ISO 9001 certification audit readiness
We run your stage 2 audit before the certification body does.
Certification audit readiness for organisations with a system already in place and an audit date on the calendar. A mock stage 2 run the way a registrar's auditor runs it, then every nonconformity it raises taken to closure with evidence.
What the auditor asks for
Prepare for the ISO certification audit you will actually get
Stage 1 reads your documents. Stage 2 reads your floor.
At stage 1 the certification body checks that the system exists on paper and that you are ready to be audited: scope under 4.3, policy and objectives, the internal audit under 9.2 and a management review under 9.3 already held. It is usually a day or less, sometimes remote. Stage 1 findings are called areas of concern. Ignore them and they come back at stage 2 as nonconformities.
Stage 2 is where the sampling starts. The auditor picks a product, a customer order or a batch number and follows it. Contract review. Purchasing. The work instruction at the cell, and whether it matches the revision on the master list. The gauge that measured the part, and whether its calibration was in date on the day of measurement. Then they ask an operator what the quality policy means to them. That question is not a trick. It is clause 7.3.
Our mock audit runs on the same plan. We write an audit plan, send it to you a week ahead as a certification body would, hold an opening meeting, sample, and hold a closing meeting with graded findings. The people being interviewed should feel it. A rehearsal where the consultant is friendly teaches nothing.
After the mock audit
Every finding goes into the corrective action log under 10.2 with a root cause, a correction and a corrective action, then evidence of effectiveness. We work through it with your owners on agreed days. We do not write the evidence for you. An auditor can tell a record made last Tuesday for their benefit, and so can we.
Grading How findings are weighed
Major and minor nonconformities are not a matter of tone
A major is a failure of a requirement or of the system to deliver its intended result. A minor is a lapse that does not, on its own, put that in doubt. Ten minors on the same clause can be graded as one major.
| Clause | Minor looks like | Major looks like | Grade |
|---|---|---|---|
| 7.1.5 | One gauge a week past due, not used for release since | No calibration system; release gauges never verified | Minor Major |
| 9.2 | Audit programme exists, one process skipped this year | No internal audit held before stage 2 | Minor Major |
| 9.3 | Minutes missing one required input from 9.3.2 | No management review held at all | Minor Major |
| 10.2 | One action closed without effectiveness check | Log of open actions with nothing closed in months | Minor Major |
| 7.5.3 | An obsolete form found in one drawer | Two live revisions of a work instruction in use | Minor Major |
Most nonconformities we find sit in clause 10.2. The corrective action was opened in March and nobody closed it. Certification bodies grade these differently, and the grading is theirs to make. The table shows the pattern, not a ruling.
Process
Eight weeks out to the closing meeting
Timings assume a stage 2 date is booked. If it is not, book it. A date concentrates a management team more than any consultant can.
- Wk −8
Readiness check
Half a day on records: 9.2 audit held, 9.3 review held, at least 3 months of operating records. If any is missing we say so before booking the mock.
- Wk −7
Audit plan issued
Processes, times, people. The same form a certification body sends.
- Wk −6
Mock stage 2
Opening meeting, trails sampled on the floor, graded findings read out at the close.
- Wk −5 to −1
Closure
Root cause, correction, corrective action, evidence. We verify each one on agreed days.
- Wk 0
Stage 2
We are not in the room unless you and the certification body agree an observer. Most of the time we are not needed.
After the certificate
Surveillance cycles catch the systems that went quiet
A certificate runs three years. Surveillance audits come in years one and two, typically within twelve months of the certification decision, and recertification falls in year three. Surveillance samples less. It always looks at 9.2, 9.3, 10.2 and complaints. It always looks at what was open last time.
The failure pattern is predictable. The quality lead who built the system leaves in month nine, the internal audit slips, and the first surveillance finds a management review that never happened. We run readiness for surveillance and recertification the same way as for stage 2, with fewer days. Ongoing audit cycles sit under internal audit and management review.
Choosing a certification body
We advise. You pick.
We do not issue certificates. A certification body does, and it cannot also be your consultant. For the same reason we take no referral fee from any registrar and do not steer you to one.
What we will do is give you the questions. Is the body accredited for your scope by an accreditation body that is an IAF signatory, and can you see the scope sector codes? Who is the lead auditor and do they know your industry? How are audit days calculated under IAF MD 5, and what does travel add? What happens to the fee if stage 2 raises a major? Get three quotes. Cheapest is rarely the problem. An auditor who does not understand your process is.
Objections
What buyers ask before booking a mock audit
Not for: a site with no internal audit and no management review a month before stage 2. You need the gap assessment and a later date, and we will say so.
Does a clean mock audit mean we will pass?
No. It means we sampled and it held. The certification body samples differently, and the recommendation is theirs alone. We never promise a pass, a certificate or a date that depends on someone else's auditor.
Our certification body already did stage 1. Is it too late?
No. Stage 1 areas of concern are the best brief we could ask for. Send the report and we plan the mock around them.
We already got a major at stage 2. Can you help close it?
Yes. That is closure work at the day rate. Bring the finding wording and the deadline the certification body gave you. Root cause first. A correction on its own will be rejected.
Do our documents need rewriting first?
Only if the mock shows people cannot follow them. If they cannot, that is a documented information job and we quote it separately.
Book the mock audit.
Give us the stage 2 date if you have one, the certification body if chosen, and the standard. We reply with an agreed number of days at the day rate.
- Phone(206) 464-3067
- Email[email protected]
- Studio1325 6TH AVE, SEATTLE, WA 98101