For people who have never sat through one, an ISO audit feels like an exam with unknown questions. It is closer to a structured conversation with a sampling plan. Knowing how the day is built removes most of the anxiety and shows where the real risks are.
Last reviewed: 17 October 2026. Facts checked. We opened web search results on ISO/IEC 17021-1 and the certification cycle (guides and a certification body annex); we did not open ISO 19011, the guidance on auditing management systems, or the text of ISO/IEC 17021-1, so the description below reflects common practice described in secondary material. Certification bodies differ in report format and grading terms. The example is invented.
The shape of the day
Most audits, whether internal or by a certification body, follow the same sequence defined in general audit guidance:
- Opening meeting.
- Audit activities: document review, observation, interviews, sampling of records.
- Auditor team review of findings.
- Closing meeting.
- Report and follow-up.
A certification audit adds a decision step afterwards, taken by the certification body, usually by someone who was not on the audit team. See our overview of stage 1, stage 2, surveillance and recertification audits.
The opening meeting
Usually 20 to 30 minutes. The lead auditor:
- introduces the team and confirms the scope, standard, sites and objectives;
- confirms the audit plan and the timetable;
- explains how findings will be graded and reported;
- confirms confidentiality and the arrangements for guides, safety and facilities;
- explains how sampling works and that the audit is a sample, not a full check;
- agrees how to raise concerns during the day.
Top management should attend. Auditors read a lot from whether the managing director shows up and whether the room is prepared.
What to do: have the scope statement ready, confirm it is accurate, and agree the guides. If the audit plan clashes with a shift or a visitor, say so now.
How auditors choose what to look at
Auditors sample. They follow a process or a trail rather than reading every record. A common method is the trace: start from a customer order, a complaint, an incident or a purchase and follow it through the departments, asking for the record at each step.
They tend to concentrate on:
- areas with higher risk or past problems;
- what changed since the last audit: new product, new site, new system, new people;
- the results of earlier audits and how findings were closed;
- processes that matter to the standard's purpose, such as design in a manufacturing business or hazard control in a safety standard.
This is why it helps to know your own process map. You can predict much of the route.
Interviews
An auditor will speak to people who do the work and to top management. Typical questions:
- What does your job involve and who do you report to?
- How do you know what to do? Where is the instruction?
- What would you do if something went wrong?
- Can you show me the last record of this task?
- What did you learn from the last complaint or incident?
Honest, specific answers serve best. Where you do not know, say that you will check and find out; do not guess. An answer that contradicts the documented procedure is a finding, but a guessed answer that contradicts reality is a worse one.
Escorts should help by locating records, not by answering for the person interviewed.
Records and evidence
Evidence is something observed, heard or documented that can be verified. Auditors will:
- ask for a record by example, not by category, such as "the calibration record for this gauge";
- check that the record shows what the procedure says it should;
- compare dates, signatures and versions;
- cross-check one source against another, such as the training record against the person's actual role.
If a record is missing, say so. Producing a record that appears to have been made that morning is a different problem from admitting a gap.
Findings and how they are graded
Terminology varies by body, but findings commonly fall into groups like these:
- Major nonconformity: failure to meet a requirement in a way that affects the system's ability to achieve its intended results, or a breakdown of a whole requirement. Certification is normally not granted or continued until it is corrected and verified.
- Minor nonconformity: a lapse that does not by itself undermine the system, usually requiring a corrective action plan and verification at a later audit.
- Observation or opportunity for improvement: not a nonconformity, but a pointer for the organisation.
The exact definitions, and what a major requires before a certificate is issued, come from the certification body's rules, so ask for them. Our guide to major and minor nonconformities covers evidence and corrective action.
A well-written finding names the requirement, the evidence and the gap. Ask to read the wording during the day, so there is no surprise.
During the day: working well with the auditor
- Check facts as findings emerge. If the auditor writes something down that seems wrong, politely ask what they saw. A misunderstanding is easier to fix on the day than in the report.
- Do not argue the grade in the corridor. Understand the requirement and the evidence; if you disagree, state your case at the closing meeting and, if needed, through the certification body's appeal route.
- Keep notes of every finding and every sampled record. Your own record of the day helps with the response.
- Do not hide problems. A voluntarily disclosed gap with action already started is received very differently from one the auditor discovers.
The auditor team review
Before the closing meeting, the audit team meets to review evidence, agree the findings and grade them, and decide the audit conclusion. This is also when they agree what they will recommend. The organisation is usually asked to wait. It is not a sign of trouble.
The closing meeting
The lead auditor:
- thanks the team and reminds everyone of scope and the sampling limit;
- presents each finding with the requirement and evidence;
- states the grade and what response is needed and by when;
- explains the recommendation and the next steps, including who decides on certification;
- invites questions and discussion.
At this point the organisation should clarify, not negotiate. It is fair to ask: What is the requirement? What evidence led to this finding? What will the corrective action response need to include? By when?
Top management should attend and acknowledge the findings.
After the audit
- Write the response. For each finding, state the correction (immediate fix), root cause and corrective action, with evidence and dates. Our posts on root cause analysis and corrective action evidence help.
- Meet the deadline. The certification body sets it. Late responses can delay or stop certification.
- Learn from observations, too, which often predict next year's minors.
- Plan for surveillance. The cycle continues; the next audit will check how well you closed this one.
A worked example (invented)
During a stage 2 audit at an invented logistics firm, the auditor traces a customer complaint. The complaint log shows it was closed, but the corrective action record has no root cause, only "driver counselled". The auditor raises a minor nonconformity for the corrective action process, and notes that two other complaints were handled the same way. At the closing meeting, the managing director asks what a sufficient root cause would look like. The auditor explains the requirement and what the response should contain. The firm replies with a cause analysis for all three complaints, a revised template and a check by quality that cause fields are filled before closure.
The takeaway
An audit day is a sampled conversation about whether the system works in practice. Know the sequence, expect traces, answer plainly and use the closing meeting to understand findings rather than to contest them. What happens in the weeks after counts as much as the day.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error