A first ISO 9001 audit rewards evidence, not last-week document production. The best preparation is a 90-day discipline of internal audit, management review and clean records.
- Stage 1 checks readiness; Stage 2 checks whether the system is operating.
- Internal audit and management review must be complete before certification audit day.
- Staff should answer from evidence, not scripts or guesses.
Auditors are trained to tell the difference between a system that runs your business and a binder produced the week before.
That said, disciplined preparation makes the audit faster, calmer and far less likely to end in major nonconformities.
Understand what is coming: stage 1 and stage 2
Accredited certification audits (under ISO/IEC 17021-1) happen in two stages:
- Stage 1 is a readiness review. The auditor examines your documented system (scope, policy, objectives, risk assessment, internal audit and management review evidence) and confirms you are ready for the full audit. Stage 1 findings are your free warning shots: fix them before stage 2.
- Stage 2 is the full implementation audit, on site. The auditor samples processes, records and people across your scope, and the result feeds the certification decision.
Plan backwards from the stage 2 date. The single most common readiness failure: companies that have not yet completed a full internal audit cycle and management review. Without both, you are not certifiable. Full stop.
The non-negotiable evidence list
Before stage 1, make sure each of these exists, is genuinely in use, and someone owns it:
- Scope of the QMS: what sites, products and services are covered; any justification for requirements you deem not applicable (e.g. design, clause 8.3).
- Quality policy: signed, communicated, and staff can explain what it means for their job (in their own words; recitation impresses nobody).
- Quality objectives: measurable, with owners, deadlines and data behind them. "Improve customer satisfaction" with no measurement is a finding waiting to happen.
- Context and interested parties (clause 4): internal/external issues and stakeholder requirements, reviewed at management review.
- Risks and opportunities (clause 6.1): a live register with actions, not a one-time brainstorm.
- Process map / process definitions: your core processes, their inputs, outputs, criteria and KPIs.
- Competence records (clause 7.2): job requirements, training records, and evaluation of training effectiveness.
- Calibration/verification records (clause 7.1.5): every instrument used to verify product or service conformity, with traceable calibration status.
- Operational records: order review, production or service delivery controls, identification and traceability, nonconforming output control.
- Supplier evaluation (clause 8.4): criteria, an approved supplier list, and evidence you re-evaluate.
- Customer feedback and complaints: logged, actioned, trended.
- Internal audit (clause 9.2): a programme covering all processes, trained auditors, reports, and findings closed with corrective action.
- Management review (clause 9.3): minutes covering all required inputs and outputs, with decisions and actions.
- Corrective action records (clause 10.2): root cause analysis, action, verification of effectiveness.
The 90-day countdown
Days 90–60: audit yourselves properly.
- Run the full internal audit: every process, every clause of ISO 9001:2015 mapped to it.
- Raise real findings. An internal audit with zero nonconformities tells the certification auditor your internal audit does not work.
- Start corrective actions immediately; closing them takes longer than you think.
Days 60–30: close the loop at the top.
- Hold management review with all required inputs: audit results, customer feedback, process performance, nonconformities, resource needs, risks and opportunities, improvement opportunities.
- Fix the documentation gaps the internal audit exposed.
- Chase overdue calibrations, expired supplier evaluations, unsigned records.
Days 30–7: prepare the people.
- Brief every department: what the audit is, when the auditor will visit them, what questions sound like ("How do you know how to do this task?", "What do you do when something is wrong?", "Where is that recorded?").
- Tell staff the three golden rules: answer honestly, answer only what was asked, and say "I don't know, but I know where to find it" rather than inventing.
- Walk the site. Housekeeping, obsolete documents on noticeboards, uncontrolled forms, unlabelled nonconforming product: visual findings are the easiest to prevent.
Final week: logistics.
- Confirm the audit plan with the certification body: who is needed, where, when.
- Book a room for the auditor, arrange site access/PPE, assemble guides for each area.
- Have records accessible. Auditors sample fast; hunting for a record for 20 minutes burns goodwill and audit time.
During the audit: how to behave
- Don't argue with evidence; discuss interpretation. If the auditor found an uncalibrated gauge, it is uncalibrated. If you believe a requirement is being misread, discuss it professionally: auditors must tie every finding to a specific clause and objective evidence.
- Don't volunteer tours of your problems, but never hide or falsify anything. Integrity issues can escalate a routine audit into refusal of certification.
- Take notes on every finding as it is raised. The closing meeting should contain no surprises.
- Treat findings as free consultancy you already paid for. Certification auditors cannot consult, but a well-written nonconformity tells you exactly where the system is weak.
What happens with findings
- Minor nonconformities: isolated lapses. You submit corrective action plans (and usually evidence) within the certification body's deadline; certification proceeds.
- Major nonconformities: a system element missing or collapsed. You must implement correction and corrective action, and the certification body must verify closure (sometimes by a follow-up visit) before the certificate can be issued.
Either way, the auditor recommends; an independent reviewer at the certification body makes the certification decision. That separation is a requirement of ISO/IEC 17021-1 and a mark of a legitimate certification body.
The mindset that actually gets you certified
Companies fail first audits for one underlying reason: they built the system for the auditor instead of for the business. Records get backfilled, objectives get invented, and the auditor sees through it within an hour. Build a system your operations people actually use, run it honestly for a few months, audit it yourself, fix what you find, and stage 2 becomes a confirmation, not a confrontation.
QSI Cert is a SAAC-accredited, SFDA-approved certification body based in Riyadh and Al Khobar.
Common questions from this guide.
Minor nonconformities: isolated lapses. You submit corrective action plans (and usually evidence) within the certification body's deadline; certification proceeds. Major nonconformities: a system element missing or collapsed. You must implement correction and corrective action, and the certification body must verify closure (sometimes by a follow-up visit) before the certificate can be issued. Either way, the auditor recommends; an independent reviewer at the certification body makes the certification decision. That separation is a requirement of ISO/IEC 17021-1 and a mark of a legitimate certification body.