Preparing for your first ISO 9001 certification audit
Learn what the Stage 1 and Stage 2 audits each cover, how to run a clause-by-clause gap analysis first, and which documents an auditor expects to see.
Your first ISO 9001 certification audit is split into two visits by the certification body. Stage 1 checks whether your quality management system is documented and ready. Stage 2 checks whether it works in practice. This guide explains what each stage covers, how to run a gap analysis before either visit, and which documents an auditor expects to see.
Stage 1: the readiness review
Stage 1 is a documentation review. The auditor confirms that your QMS exists on paper and covers the requirements of ISO 9001. They read your quality manual or equivalent scope statement, your documented processes, and your records structure. They also check that you have defined the scope of certification and identified the processes that sit inside it.
The auditor is looking for gaps, not perfection. Expect them to list findings that you must close before Stage 2. Common Stage 1 findings include a missing internal audit programme, no completed management review, or objectives that are stated but not measurable. Stage 1 also fixes the timing of Stage 2, usually a few weeks to a few months later.
Stage 2: the certification audit
Stage 2 tests whether staff follow the processes you documented. The auditor interviews people across the functions in scope, watches work happen, and traces records back to the requirement they satisfy. They will sample. If you claim you calibrate equipment on a schedule, they will ask for the calibration records and check the dates.
Findings at Stage 2 are graded. A minor nonconformity means one instance of a process not being followed. A major nonconformity means a whole requirement is absent or systematically ignored, and it will delay your certificate until you correct it and provide evidence. Plan for at least one minor finding. A clean first audit is uncommon.
Running a gap analysis first
Do the gap analysis before you book either stage. Take each clause of ISO 9001 from clause 4 through clause 10 and record three things: what the clause requires, what you currently do, and the difference. Assign an owner and a date to each gap. This is the single most useful document you can produce, because it is the same map the auditor uses, built by you first.
Pay attention to the clauses first-timers underestimate. Clause 6.1 on risks and opportunities needs evidence of how you identify and act on them. Clause 9 needs a completed internal audit cycle and at least one management review before Stage 2. Clause 7.5 governs your documented information, including version control and retention.
Please also see our ISO 9001 overview.
Documentation checklist
Have these ready and current before Stage 1. Scope statement defining what the QMS covers. Quality policy and measurable quality objectives. Process descriptions for the activities in scope. A risk and opportunity register. Roles and responsibilities. Document and record control procedure, with version history. Internal audit programme, schedule, and reports. Management review minutes with inputs and outputs. Corrective action records. Competence and training records for staff in scope. Supplier and outsourced process controls. Evidence of monitoring, measurement, and any calibration.
Training records are often the weakest folder at a first audit. The auditor will ask who was trained, on what, and when, and expect dated evidence. Keeping that evidence in one place, tied to each role, removes a whole category of findings.
How ComplyTrain fits
ComplyTrain is a QMS and more, and it is designed to ease the implementation of ISO 9001, so your documents, audit programme, and training records live in one system rather than scattered across drives. Each customer runs in an isolated tenant using a schema-per-tenant, bucket-per-tenant model, and data is hosted in the EU on AWS eu-central-1 in Frankfurt. To be clear: using ComplyTrain does not certify you. The certification body does that. The platform helps you produce and retrieve the evidence they ask for.
See how the training records module maps to competence requirements on our features page, then book a walkthrough with our team to plan your first audit.