The Two Stage Certification Audit Process
If your organisation is pursuing ISO 9001 certification for the first time, you will go through a two stage external audit process conducted by an accredited certification body. Understanding what happens at each stage, what the auditor is looking for, and how to prepare your team can make the difference between a smooth certification and a frustrating experience full of surprises.
On this page
Stage 1 and Stage 2 are not interchangeable. They serve completely different purposes, and the evidence you need to have ready at each stage is different. Many organisations treat Stage 1 as a formality and then find themselves scrambling before Stage 2. This article walks you through both stages in practical detail, based on how certification audits actually unfold.
If you want a broader picture of what certification audits involve overall, the article on what to expect during an ISO certification audit is a good companion read.
What Is a Stage 1 Audit?
Stage 1 is sometimes called a readiness review or a documentation review, but those labels can be misleading. It is more than a document check. The purpose of Stage 1 is for the auditor to assess whether your organisation is ready for the Stage 2 audit. The auditor needs to understand your context, confirm your scope is defined, and determine whether your quality management system is sufficiently developed and implemented to warrant a full certification audit.
Where Does Stage 1 Take Place?
Stage 1 is commonly conducted at your premises, though some certification bodies will offer a remote Stage 1 for smaller or simpler organisations. An on site Stage 1 gives the auditor a chance to understand your physical environment, your processes, and your team. Even if the audit is primarily document focused, the auditor will often walk through your facility and have brief conversations with key personnel.
The duration of Stage 1 depends on the size and complexity of your organisation. For a small business, Stage 1 might be a single day. For a larger operation, it could span two days.
What Does the Auditor Review at Stage 1?
The auditor at Stage 1 is checking several things simultaneously. Here is what they are typically working through:
- Scope of the QMS. Is the scope clearly defined? Does it reflect what your organisation actually does? Are any exclusions from Clause 8 justified and documented?
- Context and interested parties. Has the organisation identified its internal and external issues under Clause 4.1? Have interested parties and their requirements been considered under Clause 4.2?
- Quality policy and objectives. Is the quality policy documented, communicated, and aligned with the organisation's direction? Are quality objectives measurable and linked to the policy?
- Documented information. Does the organisation have the mandatory documented information required by ISO 9001? This includes procedures, records, and any documents the organisation has determined are necessary.
- Internal audit programme. Has the organisation planned and conducted internal audits? Is there evidence that internal audits have been completed and findings addressed?
- Management review. Has top management conducted a management review? Is there a record of the inputs reviewed and outputs decided?
- Nonconformity and corrective action records. Is there evidence that nonconformities have been identified and corrective actions raised and tracked?
The auditor is not just ticking boxes. They are forming a judgement about whether the system exists on paper and whether there is evidence it has been operating for a reasonable period. A QMS built last week will not pass Stage 1 regardless of how well documented it is.
How Long Should Your QMS Have Been Running Before Stage 1?
This is one of the most common questions from organisations approaching certification for the first time. Most certification bodies expect to see at least one full internal audit cycle and one management review completed before Stage 1. In practice, that means your QMS should have been operating for a minimum of two to three months, and ideally longer. Some certification bodies specify a minimum operational period in their own procedures.
If you have not yet completed an internal audit or management review, the auditor will almost certainly raise this as a significant gap and the Stage 2 audit will not proceed until it is addressed.
What Are the Possible Outcomes of Stage 1?
At the end of Stage 1, the auditor will typically produce a Stage 1 report that identifies any areas of concern. These are often called Stage 1 findings or issues for attention. They are not formal nonconformities in the same sense as Stage 2 findings, but they need to be addressed before Stage 2 can proceed.
The auditor will also recommend whether to proceed to Stage 2, and if so, they will agree on a date for Stage 2. If there are significant gaps, the auditor may recommend delaying Stage 2 until those gaps are resolved. In serious cases, Stage 1 may need to be repeated.
What Is a Stage 2 Audit?
Stage 2 is the full certification audit. This is where the auditor evaluates whether your quality management system is effectively implemented and maintained in practice, not just documented on paper. The auditor is looking for objective evidence that the system is working as intended and delivering the outcomes required by ISO 9001:2015.
Stage 2 is always conducted on site. Remote Stage 2 audits are possible in some circumstances, but for initial certification, the vast majority of certification bodies require physical presence at your premises.
How Long Does Stage 2 Take?
The duration of Stage 2 is calculated based on the number of employees, the complexity of your processes, and the scope of certification. The International Accreditation Forum publishes guidance on audit time calculations, and accredited certification bodies are required to follow it. For a small organisation of ten to twenty people, Stage 2 might be one to two days. For a larger organisation with multiple departments or sites, it could be three days or more.
What Does the Auditor Do During Stage 2?
Stage 2 follows a structured format. The day typically begins with an opening meeting where the auditor confirms the scope, objectives, and agenda. From there, the audit proceeds through a combination of document review, interviews with staff, and observation of processes in practice.
The auditor is gathering objective evidence across the full scope of the standard. This means they will be sampling records, asking questions of people at all levels of the organisation, and observing actual work being performed. They are not looking for perfection. They are looking for evidence that the system is real, that people understand their roles within it, and that it is producing the intended outcomes.
Key areas the auditor will examine during Stage 2 include:
- Leadership and commitment. Can top management demonstrate genuine involvement in the QMS? Do they know the quality policy, the objectives, and the results of recent management reviews?
- Risk based thinking. Has the organisation identified risks and opportunities? Are controls in place and are they working?
- Operational processes. Are customer requirements being captured and met? Is there evidence of planning, execution, and control across the production or service delivery processes?
- Competence and awareness. Do staff understand their contribution to quality? Are training records current and complete?
- Monitoring and measurement. Is the organisation measuring what matters? Is customer satisfaction being monitored? Are quality objectives being tracked?
- Nonconformity management. When things go wrong, is there a consistent process for identifying, recording, and addressing nonconformities? Are root causes being investigated and corrective actions verified?
- Continual improvement. Is there evidence that the system is improving over time, not just maintaining the status quo?
What Happens When the Auditor Finds Issues?
During Stage 2, the auditor may raise findings at three levels. A major nonconformity is a significant failure of the system, either a complete absence of a required element or a systematic breakdown that undermines the integrity of the QMS. A minor nonconformity is an isolated lapse or a gap that does not fundamentally compromise the system. An observation or opportunity for improvement is a note that something could be strengthened, without rising to the level of a nonconformity.
A single major nonconformity will prevent certification from being granted until it is resolved. Multiple minor nonconformities can also become a major if they indicate a systemic problem. The auditor will present findings at the closing meeting and explain what is required before certification can proceed.
For more detail on how findings are classified and what each category means in practice, the article on audit findings, observations and nonconformities covers this well.
The Gap Between Stage 1 and Stage 2
The time between Stage 1 and Stage 2 is important. It gives your organisation the opportunity to address any issues identified at Stage 1 before the full certification audit. Most certification bodies recommend a gap of four to twelve weeks between the two stages. This gives you time to close out Stage 1 findings, complete any missing records, and ensure your team is ready.
Do not use this time to simply produce paperwork. If Stage 1 revealed that your internal audit process had gaps, fix the process, not just the records. Auditors are experienced at recognising when documentation has been created in a rush to satisfy a requirement rather than to reflect genuine practice.
Common Mistakes Organisations Make Between Stage 1 and Stage 2
Having worked through hundreds of certification audits, the same patterns emerge when organisations stumble between Stage 1 and Stage 2. Here are the most common ones:
- Creating management review minutes after Stage 1 that are clearly backdated or generic. Auditors will ask questions about what was discussed and whether actions were actually implemented.
- Running an internal audit in the gap period but not completing corrective actions before Stage 2. The internal audit is only part of the picture. The follow through matters.
- Briefing staff on the quality policy and objectives only in the days before Stage 2. Auditors interview people across the organisation, and it becomes obvious when awareness is superficial.
- Assuming Stage 2 will only cover what Stage 1 identified as gaps. Stage 2 is a full audit of the entire scope. Stage 1 findings are a starting point, not a boundary.
How to Prepare for Stage 2 Specifically
Preparation for Stage 2 should be systematic, not frantic. The article on how to prepare for a certification audit as the quality manager goes into this in depth, but here are the most important practical steps:
Brief Your Team Properly
Every person the auditor might speak with should understand the quality policy, know what the quality objectives are, and be able to explain their role in the QMS. This does not mean scripting their answers. It means ensuring they have been genuinely involved in the system, not just told it exists.
Review Your Records Before the Audit
Go through your documented information and check for completeness. Are all required records present? Are they legible, dated, and signed where required? Are corrective actions closed out with evidence of effectiveness verification? Gaps in records are one of the most common sources of nonconformities at Stage 2.
Walk the Process
Before Stage 2, walk through your key processes as if you were the auditor. Follow an order from enquiry through to delivery. Check that the documented process matches what actually happens. Look for places where the documented procedure says one thing and the actual practice is different. These gaps are exactly what a Stage 2 auditor will find.
Prepare Your Top Management
The auditor will almost certainly request time with a senior leader, often the CEO or Managing Director. Top management needs to be able to speak to the quality policy, the objectives, how they demonstrate leadership and commitment, and what the management review concluded. They do not need to know every clause of the standard, but they need to demonstrate genuine ownership of the system.
After Stage 2: What Happens Next?
If Stage 2 results in no major nonconformities, and any minor nonconformities have been accepted with a corrective action plan, the certification body will proceed to grant certification. The auditor submits their report and recommendation to the certification body's technical review function, which independently reviews the findings before issuing the certificate.
The certificate is typically issued within a few weeks of Stage 2. It is valid for three years, subject to annual surveillance audits. These surveillance audits are shorter than the certification audit and focus on key processes, previous findings, and areas of risk. At the end of the three year cycle, you will undergo a recertification audit, which is similar in scope to Stage 2.
If major nonconformities were raised at Stage 2, you will be given a defined period to resolve them, usually within a specified number of days. The certification body may require a follow up visit to verify closure, or they may accept documented evidence depending on the nature of the nonconformity.
Understanding the Difference Between Stage 1 and Stage 2 as an Auditor
If you are training as an auditor rather than preparing your organisation for certification, understanding the distinction between Stage 1 and Stage 2 is essential for your professional development. As a lead auditor, you will be responsible for planning and conducting both stages, communicating findings clearly, and making sound recommendations about certification readiness.
The skills required for Stage 1 are heavily weighted towards document review, process understanding, and asking the right questions to determine system maturity. Stage 2 demands stronger interview technique, process auditing skills, and the ability to draw conclusions from evidence gathered across multiple sources simultaneously.
If you are working towards your lead auditor credentials and want to build these skills properly, Audit Workshop offers ISO 9001 Lead Auditor training at both live and self paced levels. The courses are built around real audit scenarios, not theoretical exercises, and cover the full audit process from planning through to closing meeting and report writing.
