From system design to demonstrated operation
During stage 2, the certification body examines how the management system has been implemented and operates. Documents remain relevant, but their connection with practice matters: do people apply the agreed methods and evaluate results? NQA explains this stage in its certification process. Auditing uses sampling; it does not inspect every transaction or account.
Make evidence traceable
Connect evidence to the activity and period it supports. For access management, this could include a request, approval, configuration and subsequent review. For a recovery procedure, an actual exercise can show what worked, what failed and what improvement followed. A policy statement does not demonstrate that an activity took place. Equally, an isolated screenshot without context can be difficult to assess.
Arrange evidence access without unnecessarily distributing personal data or confidential customer information. Discuss viewing and redaction arrangements before the audit. Let the people involved explain their own processes; they do not need to recite wording from a standard. If evidence is unavailable, explain the limitation and its consequences instead of treating a planned check as a completed one.
Preparation that supports the audit
| Preparation | Purpose |
|---|---|
| Agree the audit agenda | Make the right process owners and locations available |
| Organise evidence | Present current records with clear context |
| Update open actions | Show implementation and limitations accurately |
| Follow up stage 1 | Demonstrate how areas of concern were addressed |
Fictional example: a recovery test with follow-up
A fictional service provider has a backup policy and performs a recovery test. Data is restored, but another system is needed to start the application. The test report describes that limitation, an owner updates the procedure and a follow-up test checks the complete chain. This sequence makes operation and improvement more understandable than a notification stating only that a backup was successfully stored.
Findings and the certification decision
At the closing meeting, clarify the findings, supporting evidence and next steps. Address nonconformities through corrective action. Classification and handling follow the certification body’s process; do not assume every finding has the same deadline or consequence. The audit result is not automatically the formal certification decision. The certification body, rather than ISO itself, issues the certificate.