The initial audit: from stage 1 to stage 2
The initial audit is the first full certification audit, in which you obtain your certificate for the first time. An independent auditor from an accredited certification body checks whether your management system meets the standard and whether it works in practice. This happens in two stages: stage 1 (documentation) and stage 2 (implementation).
This structure is the same for most management system standards, such as ISO 9001, ISO 27001 and ISO 14001. The certification body must be accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) , which assesses it against the international audit standard ISO/IEC 17021 . On this page, we explain the initial audit independently of any specific standard.
The difference between stage 1 and stage 2
The initial audit always consists of two steps. Stage 1 checks whether your paperwork is in order and whether you are ready for stage 2. Stage 2 checks whether you do in practice what you have written down.
| Stage 1: documentation review | Stage 2: implementation audit | |
|---|---|---|
| Purpose | Ready for stage 2? | Does the system work in practice? |
| Focus | Documentation and design | Execution and effectiveness |
| Location | Often remote | On site |
| Result | Go or no-go for stage 2 | Recommendation for certification |
The process step by step
Stage 1: documentation review
The auditor checks whether your documentation is complete and whether you understand what the standard requires. The aim is not to look for nonconformities, but to establish whether stage 2 makes sense.
What the auditor does:
- Reads your policy, procedures and manual
- Assesses your context and scope
- Checks whether the internal audit and management review have been carried out
- Reviews your risk assessment
This often takes place remotely. Usually there is 1 to 4 weeks between stage 1 and stage 2, so you can address any points of attention.
Stage 2: implementation audit
The auditor visits the site and checks whether your system works as described. This is the substantive audit.
What the auditor does:
- Walks through the organisation
- Talks with employees, from management to the shop floor
- Follows and observes processes
- Reviews records (orders, complaints, measurement data, logs)
- Asks questions such as “How do you do this?” and “Can you show me that?”
The auditor is not looking for good answers, but for evidence. If your records are at hand, the conversation runs smoothly.
How long does the initial audit take?
The lead time depends on the number of audit days, and that in turn depends on your number of employees and the complexity of your organisation. The number of audit days is set according to guidelines from the Global Accreditation Cooperation (GAC, formerly IAF) .
As a rough indication for stage 1 and stage 2 together:
| Organisation size | Audit days (stage 1 + 2) |
|---|---|
| Small (1-25 FTE) | 2-4 days |
| Medium-sized (25-100 FTE) | 4-8 days |
| Large (100+ FTE) | 7+ days |
The exact number differs per standard and per certification body. You can find the precise ranges and costs on the costs page.
The possible outcomes
After the audit, you receive a report with findings. These fall into four categories.
| Outcome | Meaning | Consequence |
|---|---|---|
| Conforming | You meet the requirement | Good news |
| Observation | Point for improvement, not a nonconformity | Advice, not mandatory |
| Minor nonconformity | You do not fully meet a requirement | Resolve within an agreed deadline |
| Major nonconformity | Serious shortcoming | Blocks certification until resolved |
A minor nonconformity does not mean you fail. You get time to resolve it and provide evidence. Only when the auditor agrees is the certificate issued. A major must be fixed before certification follows, sometimes with an additional audit.
An example of a minor: the internal audit was carried out, but not covering all parts. An example of a major: no internal audit was carried out at all, or the management review is missing entirely. You will find more examples, deadlines and a template for your response on major and minor nonconformity.
How do you prepare?
Good preparation prevents nonconformities and stress. The most important points:
- Check your documentation. Is everything up to date and does it match practice?
- Check your records. Are there gaps or missing signatures?
- Carry out an internal audit. Test your own system before the external auditor arrives.
- Brief your employees. Explain that an auditor is coming and what the purpose is.
Common mistake: instructing employees to give the “right answer”. Auditors see through that. Honesty works better and gives you useful feedback.
After the initial audit
If you pass, your certificate is valid for three years. After that, the auditor returns every year for a shorter surveillance audit, and after three years comes recertification. You can read how that cycle works on surveillance audit and recertification.
Want to keep your system in good shape after the initial audit? Read how to plan and carry out internal audits and how the mandatory management review works. Want to read about the audit process for your specific standard? See the ISO 9001 audit, the ISO 27001 audit or the ISO 14001 audit. Not yet chosen a certification body? Read choosing a certification body.