Introduction
Organizations preparing for certification often treat Stage 1 and Stage 2 as the same audit split into two visits, and that misunderstanding is responsible for more failed or delayed certifications than almost any other factor.
The two stages ask fundamentally different questions - Stage 1 asks whether the system is ready to be audited at all, Stage 2 asks whether it actually works - and preparing for the wrong question wastes both the organization's time and the auditor's.
Tip: Arrange an independent review of management system documentation before Stage 1 to identify gaps early and avoid preventable audit findings.
Statutory Role of Stage 1 Reviews
Stage 1 confirms the management system's documentation exists and addresses the standard's requirements, without yet testing whether that documentation reflects real operational practice.
The auditor evaluates the organization's understanding of the standard's requirements relative to its specific context, operations and scope, flagging any fundamental misalignment before Stage 2 is scheduled.
Site-specific conditions relevant to the audit - number of shifts, physical layout, regulatory context - are assessed to inform how Stage 2 should actually be planned and resourced.
Internal audits and management review must have been conducted at least once before Stage 2 can proceed, and Stage 1 is where this is verified, not assumed.
Stage 1 findings are typically communicated as gaps requiring attention before Stage 2, rather than as formal nonconformities in the way Stage 2 findings are classified.
A Stage 1 outcome indicating the organization isn't ready should delay Stage 2 scheduling rather than proceeding on an optimistic assumption that gaps will somehow resolve themselves in the interim.
Evaluating Operational Reality in Stage 2
Auditors sample actual records, interview staff away from management oversight, and observe live operations rather than relying on documentation review alone.
Evidence of implementation is expected across a full operating cycle, not merely since the Stage 1 visit, since a system built hastily between the two stages is usually easy to identify.
Staff at the operational level, not only management, must demonstrate genuine understanding of how the system affects their specific role.
Consistency between what different staff members say about the same process is scrutinized, since conflicting explanations of a documented procedure signal the system isn't genuinely embedded.
The effectiveness of corrective actions from any prior internal findings is assessed, not just their existence in a tracking log.
Takeaway: Stage 2 auditors are testing whether the system would keep functioning correctly if no one knew an audit was happening. A system that only works when everyone is on their best behavior for the auditor's visit is not yet a management system in the sense the standard requires.
No Internal Audit Conducted Under Clause 9.2
The standard requires internal audits to be planned and conducted at defined intervals covering the full management system scope, not performed once and never repeated.
Internal auditors need demonstrable competence and independence from the areas they audit, since self-auditing one's own work undermines the exercise's value.
Internal audit findings should be documented with the same rigor expected of an external audit, including objective evidence rather than general impressions.
An internal audit program that exists on paper but has never actually been executed is functionally equivalent to having no internal audit program at all, from the external auditor's perspective.
Internal audit scope must genuinely cover every clause and process area relevant to certification, not just the areas management considers most important.
Lack of Management Review Under Clause 9.3
Management review requires specific defined inputs - audit results, customer feedback, nonconformity trends, performance against objectives - not a general discussion without supporting data.
Outputs from management review should include decisions and resource allocations, demonstrating the review actually influenced organizational action rather than being a documentation exercise.
A management review conducted once, shortly before the audit, rather than at the planned interval the organization itself documented, signals the process isn't genuinely embedded in how the organization operates.
Review minutes lacking any connection to the specific data inputs the standard requires are a frequent and avoidable finding.
Consultant Built System but Staff Unaware
Documentation reads fluently and comprehensively, but staff interviewed about the same procedures give answers inconsistent with what's written.
Process owners can't explain why a particular control exists, only that it's documented, suggesting it was designed externally rather than from genuine operational understanding.
Records required by the documented system are incomplete or missing, because staff were never genuinely trained to maintain them as part of daily work.
The system reflects generic best-practice language rather than the organization's actual terminology and processes, a clear signal of a templated implementation.
When auditors ask staff to locate a record or demonstrate a step, repeated hesitation or need to consult someone else indicates the system isn't genuine operational knowledge.
A consultant-built system isn't inherently a problem, but one built without genuine staff involvement and ownership almost always fails Stage 2 or surfaces major findings.
Major Nonconformity vs Minor Nonconformity Criteria
A major nonconformity typically represents a complete absence of a required process, a systemic failure affecting the system's overall ability to achieve its outcomes, or a situation posing significant risk.
A minor nonconformity typically represents an isolated lapse that doesn't undermine the system's overall capability.
Multiple related minor nonconformities in the same area can collectively be reclassified as major, reflecting a systemic rather than isolated issue.
Classification affects timing directly - a major nonconformity generally must be closed with verified effectiveness before certification is recommended, while minor ones are typically addressed with a plan reviewed at the next audit.
Auditors apply consistent, defensible classification criteria, and an organization disagreeing can raise it through the certification body's formal appeal process rather than disputing it informally.
Navigating the 90-Day Corrective Action Window
The corrective action should address root cause, not just the symptom observed, since a symptom-only fix often results in the same finding recurring at the next audit.
Evidence of effectiveness, not merely evidence the action was implemented, is what certification bodies look for when reviewing closure submissions.
Missing the closure window typically delays the certification decision further, and can require an additional on-site visit rather than a desk-based document review.
Organizations should treat the window as a deadline for demonstrated, verified effectiveness, not simply for submitting a written plan.
Clear, early communication with the certification body about progress generally produces a more collaborative outcome than silence until the deadline approaches.
Remote Assessment Boundaries Under IAF MD 4
Remote assessment is permitted where the certification body can demonstrate audit objectives can still be reliably met using the proposed technology and approach.
Certain activities - observing physical processes, assessing environmental conditions, verifying controls dependent on physical presence - are generally poor candidates for remote assessment.
A documented risk assessment should justify conducting any portion of an audit remotely, rather than remote assessment being adopted purely for scheduling convenience.
Technology and connectivity reliability at the audited site must be confirmed in advance, since a remote audit disrupted by poor connectivity can compromise validity.
A blended approach - combining remote and on-site elements within a single audit - is common and often the most practical way to balance thoroughness against logistics.
Operational Complexity Metrics Driving Mandays
Headcount within the certification scope, including relevant contract and shift-based staff, is a primary driver of audit duration.
Number of sites included in the certification scope, and the extent to which processes are consistent or vary meaningfully across them.
Complexity and risk profile of the organization's processes, products or services relative to the standard's requirements.
Number of significant interested parties, regulatory requirements or external dependencies the system must address.
Evidence of integration with other management systems, which can in some cases reduce combined audit time relative to running fully separate audits.
Securing Formal Lead Auditor Recommendation
Ensure internal audits and management review have been genuinely conducted and documented before scheduling Stage 1.
Use Stage 1 findings as a genuine readiness check, addressing identified gaps before Stage 2 rather than hoping they resolve on their own.
Confirm staff at every operational level can demonstrate working knowledge of the system relevant to their role, not only management.
Maintain complete, accessible records across a full operating cycle ahead of Stage 2.
Respond to any nonconformities with root-cause corrective action and genuine evidence of effectiveness, not a documentation-only response.
Close major nonconformities within the certification body's defined window, with verified effectiveness.
Cooperate transparently with the lead auditor's requests for evidence throughout both stages.
A positive recommendation then proceeds through the certification body's independent technical review before the certificate is formally issued.
How Pacific Certifications can help?
Pacific Certifications can provide:
Stage 1 documentation and certification-readiness audits
Stage 2 implementation and effectiveness audits, combining on-site and remote assessment where justified under IAF MD 4
Clear, defensible classification of nonconformities with guidance on corrective action expectations
Annual surveillance audits and triennial recertification audits
Pacific Certifications conducts impartial certification audits and does not design, implement or manage management systems for its certification clients, preserving the independence the certification decision depends on.
Contact Us
To schedule your ISO certification, contact us at support@pacificcert.com or +91-8595603096.
For training programs on ISO certification requirements and preparation, contact us at trainings@pacificcert.com.
Read More at: ISO audit process from Stage 1 to recertification
