What does stage 1 examine?
Stage 1 is the first part of an initial certification assessment. The certification body examines the management system’s boundaries and preparation to support planning for stage 2. It is neither a separate certificate nor a guarantee that stage 2 will produce no nonconformities. NQA describes the two stages in its certification process. Agree the specific agenda and requested information with your chosen body.
Prepare connections, not a document pile
Start with a clear scope. Show which services, locations and dependencies are included. Connect those boundaries to the risk assessment and selected controls. Make sure staff can identify current versions and explain how records relate to everyday work.
Show implementation as well: which checks have taken place, which results have been reviewed and which improvements remain open? Be transparent about the status of internal audit and management review. An empty template shows an intended method; a completed record can demonstrate how that method has been used. Explain limitations instead of presenting planned activities as completed work.
Check these connections before assessment
| Topic | Practical check |
|---|---|
| Scope | Do the boundaries match actual service delivery? |
| Risks | Has the assessment method been applied to relevant situations? |
| SoA | Are control selection and implementation status supported? |
| Evaluation | Are audit and management review results available? |
| Planning | Are responsible people and evidence locations known? |
Fictional example: an outsourced service desk
A fictional SaaS provider includes its application in scope but has not considered its outsourced service desk in the risk assessment. Preparation reveals that the supplier can reset customer accounts. The organisation clarifies this dependency, assesses the risks and documents relevant agreements and checks. This requires substantive work; simply adding “service desk” to a document does not supply the missing assessment.
Address results before the next stage
Discuss each area of concern with the certification body: what is expected, what evidence is needed and how does it affect scheduling? Track actions and owners. Do not assume a universal correction deadline or mandatory waiting period; the circumstances and arrangements with the body matter. Then read what the stage 2 audit examines. ISO does not issue certificates itself; certification bodies carry out that work.