Companies that fail a certification audit rarely fail on the standard itself. They fail because the records do not match what people say, the internal audit was never done or the management review was a formality. Eight weeks is enough to fix most of that, if the weeks are used in the right order.
Last reviewed: 17 October 2026. Facts checked. We opened web search results on ISO/IEC 17021-1, the standard for bodies that certify management systems: guides and a certification body annex describing the two-stage initial audit, surveillance audits in the first and second years and a recertification audit before the three-year certificate expires. These are secondary sources, not the standard text. We could not confirm the exact timing limit for the first surveillance audit or the stage 1 to stage 2 interval, which can depend on the certification body and scheme; ask yours. We did not open any individual management system standard here. The plan is a suggested pattern, and the example is invented.
Start with what the audit will look at
The first stage typically checks readiness: whether the system is documented, whether the scope is clear and whether the organisation understands the requirements. The second stage examines whether the system is implemented and effective, by sampling records, observing work and interviewing people. Our guide to stage 1, stage 2, surveillance and recertification explains the full cycle.
Everything below works backwards from that. The auditor will ask three questions in many forms: what do you say you do, do you do it, and how do you know it works?
Weeks 8 to 7: Settle scope and gaps
- Confirm the scope statement with the certification body: products and services, sites, activities, exclusions and their justification. A mismatch between the scope on the application and what actually happens is an early problem.
- Run a gap assessment against the standard if one has not been done recently; see how to run a gap assessment before certification.
- List open items with owners and dates. A gap list that nobody owns will still be a gap list at the audit.
- Check legal and customer requirements that the system claims to meet. Environment, safety, food and device standards usually bring regulatory duties that an auditor will ask about.
Weeks 6 to 5: Make the system real
- Review documented information for what the standard requires and what the organisation needs. Remove procedures that nobody follows; they create nonconformities. Add the ones that people follow but nobody wrote down.
- Check version control. Staff should use the current version of each document, and old ones should be marked or removed.
- Confirm roles and competence. Where the standard expects defined responsibilities and evidence of competence, check that training records, job descriptions and authorisations exist and match.
- Test the process evidence. Pick each key process and follow one real example from start to finish: a customer order, a purchase, a complaint, a maintenance task. If the records cannot be found, the system is not implemented, whatever the manual says.
Week 4: Internal audit
The standard expects internal audits at planned intervals, and certification auditors usually ask to see them. If the internal audit was done long ago or only on paper, run a real one now.
- Cover all clauses, processes and sites in scope, using auditors who are competent and independent of the area audited. See how to run an ISO internal audit step by step.
- Record findings with evidence, not opinions.
- Raise nonconformities and rate them honestly. A programme with no findings invites scepticism.
Week 3: Corrective action and management review
- Close what you can. For each internal audit finding, find the cause, fix it, check the fix worked and keep the record. Our post on nonconformities and corrective action explains how auditors judge this. For method, see root cause analysis methods.
- Hold the management review. Top management should look at the standard's required inputs: results of audits, performance data, customer feedback, risks and opportunities, resources, and decide actions. A review that is a signed slide is easily exposed in a conversation with the managing director. Make sure leaders can describe what they decided and why.
Week 2: Prepare people
- Brief staff on the audit: what it is, what the auditor may ask, and that the right answer is the truthful one. Teach them to answer the question asked, show the record when asked and say "I will find out" rather than guess.
- Identify guides for each area who can escort the auditor and arrange access to records.
- Run a mock walkthrough. Ask someone not involved in the system to go through a few processes as an auditor would. Gaps in confidence show quickly.
- Check the shop floor or office. Safety signs, calibration labels, controlled documents at the point of use, segregation of nonconforming product. Many findings come from simple housekeeping.
Week 1: Logistics and last checks
- Confirm the audit plan with the certification body: dates, auditors, the schedule by area and any sites.
- Prepare a room and a document access list. Have registers ready: document list, training matrix, internal audit schedule and reports, corrective action log, supplier list, calibration list, legal register, complaint register.
- Check the system is not paused. Some records, such as monthly reviews or supplier evaluations, may be missing for recent weeks. Do not backfill records with false dates. Auditors can tell, and the consequences are worse than a gap.
- Plan the opening and closing meetings. Know who attends and who speaks.
On the day
Be open and orderly. If the auditor finds a nonconformity, ask to understand the requirement and the evidence rather than argue. Findings are normal; a good response afterwards matters more.
A worked example (invented)
A components manufacturer scheduled its stage 2 audit and, in week 6, followed a customer order from enquiry to dispatch. The inspection record existed, but the gauge used had no calibration label and the calibration register showed it overdue. The company calibrated the gauge, re-measured affected parts, added a pre-use check, and found two other gauges with the same gap. The finding was resolved quietly in preparation instead of appearing as a nonconformity at the audit. The company is invented, but this kind of find is why the process walk-through is worth the time.
What not to do
- Do not write procedures for the audit and discard them afterwards.
- Do not coach staff to give polished answers; auditors notice rehearsed language.
- Do not backdate records.
- Do not treat the certification body's consultant, if one was used, as a substitute for the company's own ownership; the certification body generally cannot provide consultancy to the same client, so ask them about their rules.
The takeaway
Preparation is not decoration. It is the work of making the written system and the real system the same. Use the eight weeks to find the gaps yourself, because the alternative is for the auditor to find them.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error