How a Certification Audit Works: Stage 1, Stage 2 and Nonconformity Management

A certification audit can look mysterious to those experiencing it for the first time. Yet the process is predictable: an opening meeting, gathering evidence on site, evaluation of findings and a closing meeting. This guide explains how audit day goes and what to do about nonconformities.

Stage 1: preparation in the office

In the first stage the auditor reviews your system documentation, policy and objectives, and the internal audit and management review records. The aim is to see whether you are ready for stage 2 and to firm up the audit plan. It usually takes one to two days and, if necessary, can be done remotely. The result is reported as "ready", "ready with gaps" or "not ready".

Stage 2: evidence on site

The auditor wants to see processes in real conditions. On the production line, in the warehouse, in purchasing and in customer service they talk to employees, look at records and take samples. For example, they may pick an order and follow all records from request to delivery. The audit rests on three sources of evidence: interviews, observation and document review.

How are findings classified?

• Major nonconformity: a situation that prevents the system achieving its purpose or where a requirement is not met at all. No certificate is issued until it is closed.
• Minor nonconformity: a one-off error that is not spread across the system. A corrective action plan is submitted and verified at the next audit.
• Observation / opportunity for improvement: not a nonconformity but a point that may create risk in future.

Closing meeting

The auditor presents the findings with their evidence to management. At this stage you have the right to object; if a finding was misunderstood you can ask for it to be corrected by showing evidence.

Nonconformity closure

For major nonconformities, root cause analysis and correction and corrective action records must be submitted within 90 days; if very significant, an on-site verification audit is held. For minor nonconformities an action plan within 30 days is enough.

Preparation tips

• Each interviewee should be able to describe their own process, objective and indicator
• Findings in the latest internal audit report should be closed
• Legal requirements (permits, measurements, training records) should be ready
• A guide should be assigned to provide the auditor with resources

An audit is not an exam but an independent pair of eyes. Well-prepared organisations use the audit as an opportunity to improve their systems.

Remote and hybrid audit

In document-heavy standards such as information security and in surveillance audits, a remote audit can be carried out over a secure video link. A hybrid method is used for activities that must be seen on site; the auditor connects by camera to the production area at planned times.

Audit preparation checklist

• Announce the audit plan and scope to all departments in advance
• Keep up-to-date process, objective and indicator boards ready
• Gather legal permits and measurement reports in one folder
• Update training and competence records