Stage 2 examines implementation and effectiveness
An ISO 9001 Stage 2 audit evaluates how the quality management system operates within the agreed certification scope. Auditors sample evidence, discuss activities with relevant people and examine whether the arrangements meet applicable requirements and achieve their intended results. A procedure that describes good practice is only part of that evidence.
Stage 2 follows the readiness and planning work at Stage 1. It does not eliminate the need for subsequent findings handling and a separate certification decision. The certification guide explains those distinctions and the continuing programme after initial certification.
The chosen body provides the plan and process rules. Confirm the standard edition, locations, activities, audit methods and access requirements. Do not infer these details from a generic internet checklist or a different company’s previous audit.
Expect auditors to follow processes across handovers
A process-based audit may start with a customer order and trace how requirements were understood, planned, delivered and evaluated. Questions can move between functions because errors often occur at interfaces. Prepare people to explain those relationships instead of assuming each department will be considered in isolation.
For a fictional equipment refurbishment business, an auditor might select an urgent job. The evidence could include the agreed specification, changed delivery requirement, technician authorisation, replacement-part controls, final checks and release decision. If a complaint followed, that response may provide another view of the same process.
These are examples, not a universal list of required forms. The relevant evidence depends on the requirement, activity and organisation. A shared workflow application may provide suitable information where another business uses paper records.
Make representative activity available
Review the audit plan against the operating calendar. Identify activities that occur only on particular shifts, at remote sites or during seasonal work. Notify the body if a planned activity will not occur. It must determine how to obtain a defensible assessment of the scope.
Arrange access to people, records and working areas. Give staff enough notice to manage customer commitments and identify substitutes where appropriate. Avoid scheduling every knowledgeable person into unrelated meetings during the planned audit sessions.
If sensitive information is involved, agree suitable arrangements in advance. Redaction or controlled viewing may be possible in some circumstances, but the body must still be able to obtain the evidence it needs. A blanket refusal on the day can affect the assessment.
Explain actual practice rather than rehearsed answers
Employees should describe their normal tasks, show where requirements are found and explain what happens when something goes wrong. They do not need to memorise clause numbers to explain a controlled process. If they are unsure, they should say so and locate the appropriate source or responsible person.
Consider a supervisor asked how urgent changes are approved. A useful response follows the actual approval route and demonstrates an example. A polished statement about commitment to quality does not answer the operational question. Coaching should build understanding of the system, not a performance for the visitor.
Managers should also be ready to discuss objectives, results, resources and decisions. Where performance is below target, explain the analysis and response honestly. An unfavourable result is information to evaluate; hiding it prevents a meaningful examination of the system.
Connect different forms of evidence
Documentation shows planned arrangements. Completed records show recorded events or results. Interviews explain understanding, and observation can reveal work as it happens. Auditors consider these together. Contradictions may lead to further sampling rather than an immediate assumption that one source is always correct.
For example, a release procedure may require an authorised check, while sampled records name someone whose authorisation expired. The organisation should help establish the facts and affected work. Producing a new signature sheet during the visit does not, by itself, explain the earlier releases or their consequences.
Keep an efficient route to information. A process owner who can locate a record and explain its context is more useful than a large presentation assembled for the opening meeting. Avoid flooding the auditor with unrelated documents when a specific question has been asked.
Understand findings before planning the response
At the closing meeting, listen for the requirement, objective evidence and conclusion behind each finding. Ask for clarification where needed. Distinguish nonconformities from opportunities or suggestions under the body’s reporting system. A suggestion should not casually become an invented standard requirement.
Assign responsibility for response and confirm the applicable deadlines and verification arrangements. Correction addresses the immediate problem; corrective action addresses its cause as appropriate. The body determines the response needed under its certification procedures, including whether further evidence or a visit is required.
The Stage 1 guide explains how readiness concerns should have informed preparation. If a Stage 1 issue reappears, review why the earlier response failed rather than treating it as an unrelated new form to complete.
Wait for the certification decision
A positive audit recommendation does not equal an issued certificate. The body reviews the assessment information and findings response before making its decision. DNV’s published process explicitly separates the decision personnel from those conducting the audit.
Following a positive decision, check the certificate’s scope, entity, sites, edition and accreditation. Confirm permitted claims and mark use. The certification process article sets out the complete handover into continuing surveillance, so the operating system remains active after the audit team leaves.