ISO 9001 audit: what happens, stage by stage

An ISO 9001 audit is an independent check that your quality management system meets the standard and works in practice. Most organisations meet several kinds: their own internal audits, the two-stage certification audit, and the surveillance and recertification audits that keep a certificate alive. This guide explains each one, what an auditor looks at, how findings are graded, and how to prepare for your first certification.

Types of ISO 9001 audit

• Internal audit. Your own check, required by clause 9.2. You plan a programme, audit your processes against the standard and your own procedures, and act on what you find. A certification body expects to see at least one completed internal audit cycle before it certifies you.
• Certification audit. Run by an accredited certification body in two stages. Stage 1 checks readiness; Stage 2 checks that the system works. A certificate follows a successful Stage 2.
• Surveillance audit. A shorter visit in each of the two years after certification, sampling parts of the system to confirm it is still maintained.
• Recertification audit. A fuller audit before the certificate's three-year term ends, renewing it for another cycle.
• Second-party audit. A customer auditing you as a supplier. It is not certification, but it often follows the same logic. See internal, external and second-party audits.

Stage 1: the readiness review

Stage 1 is a documentation review. The auditor confirms that your QMS exists on paper and covers the requirements of ISO 9001. They read your quality manual or equivalent scope statement, your documented processes, and your records structure. They also check that you have defined the scope of certification and identified the processes that sit inside it.

The auditor is looking for gaps, not perfection. Expect them to list findings that you must close before Stage 2. Common Stage 1 findings include a missing internal audit programme, no completed management review, or objectives that are stated but not measurable. Stage 1 also fixes the timing of Stage 2, usually a few weeks to a few months later.

Stage 2: the certification audit

Stage 2 tests whether staff follow the processes you documented. The auditor interviews people across the functions in scope, watches work happen, and traces records back to the requirement they satisfy. They will sample. If you claim you calibrate equipment on a schedule, they will ask for the calibration records and check the dates.

What happens on the audit day

A certification audit follows a published plan. It opens with a short meeting to confirm scope, timing and who the auditor will speak to. The auditor then works through the plan: interviewing people in each function in scope, observing work, and asking for the records that show a requirement is met. Expect them to sample rather than read everything, and to follow a thread from a requirement to a procedure to a record and back.

The auditor records findings as they go and presents them at a closing meeting. Nothing in the closing meeting should be a surprise if you asked questions during the day. Before it ends, agree the deadline for responding to any nonconformities.

Nonconformities and how to close them

Findings are graded. A minor nonconformity is a single lapse: one process not followed, one record missing. A major nonconformity is a requirement that is absent or systematically not met, and it will hold up your certificate until you correct it and show evidence. Auditors also record observations and opportunities for improvement, which need no formal response but are worth acting on.

Closing a nonconformity takes more than fixing the instance. The certification body will expect three things: the correction (what you did about this case), the root cause (why it happened), and the corrective action (what stops it happening again), with evidence that the action was taken. Plan for at least one minor finding at a first audit. A clean first audit is uncommon.

Running a gap analysis first

Do the gap analysis before you book either stage. Take each clause of ISO 9001 from clause 4 through clause 10 and record three things: what the clause requires, what you currently do, and the difference. Assign an owner and a date to each gap. This is the single most useful document you can produce, because it is the same map the auditor uses, built by you first.

Pay attention to the clauses first-timers underestimate. Clause 6.1 on risks and opportunities needs evidence of how you identify and act on them. Clause 9 needs a completed internal audit cycle and at least one management review before Stage 2. Clause 7.5 governs your documented information, including version control and retention.

Please also see our ISO 9001 overview.

Documentation checklist

Have these ready and current before Stage 1:

• Scope statement defining what the QMS covers.
• Quality policy and measurable quality objectives.
• Process descriptions for the activities in scope.
• A risk and opportunity register.
• Roles and responsibilities.
• Document and record control procedure, with version history.
• Internal audit programme, schedule, and reports.
• Management review minutes with inputs and outputs.
• Corrective action records.
• Competence and training records for staff in scope.
• Supplier and outsourced process controls.
• Evidence of monitoring, measurement, and any calibration.

Training records are often the weakest folder at a first audit. The auditor will ask who was trained, on what, and when, and expect dated evidence. Keeping that evidence in one place, tied to each role, removes a whole category of findings.

After certification: surveillance and recertification

A certificate is not a one-off. It runs for three years, with a surveillance audit in each of the two years in between and a recertification audit before it expires. Surveillance audits sample the system, so any process can come up, and the auditor will ask what changed since the last visit and how you closed the previous findings.

The organisations that find surveillance easy are the ones that kept running the system between visits: internal audits on schedule, management reviews held, corrective actions closed. The ones that find it hard spent the year after certification not looking at it.

How ComplyTrain fits

ComplyTrain's QMS is structured around ISO 9001, so your documents, internal audit programme, management reviews and training records live in one system rather than scattered across drives. It tracks where each standard stands, from gap analysis through Stage 1 and Stage 2 to surveillance and recertification, and lets you hand the certification body one curated evidence package. Each customer runs in an isolated tenant (schema, bucket and user pool per tenant), hosted in the EU on AWS eu-central-1 in Frankfurt. To be clear: using ComplyTrain does not certify you. The certification body does that. The platform helps you produce and retrieve the evidence they ask for.

See how it runs an audit programme on the audit management page, then book a walkthrough with our team to plan your first audit.