What happens in an ISO certification audit?
The two stages of a certification audit, what auditors check, nonconformity types and what happens after the decision.
A certification audit runs in two stages. In stage 1, the auditor reviews documentation, scope, risk analysis and organisational readiness, and identifies areas of concern. In stage 2, the audit team verifies on site whether the system is actually applied: interviewing people at all levels, observing operations and gathering evidence. Nonconformities raised are classified and must be handled before the certification body takes the certification decision.
How the audit day unfolds
It starts with an opening meeting confirming plan, scope and logistics. Fieldwork follows, conducted by sampling: auditors choose processes, shifts, sites and records and look for evidence of conformity. It ends with a closing meeting where findings are presented to management.
How the certification audit runs
- 01Stage 1Documentation review and readiness assessment; identifying blockers to stage 2.
- 02PreparationAddressing the points raised before the effectiveness audit.
- 03Stage 2On-site audit: evidence that the system operates and is effective.
- 04Non-conformitiesRoot cause analysis and action plan, with deadlines set by the body.
- 05DecisionIndependent technical review and certification decision by DQS.
- 06SurveillanceAnnual audits across the three-year cycle and renewal at the end.
What auditors look for
- Objective evidence: records, data, minutes, indicators — not intentions or promises.
- Consistency between what is documented and what happens on the ground.
- Whether people know their responsibilities and the risks of their role.
- Effective handling of nonconformities, complaints and incidents.
- Real top-management involvement in reviewing the system.
Types of finding
A major nonconformity indicates systemic failure or absence of a requirement and blocks certification until resolved. A minor nonconformity is an isolated deviation, handled with an action plan. There are also opportunities for improvement, which do not block the decision.
Who decides
The certification decision is not made by the auditor. It is made by the certification body, by people independent from the audit team, based on the file and evidence. This separation is required by international accreditation rules.
How to prepare the organisation
The best preparation is an internal audit run with the same rigour as the external one, followed by addressing root causes. Do not prepare scripts or rehearsed answers: auditors validate evidence, and a staged system is detected within the first hours.
Frequently asked questions
- Does Export Lab take part in the certification audit?
- Export Lab prepares the organisation and may support internally, but takes no part in conducting the audit or in the decision, which belong solely to the certification body.
- What happens with a major nonconformity?
- The organisation submits root-cause analysis and an action plan; the certification body verifies effectiveness, sometimes with an additional visit, before deciding.
Sources
You may also find useful
Want to know where to start?
In 20 minutes we identify your starting point, scope and realistic effort.