An external audit evaluates a quality management system from outside the organisation. In certification, an independent certification body assesses the system against the applicable criteria and makes a certification decision through its own controlled process. A customer may also audit a supplier, but that second-party activity does not itself grant accredited ISO 9001 certification.
Effective preparation means having a working system and retrievable evidence. Effective response means understanding findings, addressing affected work, investigating causes and demonstrating appropriate action. Neither a well-rehearsed presentation nor a folder of revised procedures guarantees a favourable certification decision.
Distinguish the parties and their roles
The organisation operates its QMS and remains responsible for its products, services and obligations. The audit team gathers and evaluates evidence within its assignment. The certification body applies its certification processes, including decision-making. An accreditation body evaluates a certification body’s competence for a defined scope.
ISO develops standards; it does not carry out the organisation’s certification audit or issue its ISO 9001 certificate. QualityManagement.help is an independent educational publication, not a certification body, accreditation body or consultancy.
Understand which relationship applies before interpreting a request. A customer’s supplier audit can include contract-specific criteria that are different from an accredited certification assessment. An accreditation assessment of a certification body is another activity again.
The certification guide explains these distinctions in greater detail. They matter when choosing an assessor, interpreting a report and verifying a certificate’s status.
Confirm scope, edition and arrangements
Agree the relevant organisational scope, sites, activities and standard edition with the certification body. Examine the body’s accreditation scope and the certificate coverage sought. A certificate covering one business unit should not be presented as certification of every activity in a larger group.
ISO 9001:2026 is the current published edition. Organisations holding earlier certificates need to follow applicable transition arrangements and the certification body’s instructions. Do not assume that publication withdrawal instantly cancels every existing certificate or that a routine visit automatically completes a transition.
Confirm the audit plan, access needs, confidentiality, logistics and communication arrangements. Clarify any remote methods and their limitations. The organisation should arrange access to relevant people and real work, rather than selecting only evidence that presents the most favourable picture.
Understand the stages of initial certification
Initial certification commonly involves a Stage 1 assessment followed by Stage 2. Their purposes differ. The first stage helps evaluate readiness and inform the subsequent assessment; the second examines implementation and effectiveness against applicable criteria within the agreed scope.
Do not turn readiness into a guarantee. A satisfactory Stage 1 outcome does not mean Stage 2 cannot identify nonconformities. Equally, finding a readiness gap can provide useful information that should be addressed before further assessment.
The certification audit walkthrough explains the practical sequence. The organisation should confirm detailed arrangements with its selected certification body, including how readiness issues, scheduling and records are handled.
Prepare employees to explain actual work
People should understand their responsibilities, relevant controls, how to obtain current information and how to respond when something goes wrong. They do not need scripted answers to every possible clause question.
Use familiar examples to practise retrieving evidence and explaining handovers. If someone does not know an answer, they should say so and identify where suitable information or authority can be found. Coaching employees to conceal uncertainty can undermine the reliability of the assessment.
Avoid creating records retrospectively to make the system appear more complete. Where information is missing, address the actual gap and any affected work. Presenting an invented history as evidence creates a different and more serious problem.
The article on employee preparation gives practical ways to build understanding without turning the audit into a performance.
Expect evidence-based sampling
Auditors examine relevant evidence through interviews, observations, records and data. They may follow a transaction across several functions to see whether requirements remain controlled. The selected sample and scope limit the conclusion; an audit is not inspection of every product or service.
Keep evidence connected to its context. A record needs the relevant case, criteria and result. A chart needs a clear definition and period. A demonstration should make filters and exclusions understandable.
Where information conflicts, the team may seek additional evidence. The organisation should provide factual clarification without attempting to choose the conclusion. A disputed interpretation can be addressed through the body’s processes, but disagreement should be distinguished from withholding access.
Understand nonconformity findings
A nonconformity identifies failure to fulfil an applicable requirement. A defensible statement connects the criterion, relevant evidence and demonstrated gap. It should not simply list the auditor’s preferred method or prescribe a specific commercial product as the solution.
Major and minor classifications have meaning within certification assessment. The question concerns the effect of the failure on the management system’s capability and the extent of the evidence, not merely whether the visible error looks large or small.
A few examples may indicate a systematic failure; a single consequential issue may also warrant serious treatment. The major and minor comparison explains why count alone is an unreliable guide.
Separate nonconformities from observations or optional suggestions. A demonstrated unmet requirement should not be negotiated into a suggestion simply to obtain a clean report. An optional improvement should not be treated as mandatory unless a criterion makes it so.
Respond through correction, cause and action
Begin by understanding the finding and assessing the extent of affected work. Immediate correction may include checking an item, correcting an error or controlling an unsuitable output. That does not automatically address why the problem occurred.
Investigate causes using evidence. Consider process conditions, information flow, resources, authority and interfaces where relevant. Avoid treating human error as the final explanation without examining how the system allowed the gap.
Choose action that addresses the supported cause and assign responsibility. Define what evidence will demonstrate implementation and what later information will indicate effectiveness. The corrective-action guide follows this relationship through an external-audit example.
| Response element | Decision it supports |
|---|---|
| Extent assessment | Which other work could be affected? |
| Correction | Has the detected problem been addressed? |
| Cause investigation | Why did the control fail? |
| Corrective action | What change addresses the supported cause? |
| Effectiveness evidence | Does later relevant work show the change operating? |
These are useful distinctions, not a claim that every certification body uses an identical response form.
Confirm closure requirements with the body
The certification body determines how the response is reviewed under applicable requirements and its procedures. Depending on the finding and circumstances, it may need documents, records, additional assessment or other verification. Do not assume that uploading a procedure closes a finding automatically.
Confirm deadlines, submission methods and any certification implications in writing. Different findings and stages may have different consequences. Universal claims such as every organisation gets the same number of days can mislead readers.
The finding closure article explains how to retain a traceable response and distinguish the organisation’s internal action status from the body’s acceptance decision.
Maintain the system between assessments
Certification is an ongoing relationship, not a one-time inspection. Surveillance and recertification form part of maintaining confidence in the system. Organisations need to keep their arrangements operating as activities, people and conditions change.
Continue internal audits, performance evaluation, customer feedback, management review and action follow-up. The internal audit pillar explains how the organisation’s own assurance complements external assessment without replacing it.
Tell the certification body about changes that its agreement requires the organisation to report. Scope, legal identity, locations or significant system changes may affect the assessment arrangements. Check the actual agreement instead of assuming every change follows the same process.
Handle adverse decisions and disagreements accurately
An audit finding, a recommendation and a final certification decision are different events. If an adverse result occurs, identify the formal decision, reasons, response route and relevant deadlines. Determine whether certification is not yet granted, remains under review, is suspended or is withdrawn.
Use complaints or appeals processes where appropriate and provide a reasoned factual basis. Challenging a finding does not by itself eliminate the need to control affected work or address an established risk.
Claims about certification must match actual status and scope. If status changes, review public statements and contractual commitments. A certification-body suspension of a client’s certificate is distinct from an accreditation body’s sanction against the certification body itself.
Use the assessment to improve decisions
External assessment can identify gaps and reinforce confidence, but the organisation retains responsibility for its QMS. The most useful preparation is a functioning system that people understand, with evidence that can be traced from requirements through delivery and improvement.
Review findings and trends beyond individual forms. Repeated local issues may expose a shared weakness in a handover, change process or management arrangement. Addressing that relationship helps the organisation gain more from the audit than a certificate alone, while preserving an honest view of what certification does and does not establish.