Your certification audit is on the calendar and the system isn't ready. When time is short, the answer is not to fix everything — it is to fix the right things in the right order. This checklist explains what happens at Stage 1 and Stage 2, the evidence auditors look at first, the gaps that most often become major nonconformities, and a realistic plan for the final 30, 14, and 3 days.
First, Understand What the Auditor Will Do
Initial ISO certification happens in two stages. Stage 1 is a readiness review. The auditor looks at your documented system, your scope, your understanding of the standard's requirements, the status of internal audits and management review, and your site conditions. The main output is a decision about whether you're ready for Stage 2, plus any areas of concern that could become nonconformities later.
Stage 2 is the certification audit itself. The auditor verifies, on the floor and in the records, that your system is implemented and effective. They'll interview people at every level, sample records, follow product and processes, and look for evidence that the system works in practice, not just on paper.
Knowing the difference matters when time is short. Stage 1 is where documentation gaps surface. Stage 2 is where implementation gaps surface. You need to be ready for both.
The Non-Negotiables: Fix These First
When time is limited, some gaps matter far more than others. These are the items most likely to stop certification, because their absence usually signals that the system isn't operating.
A completed internal audit covering the full scope of the system, with findings recorded and corrective actions opened.
A completed management review, with the required inputs covered and the outputs (decisions and actions) recorded.
A defined scope, quality policy, and quality objectives that people can explain.
A working corrective action process with at least some real examples worked through to root cause.
Training and competence records for people doing work that affects quality.
Control of documents and records, so people are using current versions and records can be found.
If any of these are missing, start there. Certification bodies generally expect the system to have been operating for a period before Stage 2, with at least one cycle of internal audits and a management review completed. Check your certification body's specific expectations.
Where Auditors Look First
Experienced auditors tend to start in the same places, because these areas reveal quickly whether the system is real. Expect questions like these.
Top management: Can leadership explain the quality policy, objectives, and how they review performance? Clause 5 requires leadership to take accountability, not delegate it entirely to the quality manager.
Objectives and data: Are objectives measurable, tracked, and discussed? Is there data behind the claims?
The floor: Do operators know what's expected of them, where to find current instructions, and what to do with a nonconforming part?
Corrective action: Pick a recent problem. Was the root cause found, was the action effective, and how do you know?
Purchasing and suppliers: How are suppliers selected, evaluated, and monitored?
Calibration: Are measuring instruments calibrated, identified, and traceable?
Walk these areas yourself, or have someone independent do it, and answer the questions honestly.
The Last 30 Days
With about a month left, focus on closing gaps with real evidence, not creating paperwork to look ready. Auditors are experienced at spotting records that were all created last week.
Finish any incomplete internal audits and management review. Work open corrective actions to root cause and document what you've done, even if some are still in progress. An open corrective action with a sound plan is fine. A problem with no action is not.
Run a mock audit that replicates what the registrar will do: an opening meeting, interviews on the floor, record sampling, and a closing meeting with findings. Use someone independent who knows how certification auditors think. Treat the findings as seriously as real ones.
Clean up document control. Remove obsolete documents from the floor, confirm that forms in use match the current revision, and make sure people can find what they need.
The Last 14 Days
Two weeks out, shift from fixing to preparing people. The people who will talk to the auditor need to be comfortable, not scripted.
Brief each area. Explain what an audit is, what the auditor may ask, and the golden rules: answer the question asked, tell the truth, show evidence rather than describing it, and if you don't know, say so and say who does.
Prepare a simple audit plan response. Confirm who will escort the auditor, who will cover each process, and where records are. Make sure key people aren't on vacation.
Verify the mock audit findings are closed or have credible plans.
The Last 3 Days
Resist the urge to write new procedures. Changes made in the final days usually create more inconsistencies than they fix.
Confirm logistics: a room for the auditor, access to records, and a schedule that works with production. Print the audit plan. Remind everyone that the audit is a sampling exercise, and that finding something is normal. Minor nonconformities are common at certification audits. What matters is how you respond.
During the audit, take notes, ask for clarification if a finding isn't clear, and don't argue. If you disagree with a finding, provide evidence calmly at the time or in the closing meeting.
If the Auditor Finds Something
A minor nonconformity usually requires a corrective action plan. A major nonconformity usually requires the correction to be implemented and verified, sometimes through a follow-up visit, before certification can be granted. Your certification body will tell you the deadlines.
Respond with a real root cause and a real process change. "Retrained employee" is rarely accepted as a corrective action on its own. Ask why the system allowed the problem, fix that, and show evidence it works.
How We Help When Time Is Short
When the audit date is close, our approach starts with a rapid clause-by-clause gap assessment, then a prioritized plan that separates what must be fixed from what can wait. We close gaps with your team so the evidence is genuine, run a pre-certification mock audit that replicates the registrar, and stay with you through the first surveillance cycle.
Our work is led by an active third-party auditor who knows what certification bodies look for. If your audit is coming fast, see our page on certification audits coming fast, or tell us what's going on.
Sounds like your situation?
“Certification audit coming fast”
See exactly how we approach this situation, what you'll have at the end, and request a Situation Review with our team.
Frequently Asked Questions
What is the difference between a Stage 1 and Stage 2 audit?
Stage 1 is a readiness review. The auditor checks your documented system, scope, internal audit and management review status, and whether you are ready for Stage 2. Stage 2 is the full certification audit, where the auditor verifies on the floor that the system is implemented and effective.
What causes a major nonconformity at a certification audit?
Common causes are no completed internal audit, no management review, a required process that is missing entirely, or a systemic breakdown such as widespread missing training records or uncontrolled documents. A major nonconformity usually delays certification until it is corrected and verified.
How long before the audit should we have records?
Certification bodies generally expect to see the system operating for a period before Stage 2, often a few months, with at least one full cycle of internal audits and a management review completed. Check your certification body's specific expectations.
Is a mock audit worth it?
Yes, if it is run the way a registrar will run it. A pre-certification mock audit finds the gaps while you still have time to fix them and gets your team comfortable answering an auditor's questions with evidence.
