Guide

How to prepare for an ISO audit

Guide to prepare your organization before an ISO certification audit. Documentation, objective evidence, simulation, and common mistakes.

A certification audit evaluates whether your management system meets the standard's requirements. Proper preparation reduces findings and accelerates the certification process.

Step by step

Verify mandatory documentation

Each ISO standard requires a minimum set of documents. Verify they exist, are approved, and up to date. Use the standard's required documented information list as a checklist.

Auditor tip: Auditors check version control: if a document says 'Rev. 3' but there is no record of previous revisions, it is an immediate finding.

Gather objective evidence

Objective evidence demonstrates that controls work. It includes records, screenshots, logs, meeting minutes, and test results. Organize it by clause or control.

Auditor tip: Having an approved policy is not enough; the auditor will ask for evidence that the policy is executed. Example: if the policy says 'biannual review,' show records of the last two reviews.

Train involved personnel

Auditors interview people from different areas. Ensure each responsible person knows their role within the management system and can explain the processes they execute.

Auditor tip: Conduct interview rehearsals with key people. The auditor's most common question is: 'How do you know this works?' If they cannot answer with data, there is a finding risk.

Conduct a complete internal audit

Internal audit is a requirement of all ISO management system standards. It must cover all in-scope processes and produce a report with classified findings.

Auditor tip: Use internal auditors who do not audit their own area. Internal auditor independence is a point that certifiers always verify.

Close findings and execute corrective actions

Each internal audit finding requires root cause analysis and corrective action. Document the implementation and verify its effectiveness before the external audit.

Auditor tip: Saying 'personnel were trained' is not enough. The auditor will ask for evidence of training effectiveness: assessments, attendance records, measurable process changes.

Prepare external audit logistics

Coordinate the room, system access, personnel availability, and organized documentation. A professional and orderly environment conveys management system maturity.

Auditor tip: Designate an 'audit guide' to accompany the auditor at all times. This person controls the pace, facilitates evidence access, and prevents focus deviation.

Key takeaways

Objective evidence is more important than perfect documentation. Demonstrate that controls work in practice.
Internal audit is your dress rehearsal: use it to find issues before the external auditor does.
Preparing personnel for interviews is as important as having documents in order.
Close internal audit findings with verifiable corrective actions, not promises.

Frequently asked questions

The certification body grants a period (usually 90 days) to implement corrective action. If resolved satisfactorily, certification proceeds.

It is not mandatory, but the internal auditor must have demonstrable competence and be independent of the audited area. Internal auditor training is highly recommended.

It depends on the scope and size of the organization. For an SME, between 2 and 5 days of on-site auditing, divided between Stage 1 (documentation) and Stage 2 (implementation).

Professional guidance for your implementation

Assessment within 72 business hours. ISO methodology. No ties to certification bodies.

Request diagnosis

Loading content…

Key takeaways

Objective evidence is more important than perfect documentation. Demonstrate that controls work in practice.

Internal audit is your dress rehearsal: use it to find issues before the external auditor does.

Preparing personnel for interviews is as important as having documents in order.

Close internal audit findings with verifiable corrective actions, not promises.

Frequently asked questions

The certification body grants a period (usually 90 days) to implement corrective action. If resolved satisfactorily, certification proceeds.

It is not mandatory, but the internal auditor must have demonstrable competence and be independent of the audited area. Internal auditor training is highly recommended.

It depends on the scope and size of the organization. For an SME, between 2 and 5 days of on-site auditing, divided between Stage 1 (documentation) and Stage 2 (implementation).