Stage 1: are you ready to be audited?
It is a documentation review, sometimes remote, of one or two days. The auditor checks that the system exists: defined scope, policy, risks, objectives, at least one internal audit and one management review done, and documented information under control. If large gaps appear, you do not move to Stage 2 until they are closed. It is not an audit of results; it is an audit of readiness.
The typical Stage 1 mistake: arriving without the internal audit or the management review. Without them, the system has not completed a full cycle and the auditor cannot continue.
Stage 2: does the system actually work?
Two to six weeks later, on site. The auditor walks the processes, interviews people and samples records: asks for three random production orders and follows their trail, opens an operator's training record, reviews how the last complaint was handled. The auditor compares what the company says it does (the documents) with what it does (the evidence). At the end comes a certification recommendation, with or without findings.
How a finding is written
A well-written finding has three parts, and knowing them lets you rehearse them beforehand:
- Criterion: what the standard or your own procedure requires. “Only the current version available at the point of use.”
- Evidence: what the auditor saw, with date and place. “Two printed copies of version 1 on the shop floor; version 3 is current.”
- Statement: the nonfulfilment, in one sentence. “Availability of the current version of the cutting procedure is not ensured.”
If one of the three is missing, the finding is debatable. If all three are there, the only thing left is to close it properly.
Major, minor and observation
- Major nonconformity: a whole requirement is missing, or there is a systematic breach, or something affects the system's ability to deliver what it promises. It blocks the certificate until you prove closure, usually with an additional verification.
- Minor nonconformity: a one-off breach that does not compromise the system. The certificate is issued with an accepted action plan; closure is verified at the next surveillance audit.
- Observation or opportunity for improvement: not a breach, a warning. Worth addressing because it tends to become a minor the following year.
How a nonconformity is closed
With four things, in this order: the correction (fix the specific case), the root cause analysis (why it happened), the corrective action (what changes so it does not recur) and the evidence it was done. “Train the staff” without a root cause is the answer no auditor accepts.
The Ark of ISO rehearses both stages before the real one: it walks your system, writes findings with criterion, evidence and statement, and helps you close them. When the real auditor arrives, you already know the script.