Preparing for a certification audit: checklist for the final weeks and the day itself

How does a certification audit work?

A certification body independently assesses whether your management system meets a standard, such as ISO 9001, ISO 14001 or ISO 45001. For a first certification this often happens in two steps: first the auditor checks whether your documentation and setup are ready, then whether you do in practice what you have described. The exact setup differs per body and standard.

After a successful assessment, periodic surveillance audits follow and, after some time, a renewed assessment; that too differs per scheme. Ask your body for the audit plan and duration, so you know who is coming, which parts will be covered and how much time it takes.

Checklist for the final weeks

Good preparation does not start the week before. Work back from the audit date and put the key steps in the diaries of those involved: when is the internal audit finished, when is the management review and when must the last actions be closed? That leaves room for the unexpected. In the final weeks, work through these points:

• Internal audit carried out across all parts of the scope and findings followed up
• Management review held and recorded, with decisions and actions
• Policy, objectives and KPIs current and known to employees
• Documents and procedures on the latest version, outdated versions removed
• Legal and other obligations mapped, with proof of compliance
• Training, certificates and authorizations valid and recorded
• Open actions and deviations followed up or planned with justification
• Audit plan discussed with the departments involved and availability of people checked

How to prepare your evidence

An auditor does not believe claims but looks at evidence. For each process, prepare what you will show: the procedure or instruction, the records of the past months (inspections, reports, training, actions) and an example of a case in which the system solved something.

Make it findable. Anyone who cannot show the evidence within a few minutes creates doubt. Work with an overview per part of the standard or per process, with references to where the evidence is, and test it with a colleague who was not involved in the setup.

What does an auditor often ask?

Every auditor works differently, but the questions always revolve around the same thing: do you do what you say, and can you show it? The questions are usually open and go to the people doing the work, not only to the coordinator. So also prepare colleagues for questions about their own tasks. Typical questions are:

• What are your most important objectives and how are you doing?
• How do you know whether customers and employees are satisfied, and what happens in case of a complaint?
• Can you show the latest incident, complaint or deviation and what was done about it?
• What are your biggest risks and how do you control them?
• When was the last internal audit and what did it yield?
• How do employees know what to do, and how do you keep track of their competence?
• What has changed since the previous assessment, and how was that controlled?
• Which laws apply to you and how do you check compliance?

The day itself

Appoint one guide who leads the auditor through the day, keeps appointments and brings in the right people. Hold a short opening: who is present, what is the scope, how is the day structured. Make room for the auditor on the shop floor, because much of the evidence is there.

Answer the question that is asked, honestly and without much around it. If you do not know something, say you will look it up and then do so. Do not guess. Take your own notes on the points the auditor raises, so you are not surprised at the closing meeting.

Handling findings

An auditor can record a nonconformity (a requirement is not or insufficiently met) or note an improvement point or observation. The names and the split into major and minor differ per body, so ask how they work. Do not react defensively, but ask what exactly was missing and discuss it at the closing meeting. Then proceed like this:

• Understand the finding: what evidence was missing and what was it assessed against
• Fix at once what can be fixed (correction)
• Find the cause, so the nonconformity does not return
• Draw up a corrective action with owner and end date, within the period the body states
• Submit the evidence and check later whether the measure has effect

Common mistakes

Many organizations only compile their evidence when the date approaches, so records from the months before are missing. A second mistake is that one person, often the QHSE coordinator, knows everything and the rest of the organization sees the audit as somebody else's business. Let employees themselves explain how they work; auditors like to talk to the people doing the work.

Finally, an open nonconformity from the internal audit often stays on the shelf "for a while", whereas an external auditor picks it up immediately. Resolve what you already know yourself first. Also do not create records after the fact with an old date: that costs more trust than an honest gap in your evidence.

After the audit

Thank the team and discuss what went well. Turn the findings into actions and take them to the next management review. Then keep the system up to standard: a certificate shows a moment, daily operation shows the rest. Put internal audits and management reviews in the annual calendar, so you do not have to sprint again for the next surveillance audit.

How BrydgeOne supports this

In BrydgeOne the Audit-ready check shows per part of your standards framework what is still missing, and the GAP analysis shows at a glance where you still fall short. With Audits you plan internal audits and record findings, and Document management provides one current version, with read confirmation.