During an ISO 9001 certification audit, an external audit team evaluates the organisation’s QMS against agreed criteria within a defined scope. The team examines evidence, discusses relevant findings and reports its conclusions. The certification body then applies its controlled decision process; an auditor’s favourable comment is not itself a certificate.
The external audit guide explains the wider relationship between assessment, findings and ongoing certification. The sequence below is an educational overview. Detailed arrangements should be confirmed with the selected certification body.
Before the visit
The organisation and certification body establish scope, relevant activities, sites and other information needed to plan the assessment. Confirm the standard edition and any applicable transition arrangements. Check what the body needs to know about outsourced activities or significant changes.
The audit plan identifies proposed coverage and practical arrangements. Make appropriate people, records and activities available. If an important operation occurs only on a particular shift, tell the body rather than assuming a standard office-hours visit will provide adequate coverage.
Resolve confidentiality, safety and access issues in advance where possible. Restrictions may require adjusted methods, but they should not be hidden until the auditor reaches the relevant process.
Stage 1 and readiness
Initial certification normally includes Stage 1 before Stage 2. This helps the certification body understand the system and evaluate readiness for further assessment. It may identify issues that need attention before the next stage.
Do not treat Stage 1 as a consultancy exercise in which the auditor designs the system. The organisation remains responsible for choosing and operating its arrangements. Clarification of requirements differs from prescribing the exact implementation method.
The existing Stage 1 explanation covers readiness in more detail. A positive result at that stage does not guarantee that later evidence will reveal no nonconformities.
Opening and evidence collection
An opening discussion confirms the assignment, communication arrangements and practical matters. The team then examines implementation through interviews, observations, records and data. It may follow a case across several functions rather than complete a separate interview for every clause.
For example, a fictional service audit might trace a customer request through review, staff assignment, service delivery, acceptance and complaint handling. The selected trail depends on scope and objectives; it is not a universal checklist.
Employees should explain actual practice and show relevant evidence. They can ask for clarification when a question is unclear. If they do not know an answer, they should identify suitable information or authority rather than invent a response.
Sampling and emerging findings
Audits use samples, so the team may select records, activities or periods that help evaluate particular requirements. It may expand an enquiry when information conflicts or suggests a wider issue.
| Situation | What may happen |
|---|---|
| Evidence is consistent | The team continues the planned trail |
| A gap appears | Further evidence is examined against the criterion |
| Access is restricted | The effect on scope and assurance is evaluated |
| Interpretation is disputed | Facts and applicable criteria are discussed |
A missing preferred form is not automatically a nonconformity. The issue is whether an applicable requirement is fulfilled. Conversely, an adopted required control cannot be ignored simply because a favourable outcome occurred in the sampled case.
Closing discussion and report
The team communicates findings and conclusions, including relevant limitations. The organisation should understand the evidence behind a nonconformity and the arrangements for response. Correct factual errors, but distinguish clarification from bargaining over an established failure.
The report should make the scope and basis of conclusions clear. Findings may affect the body’s subsequent decisions, but do not assume that every adverse observation means immediate loss of certification.
The article on opening and closing meetings explains how to make these discussions useful without rehearsed presentations.
Response and certification decision
Where nonconformities are identified, the organisation responds through the body’s process. This can involve correction, cause investigation, corrective action and relevant verification evidence. Confirm deadlines and submission requirements instead of assuming that all bodies use identical arrangements.
The certification decision follows the applicable review process. Distinguish a recommendation, a request for further evidence and the final status. If certification is granted, verify that its scope and public claims are accurate.
Prepare for ongoing surveillance and eventual recertification by maintaining the system between assessments. A certification audit is one part of external assurance; it does not replace the organisation’s daily controls, internal evaluation or responsibility for its products and services.
Where assessment methods change, ask the body to explain the effect on the assignment. A remote interview may be suitable for reviewing electronic decisions while physical operations require another method. The organisation should disclose constraints early and retain a clear record of agreed arrangements. Avoid assuming that a shorter visit means a narrower certification scope or that a longer visit guarantees a stronger result. Coverage and conclusions depend on the evidence and applicable requirements, not on duration alone.