ISO certification audit: what happens in Stage 1 and Stage 2

The auditor is not coming to catch you out: they are coming to see whether your system really works. What they will ask you in the two stages, and what to keep close at hand.

The initial ISO certification audit always takes place in two steps, Stage 1 and Stage 2, and it is not a bureaucratic formality. This is set out in ISO/IEC 17021-1, the international standard that lays down the requirements for bodies certifying management systems: it applies to ISO 9001 just as it does to ISO 14001, ISO 27001 or ISO 45001. Knowing those rules lets you understand in advance what the auditor will look at, in what order and for what purpose.

Here you will find what the certification body checks in each stage, how an audit day runs from the opening meeting to the closing meeting, what happens if nonconformities come up and which documents and evidence to have ready. If you first need a refresher on what certification is and how the whole process works, start with our guide on what ISO certifications are.

What is the initial certification audit and why is it split into two stages?

The initial certification audit is the assessment in which an accredited body evaluates whether your management system meets the standard. Under ISO/IEC 17021-1 it is mandatorily carried out in two stages: Stage 1 and Stage 2.

The split follows a clear logic. In Stage 1 the auditor understands how the system is built and whether the organisation is ready; in Stage 2 they check that the system is applied and effective in day-to-day reality. Both stages are part of a three-year audit programme, which also includes surveillance audits in the first and second years after the certification decision and a recertification audit in the third year, before expiry. We cover surveillance and renewal in our guide to surveillance and recertification audits.

Who carries out the audit and who decides on the certificate

The audit is conducted by an audit team led by an audit team leader. But the person who checks is not the one who decides: ISO/IEC 17021-1 requires the decision to grant or refuse certification to be taken by people other than those who carried out the audit.

In practice, at the end of Stage 2 the audit team makes a recommendation and sends the certification body the report, comments on nonconformities and the actions taken. The decision comes after an internal review within the body. That is why, even if the closing meeting goes well, you do not receive the certificate there and then: there is a further step, whose timing depends on the body and on closing any nonconformities.

The audit plan and your right to know the auditors

Before each audit the certification body prepares an audit plan setting out objectives, criteria, scope, dates, sites, expected duration and team roles. The dates are agreed with you in advance. Stage 1, the standard specifies, does not require a formal plan, but the body must inform you of any activities it will carry out on site.

There is also a little-known right. The body must give you the names of the audit team members, and their background on request, early enough for you to object to a team member on valid grounds, for example an auditor who previously worked for you or for a direct competitor. In that case the body must reconstitute the team.

What does the auditor check in Stage 1?

In Stage 1 the auditor assesses your readiness: they read the documentation, get to know the context and decide whether the conditions are in place to move to Stage 2. It is not yet the full check of how the system is applied.

The objectives of Stage 1 are listed in clause 9.3.1.2 of ISO/IEC 17021-1. In operational terms, the auditor must:

• review the documented information of the management system (policy, scope, procedures, records);

• evaluate site-specific conditions and talk to staff to understand whether the organisation is ready for Stage 2;

• check how well the organisation understands the requirements of the standard, particularly significant aspects or key performance, processes and objectives;

• gather information on the scope: sites, processes and equipment, levels of control, applicable legal requirements;

• review the resources for Stage 2 and agree its details;

• understand enough of the system and operations to plan Stage 2 properly;

• evaluate whether internal audits and management reviews are planned and performed, and whether the level of implementation justifies moving to Stage 2.

The point that stalls most organisations: internal audit and management review

The last objective is the one that most often halts the process. If, when the auditor arrives, the internal audit has not been done or there is no management review, there is no proof that the system checks itself, and Stage 2 risks slipping.

Take a typical company: a machining workshop with forty staff aiming for ISO 9001. It has written its procedures, has a signed quality policy and has mapped its processes. But the internal audit is "scheduled for next month" and the management review is planned "after certification". For the auditor, that system has not yet shown that it works. The solution is easy to state and harder to do: complete one full cycle of internal audit and management review before Stage 1. We explain how to set it up in our guide to the ISO internal audit.

Where Stage 1 takes place: on site or remotely

The standard does not require Stage 1 to take place on site, but it notes that carrying out at least part on your premises helps achieve its objectives. Seeing the site, the departments and the people lets the auditor assess real conditions that a document cannot convey.

ISO/IEC 17021-1 allows parts of the audit to be carried out by electronic means, such as video calls, document sharing or remote access to systems, provided this is done by competent personnel and the evidence is sufficient to reach a decision. The detailed rules on using these technologies are set out in the international mandatory document IAF MD 4. For you, the practical consequence is simple: ask the certification body, at the planning stage, which activities will be on site and which remote.

How does Stage 1 end and what happens before Stage 2?

Stage 1 ends with documented conclusions that the certification body must communicate to you. They state whether the objectives have been met, whether you are ready for Stage 2 and which areas of concern could become nonconformities in the next stage.

It is not a full report like the Stage 2 one: the standard specifies that the Stage 1 output does not need to meet all the requirements of an audit report. But it is the most useful tool you will receive in the whole process, because it tells you precisely where the auditor will look when they return.

Areas of concern: an early warning, not a failure

The areas of concern raised in Stage 1 are not yet nonconformities. They are weak points that, if they remain, could become nonconformities in Stage 2.

Some frequent examples: a scope written too vaguely, objectives without measurable indicators, an incomplete list of legal requirements, a risk assessment that exists but is not linked to actions. Treat each area of concern as a task with an owner and a date, and keep evidence of what you did. When the auditor returns, that is the first thing they will look at.

How much time passes between the two stages

ISO/IEC 17021-1 does not set an interval, minimum or maximum, between Stage 1 and Stage 2. Instead, it asks the certification body to take into account the time you need to resolve the areas of concern identified.

This has two consequences. First, an interval that is too short, chosen only to finish quickly, leaves you no room to fix what came up. Second, if something significant changes in the system in the meantime, such as a new site or a change of ownership, the body considers whether to repeat all or part of Stage 1. The standard also requires you to be informed that the results of Stage 1 may lead to the postponement or cancellation of Stage 2.

What does the auditor check in Stage 2?

Stage 2 is used to evaluate implementation and effectiveness of the management system. It takes place at the organisation's sites and is the stage where the auditor moves from documents to reality.

Clause 9.3.1.3 of ISO/IEC 17021-1 lists what Stage 2 must cover as a minimum:

1. information and evidence of conformity to all requirements of the applicable standard;

2. performance monitoring, measuring, reporting and reviewing against key objectives and targets;

3. the system's ability and performance in meeting applicable statutory, regulatory and contractual requirements;

4. operational control of processes;

5. internal audits and management review;

6. management responsibility for the organisation's policies.

How the auditor gathers evidence

Information is gathered through interviews, observation of processes and review of documents and records. These are the three methods set out in the standard, and the auditor usually combines them: they ask an operator how they handle a nonconforming product, watch how it is actually done, then check the record.

The audit is based on sampling. The auditor does not read everything: they pick some orders, some suppliers, some training records, and check that they are consistent. So there is no need to prepare mountains of paper, but whichever sample they pick must tell the same story. If the procedure says suppliers are evaluated every year, the three supplier files the auditor opens must contain an evaluation from the last year.

People, not just documents

In Stage 2 the auditor talks to the people who do the work, not only to the quality manager. Genuinely involved top management is one of the points the standard requires to be checked: the auditor will want to hear from the owner or managing director why those objectives exist and how they are followed up.

Prepare your people without rehearsing a script. Someone who says "I don't know, but I know where to find it" makes a better impression than someone reciting a procedure they do not follow. Explain to each person what the auditor does, which questions they might be asked about their own work and where the instructions and records they use every day are kept.

How does an audit day run, from opening to closing?

Every on-site audit follows a predictable pattern: opening meeting, evidence gathering, closing meeting and written report. Knowing it reduces anxiety and helps you organise people and spaces.

The opening meeting

The opening meeting is formal and involves management and, where appropriate, those responsible for the processes to be audited. The audit team leader introduces the team and confirms the scope of certification and the plan, communication channels, confidentiality, safety rules for the auditors, the sampling method and the language of the audit.

It is also the right time to ask questions: the standard provides for you to ask for clarification. Make sure there is a contact person available all day, a room for the audit team and quick access to documents and systems.

During the audit

The audit team leader must keep you informed of progress and of any concerns as the audit proceeds. If a need to change the scope emerges, they discuss it with you and report it to the certification body.

Nonconformities must be discussed with the organisation to check that the evidence is accurate and that the finding is understood. An important detail: the auditor cannot suggest the cause or the solution of a nonconformity. They can point out opportunities for improvement, but without recommending specific solutions, as that would undermine their impartiality. If you see them hesitate when you ask "how would you fix it?", they are simply following the rule.

The closing meeting and the report

At the closing meeting the audit team leader presents the conclusions and the recommendation on certification. Nonconformities must be explained so that they are understood, and the timeframe for responding is agreed.

You are also told about the reporting timeframe, how nonconformities are handled and the complaints and appeals procedures. If you disagree with a finding, say so then: unresolved differences of opinion are recorded and referred to the certification body. The written report, which remains the property of the certification body, follows later and also includes a statement on the conformity and effectiveness of the system.

What happens if nonconformities come up during the audit?

A nonconformity is the non-fulfilment of a requirement. Finding one does not mean losing certification: it means you need to analyse its cause and correct it within a defined timeframe.

Major and minor nonconformities

ISO/IEC 17021-1 distinguishes two levels. A major nonconformity affects the system's ability to achieve its intended results: for example when there is significant doubt that processes are under control, or when several minor nonconformities on the same requirement reveal a systemic failure. A minor nonconformity, on the other hand, does not affect that ability.

The difference matters for the decision. Before certifying, the body must have reviewed, accepted and verified the corrections and corrective actions for every major nonconformity; for minor ones it is enough for it to have reviewed and accepted your plan. We look at criteria and examples in our guide on major and minor nonconformities.

The six-month rule

For major nonconformities there is a precise limit. If the certification body cannot verify the implementation of corrections and corrective actions within six months of the last day of Stage 2, it must carry out a new Stage 2 before recommending certification.

In any case, the body asks you to analyse the cause and describe corrections and corrective actions within a set time. Verification can be based on documents you send or, where necessary, on a further site visit. A concrete example: the auditor finds three measuring instruments with expired calibration. The correction is to calibrate those instruments; the corrective action is to understand why the schedule failed and change how it is managed. Sending only the calibration certificates addresses the symptom, not the cause, and is unlikely to be accepted.

What should you keep at hand for Stage 1 and Stage 2?

Arriving at the audit with well-organised evidence is the simplest way to reduce downtime and misunderstandings. The table summarises what to prepare for each stage.

Beyond documents, organise the logistics: a single contact person, a schedule of the people to be interviewed, a room, access to IT systems and, if the audit is partly remote, a stable connection and the ability to share your screen. For the minimum content of a quality management system, see our guide to ISO 9001.

How Complaion supports you between the two stages

At Complaion a dedicated Lead Auditor follows the organisation throughout the process: they analyse the starting point, propose the route best suited to your needs, set up the system with you and prepare you for the audit, also handling the dialogue with the certification body. The Lead Auditor is not the certification body's auditor: they are on your side and work to get you there ready. Before Stage 1, your Complaion Lead Auditor carries out the internal audit to the same standard as the certification body: gaps come to light and are closed before the visit.

Alongside the Lead Auditor is the platform: it collects the evidence, manages documents with their versions, keeps the schedule for calibration, training, supplier evaluation and internal audits, and prepares the material for the audit. When the auditor asks for three supplier files as a sample, you find them in the same place, up to date and with their history. You can see how it works on the platform page.

Which mistakes make the certification audit harder?

The most frequent mistakes are not about knowing the standard, but about consistency between paper and reality. The auditor spots them quickly because sampling brings them to light.

The first is a system written but not lived: procedures copied from a template that describe a different organisation from the one the auditor sees on the shop floor. The second is an internal audit rushed through the week before, with a report showing no findings: for an experienced auditor, an internal audit that finds nothing is a weak signal, not a guarantee.

The third mistake is underestimating applicable legal requirements. In ISO 14001 and ISO 45001, but also in ISO 9001 for product requirements, the auditor checks that you know which obligations apply and how you comply. An expired permit or a missed legal deadline will rarely escape sampling.

The fourth is the improvised single contact: only one person knows where the documents are, and they are away on the day of the audit. Spread the knowledge and keep evidence in a shared place, with a clear current version.

How to prepare for the certification audit with Complaion

Stage 1 and Stage 2 reward organisations that arrive with a system that is genuinely applied and with their evidence in order. Everything else, from the interval between stages to handling nonconformities, becomes far more manageable when you know what to expect.

Complaion supports more than 1,000 clients with a model that combines a dedicated Lead Auditor and a platform that collects evidence, manages documents, keeps the schedule and prepares the audit. The Lead Auditor proposes the route best suited to your organisation, for your first certification as well as for the standards you may add later, from ISO 9001 to ISO 27001, among those listed on our certifications and regulations page.

If you have an audit in the diary or want to understand where to start, talk to our team: we will assess your starting point together and prepare a quote based on your needs.

Frequently asked questions about the ISO certification audit

Can Stage 1 and Stage 2 take place on the same day?

ISO/IEC 17021-1 does not set a minimum interval between the two stages, but it asks the certification body to take into account the time you need to resolve the Stage 1 areas of concern. Stage 2 is also planned on the basis of what emerged in Stage 1. For an SME seeking certification for the first time, it is almost always worth leaving a gap between stages so you can fix the points raised. The timing is agreed with the certification body at the planning stage.

Can I fail Stage 1?

Stage 1 does not end with a certification decision, but with conclusions on your readiness. If the system is not ready, the body can postpone or, in more serious cases, cancel Stage 2: the standard requires you to be informed of this. Rather than a failure, it is a pause to complete the system, for example by carrying out a missing internal audit or management review.

How long does the certification audit take?

The duration depends on the standard, the complexity of the organisation and its system, the technological and regulatory context, outsourced activities, the size and number of sites and the risks of its products and processes. ISO/IEC 17021-1 requires certification bodies to have documented procedures for calculating it and to record the justification. That is why two similar organisations may be given different durations. The body states the expected duration in its offer and in the audit plan.

Can the auditor tell me how to fix a nonconformity?

No. ISO/IEC 17021-1 prohibits the auditor from suggesting the cause or solution of a nonconformity and from recommending specific solutions in the report. They can point out opportunities for improvement, but the solution remains your choice. It is a safeguard for the impartiality of the certificate: whoever certifies cannot design what they will later judge.

What happens if I disagree with a finding?

During the audit the audit team leader must try to resolve differences over evidence or findings. If differences of opinion remain, they are recorded and referred to the certification body. You can also use the complaints and appeals procedures that the body must explain to you at the closing meeting. It is always worth bringing objective evidence to support your position.

Do I receive the certificate straight after Stage 2?

No. The audit team makes a recommendation, but the decision rests with people at the certification body other than those who carried out the audit. Before deciding, the body checks that the information is sufficient and that nonconformities have been handled: major ones require verified corrections, minor ones an accepted plan. The three-year certification cycle starts from the date of the decision.

Do I need to have done the internal audit before Stage 1?

One of the objectives of Stage 1 is to check that internal audits and management reviews are planned and performed. If they are missing, the auditor may conclude that you are not ready for Stage 2. That is why it is worth completing at least one cycle of internal audit and management review before calling in the certification body, so that you present a system that has already shown it can check itself.