Certification process
Audit stages
Certification is a two-stage audit, and the stages ask different questions. Understanding the difference is the easiest way to arrive at Stage 2 prepared.
Two audits, two questions
What each stage is actually for
Stage 1 asks whether you are ready. Stage 2 asks whether your system conforms in practice. Conducting them back-to-back defeats the purpose of the first.
Stage 1 — Readiness Review
To determine whether you are ready for Stage 2, and to plan Stage 2 intelligently. Stage 1 is not a soft audit; it is a different audit with a different question.
What happens
- Confirmation that the proposed scope is accurate and appropriate
- Review of your management system documented information
- Evaluation of your understanding of the standard’s requirements
- Review of internal audit and management review evidence
- Assessment of statutory and regulatory compliance status
- Evaluation of site conditions, shift patterns and Stage 2 resource needs
- Collection of information needed to plan Stage 2 sampling
What you receive
- A written Stage 1 report identifying any areas of concern
- Confirmation of Stage 2 readiness, or a clear statement of what must be resolved first
- An agreed Stage 2 audit plan with dates, duration and areas to be sampled
Stage 2 — Certification Audit
To determine conformity of your management system to all requirements of the standard, as it operates in practice — not as it is described in your documents.
What happens
- Opening meeting confirming scope, plan, confidentiality and reporting
- Sampling of processes across all shifts and sites in scope
- Interviews with personnel at every level, including non-managerial staff
- Examination of records demonstrating the system operating over time
- Verification of performance against your own objectives and targets
- Evaluation of internal audit, corrective action and management review effectiveness
- Closing meeting presenting every finding, with the opportunity to challenge facts
What you receive
- A written audit report listing all findings with objective evidence
- Nonconformities graded major or minor, plus opportunities for improvement
- A defined period to submit root cause analysis and corrective action
- A recommendation to the certification decision-maker — who is not the auditor
The gap between Stage 1 and Stage 2 is deliberate
We leave two to four weeks between the stages so you have genuine time to address what Stage 1 found. Running Stage 2 immediately afterwards would mean auditing a system we already know is not ready, which wastes your audit days and ours. If a certification body offers to conduct both in the same visit, ask what Stage 1 is then for.
How findings are graded
Major, minor, and opportunity for improvement
Every finding raised at your audit is graded, presented at the closing meeting with the objective evidence behind it, and open to challenge on the facts before the report is issued.
What it means
A requirement of the standard is absent, or a failure raises significant doubt that the system can deliver conforming outputs. A total breakdown of a required process, or a systemic failure across multiple samples.
What you must do
Root cause analysis plus evidence of implemented correction, verified before certification can be recommended. Frequently requires a follow-up visit.
What it means
A single, isolated lapse against a requirement that does not by itself indicate a system breakdown. One missed record where the process is otherwise applied.
What you must do
Root cause analysis and corrective action plan submitted within an agreed period, typically verified through documentary evidence.
What it means
Not a nonconformity. An observation where the system conforms but could be more effective, or where a trend suggests a future problem.
What you must do
No mandatory response. Recorded in the report for your consideration. We do not require you to action OFIs and will not raise them as findings later.
The auditor who raises a finding does not decide your certification. That decision is made independently, on the complete audit file, by someone who was not on your audit — a separation required by ISO/IEC 17021-1.
Next step
Know what to expect on audit day
Ask us for a sample audit plan and a redacted example report before you commit. Knowing the format in advance removes most of the anxiety from a first certification.