What happens during an ISO certification audit

During a certification audit, an auditor visits your organization, asks questions, looks at records and watches work being done, then reports what they found. The audit samples your activity. It does not check everything. The auditor reports to the certification body, which decides whether to certify. This article describes the usual flow. Details differ by standard and by body.

Before the audit day

The certification body agrees the audit plan with you in advance. The plan lists the scope, the sites, the people the auditor wants to meet, and the time slots. You may be asked for basic documents beforehand. Nothing here is a trick: a plan is there so that the right people are available.

Typical preparation on your side:

confirm who will host the auditor and who will answer which topics;
make sure records are retrievable;
brief staff that the auditor may speak with them, and that honest, plain answers are what is needed.

If you want a practical list, use the first certification audit checklist.

The opening meeting

The audit starts with a short meeting. The auditor introduces the team, confirms the scope, the standard and the plan, explains how findings will be reported, and agrees how confidential information will be handled. This is the moment to raise any constraints, such as a site that is not accessible on a given day.

Interviews and observation

The auditor talks to people at different levels, from management to staff doing the work. Questions are usually open: how do you do this, what happens when it goes wrong, how do you know this is working. Auditors also watch work in progress, for example a process on the shop floor, a service being delivered or a system being administered.

Some tips that hold in any sector:

Answer the question asked. Say "I would need to check that record" rather than guess.
Show how you actually work. An audit is about the real system, not a perfect one.
If you do not understand a question, ask for it to be rephrased.

Evidence sampling

The auditor selects samples of records and evidence, such as training records, supplier evaluations, incident reports, change records or customer complaints. Which ones depends on the standard, the risk and the scope. The auditor traces a sample through the system from start to end, to see whether what is written down matches what happens.

A contractor with three sites might have a sample taken from one project at each site, plus a review of how the head office controls them. Not every project is looked at, so a clean sample is not a guarantee about everything.

Findings

At the end of the audit day or days, the auditor groups the observations. Common types are:

Conforming: the requirement is met.
Minor nonconformity: a requirement is not fully met, but the system as a whole still works.
Major nonconformity: a significant failure that affects the system's ability to deliver its intended results.
Opportunity for improvement: a suggestion that is not a requirement. Wording varies by body.

Our glossary defines each of these terms. Findings are evidence-based and written down so you can see exactly what was seen and which requirement it relates to.

The closing meeting

The auditor presents the findings to your management. You can ask questions and, if you disagree with a point, say so and show evidence. The auditor also states the recommendation they will make to the certification body, though the final decision is not made in the room.

After the audit

You usually have a set period to respond to nonconformities with a correction, an investigation of the cause, and a corrective action. The certification body reviews your response and, in many cases, evidence of closure. A different person at the body than the auditor commonly reviews the file and makes the certification decision. If the decision is positive, a certificate is issued, valid for a defined period and subject to surveillance audits. See surveillance and recertification.

The first certification audit is in two parts

A first-time audit normally runs in two stages. Stage 1 looks at readiness and Stage 2 looks at implementation. We explain them in Stage 1 vs Stage 2 audit. Requirements for the audit process are set out in ISO/IEC 17021-1, which applies to the bodies that carry out the audits.

What an audit is not

It is not an inspection by a regulator, it does not check legal compliance, and it is not a test you pass by memorizing answers. Nor does MIYAAR CONNECT carry out audits. If a body promises a result before looking at your system, see how to spot misleading ISO certificate claims.

Next step

If you are still choosing a body, our guide on how to choose a certification body is a good start. You can also read how it works to see where audits sit in the process.