Stage 1 is a readiness review. The auditor examines your documentation — policy, objectives, scope, process descriptions, risk assessments — and confirms that the system as designed could meet the standard. It is also a people audit in disguise: the auditor assesses whether leadership understands the system and whether internal audit and management review have actually happened.
The most valuable preparation for stage 1 is evidence of a lived system. A completed internal audit, minutes from a management review, and corrective actions that have been raised and closed demonstrate the Plan-Do-Check-Act cycle in motion. An organization that has never audited itself cannot credibly expect to pass an external audit of the same requirements.
Stage 2 is the implementation audit. The auditor moves from documents to floors, interviewing staff, watching processes, and sampling records. The central question at every stop is consistency: does what the procedure says match what the person does and what the record shows? Nonconformities cluster exactly where the three diverge.
Brief your people rather than rehearsing them. Staff should know what their process is, where its procedure lives, and which records they generate — spoken plainly in their own words. Rehearsed recitations of standard language signal exactly the wrong thing to an experienced auditor.
Findings are not failure. Minor nonconformities come with a corrective action plan and a timeline; the certificate follows once they are addressed. Major nonconformities pause the process until corrective action is verified. Either way, the decision belongs to the certification body — your preparation controls the odds, not the outcome.
Key takeaways
- Stage 1 reviews system design and readiness; stage 2 audits implementation on site.
- Completed internal audit and management review are prerequisites for credibility.
- Consistency between procedure, practice, and records is what auditors test.
- Minor findings are closed through corrective action before certification issues.