Stage 1 vs Stage 2 audit: what is the difference?

A first certification audit is done in two parts. Stage 1 checks that your system is set up and that the certification body understands your organization. Stage 2 checks that the system works in daily practice, and it is the audit that leads to the certification decision. The two-stage structure for initial audits comes from ISO/IEC 17021-1, the standard for certification bodies.

The short version

Whether Stage 1 is done on site or remotely is for the certification body to decide in each case.

What Stage 1 looks at

Think of Stage 1 as a check of foundations. The auditor wants to understand your organization and see whether the system is in place well enough for the main audit to be worthwhile. Common topics:

• your scope and the sites and activities in it;
• the main documents and records the standard expects you to hold, referred to as documented information;
• whether internal audits and management review have been planned or carried out;
• how well your people understand the system;
• anything that might affect planning of Stage 2, such as seasonal work, shifts or temporary sites.

You get a report that tells you if there are concerns that could become a problem in Stage 2. This is useful. It is better to find a gap now than during the main audit.

What Stage 2 looks at

Stage 2 tests whether your system is implemented and effective. The auditor samples real evidence: completed records, work in progress, interviews with people who do the job, and results against your own objectives. Questions are practical: show me how this works, what happened last time it failed, how do you know it is under control.

Findings from Stage 2 are classed as conforming, minor nonconformity or major nonconformity. The certification body then reviews the audit and decides. See what happens during an ISO certification audit for the flow of the audit itself.

Why have two stages?

A single big audit would be wasteful if the system were not ready. Stage 1 lets the body check readiness and plan its audit properly, and it gives you a chance to fix gaps first. For the body, it also helps to decide how much audit time and what skills Stage 2 will need.

How far apart are they?

The gap between stages varies. There is no fixed time that applies to everyone, and no time we can promise. If major concerns appear at Stage 1, you may need extra time to fix them before Stage 2 is held. Factors that affect timing in general are covered in certification timeline.

What the stages are not

• Not a pass or fail at Stage 1. It is a review of readiness, though serious gaps may delay Stage 2.
• Not a rehearsal. Both stages are formal parts of certification and are reported to the certification body.
• Not what you get after certification. Once certified, you have surveillance audits, then recertification. These are covered in surveillance and recertification.

How to prepare for both

For Stage 1, have your scope, documented information, internal audit plan and management review plan in good order. For Stage 2, make sure the system has been running long enough to leave real records, and that people can explain their role in it. The first certification audit checklist lists practical items. It is not a readiness verdict.

A simple example

A small contractor with two sites asks for ISO 9001. At Stage 1, the auditor reviews the scope, the quality policy and objectives, and the list of projects, and notes that the supplier evaluation process has not yet been used. The contractor uses the gap between stages to run it. At Stage 2, the auditor looks at project records from both sites and speaks with site managers. This is an illustration, not a typical timeline.

Next step

If you have not yet chosen a certification body, read how to choose a certification body. To understand what you may be asked to provide first, see what to prepare before requesting a quote.