How to prepare for an ISO 9001 certification audit

How the certification audit works

Certification is carried out by an independent certification body, ideally one accredited by UKAS. It happens in two stages:

• Stage 1 (readiness review): the auditor checks your scope, your documented information and whether you are ready for the main audit. Gaps found here are raised so you can fix them before Stage 2.
• Stage 2 (certification audit): the auditor tests whether the system is actually working, by interviewing people, sampling records and following processes from start to finish.
• After certification: surveillance audits, usually every year, and a full recertification audit every three years.

The evidence auditors ask for

Most findings at small businesses come from missing evidence rather than missing processes. Before Stage 1, check you can show:

• The context of the organisation: internal and external issues, interested parties and their requirements (clauses 4.1 and 4.2).
• The scope of the management system, including any requirements that do not apply and why.
• A quality policy and measurable quality objectives, with progress tracked.
• Risks and opportunities, and the actions you have taken on them.
• Competence records: who needs which skills, and the training that proves it.
• Control of documents: current versions, approvals, and how old versions are withdrawn.
• Supplier evaluation and monitoring.
• Customer feedback and satisfaction.
• At least one full cycle of internal audits covering the whole scope.
• Nonconformities with root cause and corrective action, followed through to closure.
• A management review, minuted, covering every input the standard lists.

A 90-day preparation plan

• Days 1 to 30: confirm your scope, update the context, interested parties and risks, and check every document is current and approved.
• Days 31 to 60: run internal audits of every process and clause in scope. Raise nonconformities honestly; an auditor trusts a system that finds its own problems.
• Days 61 to 80: close corrective actions, with evidence of the root cause and of the fix working.
• Days 81 to 90: hold the management review, then brief the people the auditor is likely to interview on where things are and how they do their job.

What changes with ISO 9001:2026

ISO 9001:2026 was published on 16 September 2026, with a transition period of around three years for organisations certified to the 2015 version. The structure is familiar, but there is more emphasis on quality culture and ethical behaviour led from the top, on planning and reviewing changes, on managing organisational knowledge, and on risks and opportunities. Climate change, added to clauses 4.1 and 4.2 by the 2024 amendment, needs to be considered where it is relevant to your context.

If your certification body has not yet told you when they will audit you to the new version, ask them: most plan the transition at a surveillance or recertification visit.

Common reasons for nonconformities

• Internal audits that did not cover the whole scope, or were done by someone auditing their own work.
• Corrective actions closed without evidence that the root cause was addressed.
• Training records that do not match the competence the role needs.
• A management review that skipped required inputs, such as supplier performance or the results of audits.
• Documents in use that are not the approved version.

Frequently asked questions