Start with the audit assignment
Check which management system, standard edition, services and locations will be examined. Agree the agenda with the certification body and ask what information is needed beforehand. Initial certification may involve different assessment stages; the approach depends on the standard and certification process. NQA describes its management system certification process. Use that explanation as background and confirm the arrangements with your own body.
Demonstrate actual operation
Select records that help process owners explain their everyday work. Examples include decisions, completed checks, evaluations and follow-up of nonconformities. Connect these records to the agreed requirements. A procedure describes how a process should operate; an implementation record shows what happened in a specific case. Keep current and historical information distinct.
| Preparation | Practical check |
|---|---|
| Scope | Are boundaries and relevant dependencies clear? |
| Schedule | Are process owners available for their subjects? |
| Evidence | Are sources, periods and assessments traceable? |
| Open actions | Is completed work distinguished from outstanding work? |
| Access | Can authorised viewing happen without unnecessary disclosure? |
Prepare people to explain their work
Discuss the agenda and let staff know where relevant records are held. Practise explaining a real situation, including an exception or difficulty. Keep answers connected to facts. A rehearsed narrative does not help when actual operation is different. If an answer is uncertain, find the appropriate source or owner instead of guessing.
Fictional example: an open recovery action
A fictional service provider performs a recovery test and finds a missing system dependency. The change is scheduled but has not yet been tested. For the audit, the team gathers the original report, risk assessment and current action plan. It presents the action as outstanding. After implementation, another test is used to assess the result. This avoids describing a planned improvement as demonstrated operation.
Follow up the results
At the closing meeting, clarify findings and next steps. Record owners and deadlines, then evaluate the effectiveness of corrective action. The auditor and certification decision-maker have roles within the body’s process; preparation does not guarantee a certificate. ISO itself does not issue certificates. For ISO 27001, read about stage 1, stage 2 and evidence and documentation. Keep the agreed actions connected to the original finding so that their purpose remains clear during later reviews.