How to Prepare for an ISO Audit: What Happens in Stage 1 and Stage 2

The certification audit is the moment of truth for an ISO management system, and it is far less frightening when you know how it works. This guide explains Stage 1 and Stage 2, how findings are graded, and what to do in the weeks before the auditor arrives. If you are planning certification, see our services for ISO 9001, ISO 14001 and ISO 45001.

Two colleagues reviewing documents on a laptop, representing ISO audit preparation

The two-stage certification audit

For initial certification, an accredited certification body normally audits in two stages, following the requirements of ISO/IEC 17021-1 for bodies that audit and certify management systems. The two stages have different purposes.

Stage 1: readiness review

Stage 1 checks that you are ready for the main audit. The auditor reviews your documented information, confirms the scope, assesses your understanding of the standard's requirements, looks at how you identified legal requirements, risks and key processes, and checks that internal audits and management review have been planned or done. Stage 1 often includes a visit to the site, though parts may be done remotely, depending on the certification body. The auditor also gathers information to plan Stage 2, such as the number of sites and shifts, and may find areas of concern that could become nonconformities later.

The output is a Stage 1 report that identifies issues to resolve before Stage 2. If major gaps exist, the audit may be delayed. If too much time passes between the stages, the certification body may need to repeat Stage 1; six months is a commonly applied limit.

Stage 2: implementation audit

Stage 2 evaluates whether the system is implemented and effective. Auditors sample processes across the scope, interview people at all levels, observe work, review records and trace examples from requirement to result. They test whether top management is genuinely involved, whether risks and objectives drive decisions, whether competence and training are real, whether operational controls are applied, and whether the internal audit and management review were effective. For safety and environmental systems, they also check legal compliance and emergency preparedness.

How findings are graded

Finding	Meaning	Typical consequence
Major nonconformity	Failure to meet a requirement that affects the ability of the system to achieve intended results, or a significant breakdown of a requirement	Certification is normally not recommended until corrective action is verified
Minor nonconformity	An isolated or less serious failure to meet a requirement	Corrective action plan accepted, verified later, often at the next audit
Opportunity for improvement	Observation that is not a nonconformity	No obligation, but useful input

The precise rules and timeframes for responding vary by certification body, so ask yours. After you respond and corrective actions are accepted, the certification body makes the certification decision, usually through an independent reviewer who was not on the audit team. Certificates are normally valid for three years, with surveillance audits at least once each calendar year and a recertification audit before expiry.

A 30-day preparation checklist

Days 30 to 21: confirm the foundations

Check that scope, policy and objectives are current and approved.
Confirm that an internal audit covering the whole scope, and a management review, have been completed.
Close open corrective actions or document their status.
Check legal registers are up to date and compliance has been evaluated.

Days 20 to 11: test the system

Run a mini-audit of high-risk processes using the standard's clauses; our guide to ISO 9001 clauses explained gives a quick map of what to check.
Sample records for completeness: training, calibration, supplier evaluations, inspection results and incident reports.
Walk the site as an auditor would: look for outdated documents, uncontrolled forms, unlabelled materials, unsafe conditions or overflowing waste areas.

Days 10 to 4: prepare the people

Brief top management on what they will be asked, including how quality, environment or safety links to strategy.
Tell staff the audit is a normal event. Remind them to answer honestly, to answer the question asked, and to say so if they do not know and offer to find out.
Agree who will accompany the auditors, and arrange a room, access and any safety induction.

Days 3 to 1: organise logistics

Share the audit plan with all process owners.
Make sure records can be retrieved quickly, including any electronic systems.
Prepare a short opening meeting presentation: scope, structure, changes since Stage 1.

During the audit: practical tips

Answer what is asked. Long explanations can open new lines of questioning.
Show evidence. Records beat assurances.
Do not argue about findings during the audit. Ask for clarification of the requirement and evidence, and raise disagreements through the proper channel.
Take notes of what was sampled and what was raised, so that you can start corrective action immediately.
Attend daily briefings if offered, to avoid surprises at the closing meeting.

After the audit

Analyse the root cause of each nonconformity, not just the symptom, then propose corrections and corrective actions within the timeframe set by the certification body. Share the report with top management and use it as input to the next management review. For integrated systems, a combined audit covers several standards at once; see integrated vs consolidated management systems. If your audit follows a change in the standard, our article on leading ISO transitions will help you plan.

Common reasons for audit findings

Internal audits that are superficial or do not cover the full scope
Management review missing required inputs
Objectives that are not measurable or not monitored
Competence records that do not match the roles
Supplier evaluation not applied to critical suppliers
Out-of-date legal requirements

Frequently Asked Questions

What is the difference between Stage 1 and Stage 2?

Stage 1 reviews readiness and documentation and plans the audit. Stage 2 verifies that the system is implemented and effective through sampling, interviews and observation.

What happens if a major nonconformity is raised?

Certification is normally not recommended until corrective action has been accepted and verified, which may require a follow-up audit.

Can Stage 1 be done remotely?

This depends on the certification body and the standard, and some elements are commonly done remotely. Ask your certification body.

How long is an ISO certificate valid?

Normally three years, with annual surveillance audits and a recertification audit before the end of the cycle.

Should the consultant attend the audit?

Consultants may support you, but the certification body decides who may attend. The audit must be independent, and your team should answer for the system.

Need Help? Talk to BRSM Global

BRSM Global supports organisations in Dubai and across the UAE with guidance, implementation, auditing and post-certification support. Explore the related service:

Contact us for a free consultation and quote or call +971 58 623 3144.