ISO Certification Audit Guidance

This guidance is for organisations who have arranged to complete a certification audit and provides some information about the audit and certification process. In general terms an audit is a check by an independent 3rd party, the auditor, that management systems in place are effective and that ISO and other requirements are being met. The audit is intended to be a useful process and the auditor is not there to pick faults or try to find issues and non-conformances, they are looking for evidence of compliance.
To complete the audit successfully the auditor will require your co-operation and participation and this guidance provides some additional information about the audit process to assist with this.
Unless specific arrangements have been made for a pre-audit or a separate stage 1 audit the audit will be a combined stage 1 and stage 2 audit which means the audit will include a review of management system documentation and supporting evidence to confirm that the management systems reflect actual operations and that effectively managed and meeting all requirements. A pre-audit review of documentation can be completed if required and at no additional charge – please contact us to arrange this.

Audit preparation – in advance of the audit

In advance of the audit there may be some arrangements made with regards file sharing and pre-audit review of documentation or evidence as required. If no advance arrangements have been made you can prepare for the audit by checking that all the requirements as detailed in the Certification Audit Guidance file have been met.

To formally review and check that everything is in place and ready for the audit please download and complete the Certification Audit Checklist.
Where an audit is being completed remotely, we will be in touch in advance of the audit to make arrangements
for file sharing and communications on the day of the audit and further details about remote audits are available in the Remote Audit Guidance file download.
For on-site audits please also let us know if there are any site-specific instructions, emergency information, personal protective equipment requirements or procedures our audit team need to be aware of.
Audit fees - please also ensure audit fees are paid in advance of the audit. Where audit fees are not paid the audit may be canceled and the charges detailed in the Audit Rescheduling Policy may be applied.

Audit preparation - management systems

Prior to booking the certification audit it is necessary to make sure that management systems are in place and compliant with the requirements of the relevant ISO standard(s).
Once management systems are fully developed there are various checklists and guidance documents available to assist with checking that ready for the certification audit or alternatively an external consultant can be engaged to assist with setup of management systems and completion of checks to ensure everything is ready for the audit. Please contact us if you require support or assistance, we can offer remote support or provide the contact details for an approved consultant in your area.

The audit process and schedule

The actual process followed on the day of the audit will depend on the audit type, the preferred approach of the auditor and your own requirements as wherever possible we will endeavour to complete the audit with minimal disruption or distraction from your ongoing operational activities.

The planned approach and schedule will be agreed with the auditor but all audits will require certain key activities to be completed. Please download the Certification Audit Plan to see an example audit plan.

Audit objectives

All certification audits will have the following objectives and criteria:

• To assess the extent that the management system conforms with the requirements of the standard(s)
• To assess the effectiveness and suitability of the management system and documentation and to determine if following any documented procedures provided
• To review that the operations covered by the scope of the audit are meeting all applicable statutory and regulatory requirements

This effectively means that the auditor will be checking that appropriate management systems are in place, that the management systems are suitable and that all the documented procedures are being followed and also that meeting all applicable requirements. Auditing is a sampling process; the auditor will need to see evidence that procedures are being followed and will require your assistance with providing access to suitable evidence, for example if the auditor is reviewing the processes for staff training and management of competence the auditor will need to see training records or systems for logging and managing staff competence.

Audit report and findings

The audit report is structured to facilitate effective and efficient auditing of management systems and an overview of the report structure is available in the Certification Audit Guidance file download.
Where issues are identified during the audit they will be communicated to you by the auditor as they are identified to allow review and response to the issue before it is raised as a finding in the report.
Findings including observations and non-conformances that are added to the report will include an explanation of why they have been raised and any response or follow up required. Where significant non-conformance(s) have been identified it may be necessary for a response or follow up before certification is issued and details of how to respond will be included with the report.
Personal data – wherever possible we will endeavour to avoid collecting personal data and where it is not required it will not be logged in the report. Names will be redacted to just detail initials in the report.

ISO Certification

After the audit the auditor will submit the completed report and recommendations and once the report has been reviewed and approved, assuming the final recommendation was for certification, the report and ISO certification will be issued. This is usually completed within a few working days but may take longer if additional information or a response has been requested.

Need help with setting up ISO compliant management systems?

If you need help head over to our ISO support and management system implementation web site - isomanaged.com where there's a knowledge base with guidance and also the alphaZ documents package which includes files and toolkits covering each ISO standard we certify.

isoassured certification clients are entitled to an 80% discount for alphaZ subscription - please download the alphaZ Free Account Setup file for instructions on how to create your account - and can also subscribe to our email update service free of charge (note: alphaZ subscription is also provided free of charge up until initial ISO certification or certification renewal when the discounted fee will be added if ongoing access is required).

If you're looking for consultancy assistance with getting things setup there is further information and guidance on the ISO Consultancy Services page.

Preparing for Certification Audits Video