draft of nonconformities, finalization of audit report.
10. Day 4, 15:00-16:00 — Closing meeting: nonconformities read out, classification confirmed (major/minor), corrective-action timeline agreed (typically 60-90 days for minors, immediate plan for majors).

Common Stage 2 nonconformities in automotive plants

1. Customer-specific requirements not flowed to the floor — CSR exists in Quality's folder but the operator at the station has never seen the customer's special-characteristic symbology.
2. Internal audits are too clause-focused, not process-focused — auditors checked clause boxes without sampling actual production records, so risks went undetected.
3. Management review missing required inputs — most often the "changes in external and internal issues" input (9.3.2.b) and the "adequacy of resources" input (9.3.2.e).
4. Calibration recall failures — one or two gauges past calibration date in active use, usually low-traffic measurement devices like torque drivers.
5. Document control at point of use — the controlled document master shows revision C but the laminated work instruction at the press is revision B from 2024.
6. Supplier approval evidence gaps — a critical raw-material supplier is on the approved list but the most recent re-evaluation is over 24 months old.
7. Risk register treated as a one-time exercise — risks were identified at QMS launch but not refreshed when a new customer, new product, or new process was added.

Each pattern is preventable. Each is also predictable, which is exactly why the 25-question pre-audit at T-60 catches roughly 80% of them before the registrar arrives.

Stage 1 and Stage 2 are not pass-or-fail roulette. They are the final checkpoint of a 90-day countdown that started with registrar selection and ended with a plant where every operator knows the documents at their station, every supervisor can pull a record in five minutes, and every leader can defend the management review against any clause challenge. PinnacleQMS clients clear that countdown at a 98% first-attempt pass rate because the platform carries every CAPA, every audit finding, and every CSR through the system in one place, and the structured process makes sure no checkpoint is skipped. To map the same countdown for an upcoming automotive certification audit, contact PinnacleQMS for a Stage 1 readiness assessment scoped to the plant's customer mix, headcount, and registrar timeline.