Getting audit ready before an external audit is one of those things that separates organisations that sail through certification from those that spend the closing meeting arguing over nonconformities. Whether you are facing your first certification audit, a surveillance visit, or a recertification audit, the preparation you do in the weeks beforehand will determine how the day unfolds. This article walks you through exactly what to do, in the right order, so nothing catches you off guard.
On this page
Understand What Kind of External Audit You Are Facing
Before you prepare anything, be clear on what type of external audit is coming. A Stage 1 audit is a document review. The auditor wants to see that your management system is designed correctly and that you are ready for a full audit. A Stage 2 audit is where they verify that what you have documented is actually happening in practice. A surveillance audit checks that the system is being maintained. A recertification audit is a full reassessment of the whole system.
Each of these has a different focus and requires a different level of preparation. Treating a surveillance audit like a Stage 2 is overkill. Treating a Stage 2 like a Stage 1 will leave you exposed.
If you want a clear breakdown of what each stage involves, our article on what happens at Stage 1 and Stage 2 of an ISO 9001 audit covers it in detail.
Exemplar Global Recognised Training ProviderRTP No. 310970
Run a Pre-Audit Gap Analysis or Internal Audit
The single most valuable thing you can do before an external audit is run a thorough internal audit or gap analysis. Not a tick-box exercise. A genuine review of whether your system conforms to the standard and whether it is actually working.
Pull out your audit checklist and go clause by clause. Look for areas where documented procedures do not match what staff are doing. Look for records that are incomplete, missing, or out of date. Look for objectives that have not been tracked. These are exactly the things an external auditor will find, so finding them first gives you time to fix them.
Pay particular attention to the clauses that generate the most nonconformities. For ISO 9001, these tend to be Clause 9.1 monitoring and measurement, Clause 9.2 internal audit, Clause 9.3 management review, and Clause 10.2 corrective action. For ISO 14001, aspects and impacts registers and compliance obligation evaluations are common problem areas. For ISO 45001, hazard identification processes and worker consultation evidence tend to come up repeatedly.
Get Your Documents in Order
External auditors will ask to see your documented information. They are not just checking that documents exist. They are checking that documents are current, approved, accessible, and that people are actually using them.
Check Version Control and Approval
Go through your key procedures, work instructions, and forms. Make sure every document has a current version number and has been approved by the right person. Documents that were last reviewed three years ago and have had no updates will attract scrutiny, especially if the business has changed significantly in that time.
Confirm Records Are Complete
Records are the evidence that your system is working. Pull a sample of records for the past three to six months and check them against what your procedures say should be captured. Common gaps include incomplete monitoring records, training records that do not link to competency requirements, calibration records that are out of date, and corrective action records with no root cause or effectiveness review.
Review Your Mandatory Documented Information
Each standard has specific documented information requirements. Make sure you have everything the standard requires, not just what you think it requires. A common mistake is having a quality policy but not being able to demonstrate it has been communicated to workers. Another is having a risk register that was created during implementation and never updated.
Confirm Your Management Review Has Been Done
A missing or inadequate management review is one of the most common reasons organisations receive nonconformities at external audits. The standard requires management review to happen at planned intervals. If your last management review was more than twelve months ago, or if the minutes do not cover all the required inputs, you have a problem.
Before the audit, check that your most recent management review minutes include evidence that all required inputs were discussed and that outputs include decisions and actions. The auditor will want to see that top management is genuinely engaged with the system, not just signing off on a document someone else prepared.
Verify Your Internal Audit Programme Is Current
External auditors will check whether your internal audit programme has been completed as planned. If you have internal audits scheduled that have not happened, or if certain areas of the business have not been audited in the past cycle, this will be raised.
Check that all planned internal audits have been conducted, that reports have been issued, and that any nonconformities raised have corrective actions in progress or closed. If there are overdue audits, either conduct them before the external audit or be prepared to explain why the programme was not followed and what you have done about it.
Prepare Your Corrective Action Records
Corrective action management is an area where external auditors spend a lot of time. They want to see that when problems are identified, the organisation investigates the root cause, implements a fix, and checks that the fix worked.
Before the audit, review all open corrective actions. Close out anything that has been sitting open without progress. For corrective actions that are genuinely in progress, make sure there is documented evidence of what has been done so far. For closed corrective actions, check that there is evidence of effectiveness review, not just a signature saying it is done.
If your corrective action records are thin, for example if root cause analysis is missing or effectiveness reviews have not been done, address this before the auditor arrives. It is far better to have a corrective action record that shows genuine investigation than one that shows a quick fix with no analysis.
Brief Your Team
One of the biggest risks in an external audit is what your staff say when the auditor interviews them. Not because staff are dishonest, but because they may not understand what the auditor is looking for, or they may inadvertently describe a process that differs from what is documented.
What to Tell Staff Before the Audit
Brief your team on what to expect. Tell them the auditor will ask questions about how they do their work, where they find procedures, how they raise issues, and what they would do if something went wrong. Remind them to answer honestly and specifically. The worst thing a staff member can do is say what they think the auditor wants to hear rather than describing what actually happens.
If there are areas where actual practice differs from documented procedure, address those gaps before the audit rather than hoping the auditor does not ask about them. Auditors are trained to follow the trail of evidence, and inconsistencies between documents and interviews are exactly what they are looking for.
Identify Your Key Contacts for Each Area
Work out in advance who will accompany the auditor in each area of the business. This person should understand the processes being audited, know where records are kept, and be able to answer questions confidently. Brief them specifically on what the auditor is likely to ask about in their area.
Our article on preparing your team for an external audit goes deeper on how to get your people ready without making them anxious.
Prepare Your Logistics
Practical logistics matter more than most quality managers realise. An auditor who cannot find a quiet room to conduct interviews, cannot access records because the system is down, or spends twenty minutes waiting for someone to locate a document will form a negative impression of the organisation's general state of control.
Book a Room and Organise Access
Confirm that a suitable room is available for the opening meeting, interviews, and document review. Make sure the auditor will have access to your document management system, whether that is a shared drive, a quality management software platform, or a physical filing system. If records are stored electronically, check that the auditor can view them without needing to log in with a staff member's credentials every time.
Prepare a Site Tour Route
For audits that include a site inspection, plan the route in advance. Think about what the auditor will observe and whether there are any obvious issues that need to be addressed beforehand. This is not about hiding problems. It is about making sure that routine maintenance, housekeeping, or labelling issues that have been on the to-do list for months are not still there when the auditor walks through.
Review the Scope of Your Certification
Check that your scope of certification still accurately reflects what your organisation does. If the business has grown, changed its services, or taken on new activities since the last audit, the scope may need to be updated. An auditor who finds activities happening outside the certified scope will raise this as a finding.
Similarly, if you have claimed any exclusions under the standard, make sure those exclusions are still valid and that you can justify them. Exclusions that were reasonable at initial certification may no longer apply if the business has changed.
Review Your Objectives and Performance Data
External auditors will ask about your quality, environmental, or OH&S objectives and whether you are achieving them. Before the audit, pull together your performance data for the current period. Check that objectives are measurable, that you have been tracking progress, and that you can show the results.
If an objective has not been met, be prepared to explain why and what action has been taken. An auditor is not necessarily going to raise a nonconformity because you missed a target. What they will raise is a nonconformity if you have not been monitoring performance, have no idea whether you are on track, or have taken no action when results were poor.
Do a Final Check the Day Before
The day before the audit, do a quick walkthrough of the key areas. Check that noticeboards are current, that emergency procedures are posted where required, that equipment calibration stickers are current, and that any obvious housekeeping issues have been addressed. Brief your key contacts one more time and confirm the schedule for the day.
Prepare a brief summary document for yourself covering the audit scope, the schedule, the key contacts for each area, and where key records are located. This will help you stay organised on the day and respond quickly when the auditor asks for something.
Exemplar Global Recognised Training ProviderRTP No. 310970On the Day: Opening Meeting to Closing Meeting
When the auditor arrives, the opening meeting sets the tone. Be professional, be welcoming, and confirm the scope, schedule, and any practical arrangements. If there are areas that will be unavailable due to operational reasons, say so upfront.
During the audit, accompany the auditor or ensure a designated guide is with them at all times. Do not leave the auditor unsupervised with staff. Not because you are hiding anything, but because having a guide ensures the audit runs smoothly, questions are understood correctly, and any clarifications can be provided promptly.
At the closing meeting, listen carefully to the findings. If you disagree with a finding, you have the right to raise a concern, but do so professionally and based on evidence, not emotion. Our article on what to expect during an ISO certification audit covers the full day in detail.
After the Audit: Responding to Findings
Once the audit is complete and the report is issued, your work is not done. If nonconformities have been raised, you will need to submit a corrective action response within the timeframe specified by the certification body. This typically means conducting root cause analysis, implementing corrective actions, and providing evidence to the auditor for review.
Treat the findings as genuine improvement opportunities rather than administrative hurdles. The organisations that get the most value from external audits are the ones that use the findings to drive real change, not just to satisfy the certification body and move on.
If you want to build the internal skills to prepare your organisation more effectively for every audit cycle, Audit Workshop offers practical training for Internal Auditors and Lead Auditors across ISO 9001, ISO 14001, and ISO 45001. The courses are built around real audit practice, not just theory, and are available in live virtual and self-paced formats to suit working professionals.
