The ISO 9001 audit process
The audit is the moment of truth. An independent auditor from an accredited certification body checks whether your quality management system meets ISO 9001 and whether it works in practice. NEN publishes the official Dutch version of the standard. On this page you can read exactly what to expect.
An audit assesses not only documents, but above all whether your quality system works in practice. The auditor talks to employees at all levels.
The ISO 9001 audit process in brief
| Part | What happens? | Result |
|---|---|---|
| Stage 1 | Document review | Ready or not ready for stage 2 |
| Stage 2 | Implementation audit on site | Certification recommendation |
| Surveillance | Annual surveillance audit | Certificate retained |
| Recertification | Full reassessment in year 3 | Certificate renewed |
What types of ISO 9001 audit are there?
There are three types of external audit in the certification cycle:
| Type of audit | When | Purpose |
|---|---|---|
| Certification audit | First time | Assessing whether you comply and deserve a certificate |
| Surveillance audit | Annually (years 1 and 2) | Checking that you still comply |
| Recertification audit | After 3 years | Reassessing to renew the certificate |
You also have the internal audit: an audit you carry out yourself (or have carried out) to check your system. The standard requires this.
The ISO 9001 audit process step by step
The first audit consists of two stages:
Stage 1: Document review
The auditor assesses whether your documentation is in order and whether you are ready for stage 2.
What the auditor does:
- Reads the documentation (quality manual, procedures, policy)
- Assesses the context and scope
- Checks the internal audit and management review
- Reviews the risk assessment
How:
- Often remotely (the documents are sent to the auditor)
- Sometimes a short visit on site (half a day)
Result:
- Findings and comments
- Advice on whether you are ready for stage 2
- An indication of focus points for stage 2
Between stage 1 and stage 2 there is usually 1 to 4 weeks, so you can address any findings.
Stage 2: Implementation audit
The auditor visits your site to check whether your system works as described.
What the auditor does:
- Walks through the company
- Talks to employees (from management to the shop floor)
- Follows and observes processes
- Reviews records (orders, invoices, complaints, measurement data)
- Asks questions: “How do you do this?”, “Can you show me an example?”
How long:
- Small company: 1 day
- SME (MKB, small and medium-sized enterprise): 2 to 3 days
- Large company: 3 to 5 days or more
What the auditor wants to see:
- That you do what you say (processes match the documentation)
- That employees know what their role is
- That you measure and improve
- Evidence: records, reports, minutes
What does the ISO 9001 auditor assess?
The auditor checks all requirements of ISO 9001, but pays particular attention to:
Overall effectiveness
- Does your system work? Not only on paper, but in practice?
- Does it deliver results (customer satisfaction, quality)?
Context and leadership
- Do you understand your own organisation and environment?
- Is top management involved?
Processes
- Are your core processes under control?
- Do you measure the right things?
- Do you address nonconformities?
Improvement
- Do you improve continually?
- What do you do with complaints and nonconformities?
- What are the results of your internal audits?
What questions does the auditor ask under ISO 9001?
The auditor tests whether your system works in practice. They do this mainly with open questions and by asking to see an example. Below are questions that often come up, linked to the topic and the chapter of the standard.
| Topic | Example question from the auditor | Clause |
|---|---|---|
| Context | Which external factors affect your work? | 4.1 |
| Interested parties | Who are your most important customers, and what do they expect? | 4.2 |
| Policy | What does the quality policy say, and how do you contribute to it? | 5.2 |
| Risks | Which risks do you see, and what are you doing about them? | 6.1 |
| Objectives | What are your quality objectives, and how do you measure them? | 6.2 |
| Competence | What training have you had for this work? | 7.2 |
| Customer requirements | How do you know exactly what the customer wants? | 8.2 |
| Suppliers | How do you assess your suppliers? | 8.4 |
| Nonconformities | Can you show an example of something that went wrong and what you did about it? | 10.2 |
| Improvement | What has improved over the past year? | 10.3 |
The auditor is not looking for “right answers” but for evidence. Expect a follow-up question such as “can you show that?” for almost every answer. If you have your records to hand, the conversation runs smoothly.
Want to practise these kinds of questions internally? See the example questions for internal audits in the tools section.
Risk analysis in the ISO 9001 audit
The auditor wants to see that you think about what could go wrong and do something about it (chapter 6). A complicated risk matrix is not necessary, but you must be able to show your risks and measures.
A fully worked example and a step-by-step plan are on the page about risk management and risk analysis under ISO 9001. A blank template is in the tools.
Possible outcomes of the audit
After the audit you receive a report with findings. There are four categories:
| Category | Meaning | Consequence |
|---|---|---|
| Conformity | You meet the requirement | Good news |
| Observation | Improvement point, but not a nonconformity | Not required to fix, but advice |
| Minor nonconformity | You do not fully meet a requirement | You must fix it within 90 days |
| Major nonconformity | Serious shortcoming | Blocks certification, a re-audit is needed |
One or more minor nonconformities do not automatically mean you fail. You get time to fix them and provide evidence. Only once the auditor agrees is the certificate issued.
Examples of nonconformities
Minor nonconformity:
- Internal audit not fully carried out
- Quality objective not formulated in a measurable way
- A procedure description is missing
- A record is not complete
Major nonconformity:
- No internal audit carried out at all
- Management review entirely missing
- Structurally not meeting customer requirements
- No evidence that the system works
How do you prepare for an ISO 9001 audit?
Start with a document list: which documents the auditor wants to see in advance, and where they are kept. That makes the rest of your preparation more concrete.
Weeks before
- Check your documentation: is everything up to date? Does it match practice?
- Check your records: are there gaps? Missing signatures?
- Do a mock audit: go through the requirements yourself, or have someone else do it
Days before
- Brief employees: explain that an auditor is coming and what the purpose is
- Prepare the room: a place where the auditor can work
- Make sure documents are accessible: nothing is more irritating than searching during the audit
During the audit
- Be honest: do not try to hide what goes wrong
- Give concrete answers: “We do it like this…” with examples
- Ask for clarification: do not understand the question? Ask again
- Take notes: write down the findings
A common mistake is instructing employees to give “the right answer”. Auditors see through this. Honesty works better.
What if you fail the ISO 9001 audit?
With major nonconformities you do not receive a certificate. That is unpleasant, but it is not the end of the road.
What you can do:
- Analyse the findings: what went wrong?
- Make an action plan to resolve the nonconformities
- Carry out the actions
- Schedule a re-audit (often only on the problem areas)
Most organisations that fail pass the re-audit. It costs extra time and money, but it is not a disaster.
The annual surveillance audit
After certification the auditor returns every year. This surveillance audit is shorter than the initial audit, usually about half the time.
What the auditor checks:
- Whether you still comply
- What you have done with earlier findings
- Changes in your organisation
- Specific parts of the standard (not everything every year)
Tip: see the surveillance audit not as a “check”, but as an opportunity to get feedback. A good auditor gives valuable improvement points.
The ISO 9001 recertification audit after 3 years
After 3 years your certificate expires. To renew it, a recertification audit is required. This is similar to the initial audit, but often somewhat shorter because your track record counts.
How do you choose a certification body for ISO 9001?
Not every certification body is the same. Pay attention to:
Accreditation
Choose a body that is accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council). Without accreditation, your certificate is not recognised.
Experience in your sector
Some bodies have more experience in certain sectors. An auditor who knows your industry asks more relevant questions.
Costs
Compare quotes, but do not look only at price. The cheapest option is not always the best.
Approach
Some auditors are strict and formal, others more coaching. Ask about their approach.
Well-known certification bodies in the Netherlands:
The mandatory internal audit
Alongside the external audit, you must also audit yourself. The standard makes this mandatory. A full explanation of the annual planning, execution and reporting, and a checklist per chapter, is on the page internal audit under ISO 9001.
Who may carry out the internal audit?
Someone who:
- Is independent of the process being audited (you may not check your own work)
- Knows how to audit (training is recommended)
- Knows the standard
Options:
- A colleague from another department
- An external party (adviser, consultant)
- A contracted-in auditor
How often?
The standard does not say how often, but you must audit all parts of your system regularly. Most organisations run a full cycle every year.
What do you record?
- Audit plan (what, when, by whom)
- Audit report (findings)
- Actions arising from the findings
- Evidence that the actions were carried out
Frequently asked questions about the ISO 9001 audit
Am I allowed to be present during the audit? Yes, in fact it is recommended. Make sure someone accompanies the auditor.
What if an employee says something wrong? That can happen. Try not to correct it during the conversation. Make a note and discuss it with the auditor later if there is a misunderstanding.
How long will it take before I have the certificate? After a positive audit, usually 2 to 4 weeks. If there are nonconformities, it takes longer, depending on how quickly you resolve them.
Can I switch certification body? Yes, but it takes extra work. The new body must reassess your system.
Next step
Do you still have questions? See the frequently asked questions or go back to the overview of ISO 9001. Want to know how to deal with nonconformities the auditor finds? Then read how nonconformities and corrective actions under ISO 9001 work.