First certification audit checklist

This checklist helps you prepare for a first certification audit by an independent certification body. It is generic. It does not reproduce any standard's text, and it does not replace the requirements of the standard you are working to. Completing it does not mean you are ready or that you will be certified. It is not a formal audit, a readiness assessment or a prediction of the result. Only the certification body can audit and decide. To print, use your browser's print command.

Know the basics

• I know which standard and edition the audit is against
• I have read what is ISO certification
• I understand the two stages: see Stage 1 vs Stage 2 audit
• I have the certification body's contact and audit plan
• I have confirmed the audit scope, sites and dates in writing

Scope and context

• The scope statement describes what we really do and where
• Every site in scope is known to the audit plan
• Exclusions, if any, are understood and explained
• Interested parties, such as customers and regulators, are identified
• Outsourced processes are identified

Leadership and responsibilities

• Top management knows what the system is for
• A policy exists and people can explain it in their own words
• Objectives exist and have owners
• Roles and responsibilities are written down and understood
• A person is named to host the auditor and to coordinate

Planning and risk

• Risks and opportunities have been identified and recorded
• Actions to deal with them have owners and dates
• Changes to the system are planned and recorded

Documented information

• Documents and records that the standard or your system calls for exist
• Documents are current and show version and approval
• Records can be found quickly when asked
• People use the current versions, not old copies
• Confidential information is handled according to the agreement with the certification body

People and awareness

• Staff know how their work affects the system
• Training and competence records are available
• New starters are briefed
• Staff have been told that an auditor may speak with them, and that plain, honest answers are best

Operations

• Main processes are described and followed
• Suppliers and contractors that matter are evaluated and records kept
• Controls for work in progress are visible at the place of work
• Customer or user feedback and complaints are recorded and handled
• Equipment, where relevant, is maintained and records exist

Checking and improvement

• At least one internal audit has been planned or carried out, by someone independent of the area audited
• Findings from the internal audit have owners and actions
• Management review has been held and recorded
• Nonconformities and corrective actions are recorded
• Performance against objectives is measured

If these terms are unfamiliar, see the glossary.

Standard-specific items

Add items that come from your standard and your sector. Ask your certification body or a competent adviser. For example:

• Items relevant to environmental aspects, if you work to ISO 14001
• Items relevant to hazards and incidents, if you work to ISO 45001
• Items relevant to information security controls, if you work to ISO/IEC 27001

The days before the audit

• Meeting room and a contact for questions arranged
• Site access and safety induction ready for the auditor
• Key people available at the planned times
• Access arrangements ready, if the audit is partly remote
• Opening and closing meetings scheduled with management

On the day

• Answer the question asked, and say so if you need to check
• Show the work as it is
• Take notes of findings and questions
• Ask for clarification on any finding you do not understand

After the audit

• Findings are recorded and understood
• Corrections and root cause investigations are assigned to named people
• Responses are sent to the certification body within the period it sets
• You know what will happen next, and when you will hear the decision
• Surveillance planning starts: see surveillance and recertification

Read next

For the flow of the audit itself, see what happens during an ISO certification audit. If you have not yet picked a certification body, read how to choose a certification body.