Initial certification to any accredited management system standard is a two-stage audit. Stage 2 is the one that decides whether a certificate is recommended, so it gets most of the attention. Stage 1 is the one that decides whether Stage 2 is worth doing yet. Organisations that treat Stage 1 as a formality are the ones most likely to find their Stage 2 postponed, or to go into it carrying problems that will be graded as nonconformities. This article explains what a Stage 1 audit is for, what the auditor actually reviews, and how to prepare.
What Stage 1 is for
The two-stage structure is set by ISO/IEC 17021-1, the standard that accredited certification bodies work to. Stage 1 is a readiness review. Its purpose is to establish whether your management system is designed and documented to meet the standard, whether it has been operating long enough to produce evidence, and whether the certification body has the information it needs to plan Stage 2 properly — the right audit time, the right auditors, the right sites and shifts.
Stage 1 does not result in a certification decision, and it is not a pass-or-fail exam. Its output is a report that tells you, and the certification body, whether you are ready to proceed and what needs attention first.
What the auditor reviews
ISO/IEC 17021-1 lists the objectives of Stage 1. In plain terms, the auditor will:
- Review your documented information — scope, policy, objectives, the processes you have defined and the records the standard requires
- Evaluate site-specific conditions and talk to your people to judge whether you are prepared for Stage 2
- Check your understanding of the standard, particularly how you have identified key performance indicators, significant aspects or hazards, processes, objectives and operations
- Collect the information needed to confirm the scope: processes, locations, headcount, shifts, outsourced activities and the legal and regulatory requirements that apply
- Confirm that internal audits and management review have been planned and carried out, and that the level of implementation supports moving to Stage 2
- Agree the arrangements for Stage 2 — dates, sites, people and resources
On site or remote?
Stage 1 is usually carried out at least partly at your premises, because evaluating site conditions is one of its objectives. Whether some or all of it can be done remotely depends on the standard, the accreditation rules that apply to it and the nature of your operations. For standards where the physical site matters most — environmental, health and safety, food safety — expect the auditor to walk the site. Your certification body will confirm the arrangement in the audit plan.
What the Stage 1 report tells you
Stage 1 findings are documented and shared with you. The important category is "areas of concern" — issues that, if they are still present at Stage 2, could be graded as nonconformities. They are not nonconformities yet, and you are not required to submit formal corrective action for them. But they are a clear signal of where Stage 2 will look first.
The time between Stage 1 and Stage 2 is set with your needs in mind: long enough to resolve the areas of concern, not so long that the information gathered at Stage 1 goes stale. If significant changes happen in between, the certification body may need to repeat part of Stage 1.
| Stage 1 outcome | What it usually means | What to do next |
|---|---|---|
| Ready, no concerns | The system is designed and operating | Keep the system running as normal until Stage 2 |
| Ready, with areas of concern | Gaps that Stage 2 could grade as nonconformities | Fix them and keep evidence of what you changed |
| Not ready | Key elements missing, such as internal audit or management review | Complete them; Stage 2 is rescheduled |
How to prepare
Before you book
- Run the system for long enough to generate records — typically at least a few months of operation, so there is real evidence to sample
- Complete at least one full internal audit cycle across the scope, with findings raised and actions under way
- Hold a management review that covers every input the standard lists, and record the decisions and actions that came out of it
- Confirm the scope statement is the one you want printed on the certificate
In the weeks before
- Send the documents the certification body asks for in advance, so the auditor arrives informed
- Make sure the legal and other requirements register is current and you can explain how compliance is evaluated
- Check that the people who own each process are available on the audit day, including top management
- Tell the certification body about any change to sites, headcount, shifts or outsourced processes since the application
On the day
- Answer questions directly and show the system as it really operates — Stage 1 exists to find gaps while they are still cheap to fix
- Take notes on every area of concern raised at the closing meeting, and ask for clarification if a point is unclear
- Agree a realistic Stage 2 date that leaves time to address the concerns properly
The common mistakes
- Booking Stage 1 the week the documentation was finished, before the system has produced any records
- An internal audit carried out by the person who wrote the procedures, auditing their own work
- A management review that is a slide deck with no recorded decisions
- A scope that omits a site, a shift or an outsourced process the auditor then discovers
- Treating areas of concern as optional because they are "not nonconformities yet"
A well-run Stage 1 makes Stage 2 shorter, calmer and more predictable. If you are planning initial certification with GMSCPL, request a quote and we will explain how Stage 1 and Stage 2 would be scheduled for your scope and sites.
