How to prepare a company for an ISO audit?
Practical checklist to prepare for an ISO audit: evidence, internal audit, management review, team preparation and audit-day logistics.
Preparing for an ISO audit is mostly about ensuring the system is running and that evidence exists. In practice: complete a full internal audit and address the root causes of findings, hold the management review with top management present, confirm indicators and records are up to date, verify compliance with applicable legal requirements, prepare teams to explain what they do — and organise audit-day logistics.
Preparation checklist
- Internal audit completed, with report, findings and actions in progress or closed.
- Management review held, with minutes and recorded decisions.
- Objectives and indicators updated, with real data for the period.
- Register of applicable legal requirements updated and evaluated.
- Training, competence and awareness records up to date.
- Nonconformities, complaints and incidents handled with root-cause analysis.
- Supplier and subcontractor control documented.
- Documentation at current version and accessible to those who need it.
Pre-audit checklist
Use this list as a reading reference. The website does not store your progress.
- Scope defined and consistent with what will be audited
- Processes mapped, with owners and indicators assigned
- Documented information controlled and at current versions
- Applicable legal requirements identified and evaluated
- Internal audit completed and reported
- Non-conformities treated, with root cause analysis
- Management review held and recorded
- Evidence accessible: records, indicators and history for the period
Preparing people, without scripts
Auditors interview the people doing the work. Each employee should be able to explain what they do, where they find instructions, what risks their role involves, what they do when something goes wrong and who they report to. Memorised answers backfire; real understanding is what sustains conformity.
Audit-day logistics
Confirm the audit plan and the availability of named people, ensure access to facilities and records, prepare a working room and escorts, and make sure top management attends the opening and closing meetings. Interruptions and absences are the most banal cause of avoidable findings.
After the audit
Handle findings with root-cause analysis and realistic deadlines, not just immediate fixes. The certification body verifies action effectiveness, and the same finding repeated in the next audit weighs far more than the first time.
Frequently asked questions
- How long before should the internal audit be done?
- Early enough to address root causes and demonstrate action effectiveness before the external audit. Doing it the day before leaves no time to generate that evidence.
- Can the internal audit be run by an external party?
- Yes. The requirement is independence from the audited area, not that the auditor be an employee of the organisation.
Sources
You may also find useful
Ready to move forward?
Tell us the challenge and we present the right specialist and a written proposal.