Your First ISO Certification Audit: Stage 1 vs Stage 2, Explained Without the Jargon
Are you preparing for your first ISO certification audit and wondering what the auditor will actually ask? Does the difference between Stage 1 and Stage 2 sound like another layer of confusing certification language?
You are not alone. Many small businesses and start-ups feel nervous before their first audit, especially when they are balancing customers, deadlines and day-to-day operations.
The good news is that the Stage 1 vs Stage 2 ISO audit process is easier to understand than it first appears. Each stage has a clear purpose, and neither is designed to catch you out. Together, they help an independent certification body check that your management system is documented, implemented and delivering the results you intended.
This guide explains what happens at each stage, how far apart they usually sit, what auditors look for and how to avoid the most common problems.
Why are there two stages?
A certification body uses two stages for an initial ISO certification audit because it needs to understand your business before making a certification decision.
The ISO 9001 Auditing Practices Group guidance on two-stage initial certification audits explains that Stage 1 helps the auditor understand your organisation, management system, processes, scope and readiness for Stage 2.
In simple terms:
Stage 1 asks: “Is your management system ready to be fully assessed?”
Stage 2 asks: “Is your management system working effectively in practice?”
This approach applies to standards such as ISO 9001 for quality management and ISO 27001 for information security management, although the evidence examined will differ.
Stage 1: Confirm your readiness
Stage 1 is often called the readiness review, documentation review or preliminary audit. It is not usually the point at which you receive or fail to receive certification.
The auditor is checking whether your system is sufficiently developed to move forward to Stage 2. They will review your documented information and assess whether your business has begun using the system rather than simply writing it.
What happens during Stage 1?
Your auditor may review:
The proposed scope of your certification
Your business context and relevant interested parties
Policies and objectives
Key processes and responsibilities
Risk assessments and planned controls
Applicable legal or regulatory requirements
Internal audit arrangements
Management review arrangements
Evidence that the system is being introduced and used
The locations, people and activities included in the audit
For ISO 9001, this could include your approach to customer requirements, operational controls, supplier management, complaints and improvement.
For ISO 27001, the review may include your information security scope, risk assessment, risk treatment plan, Statement of Applicability, policies and security controls.
The auditor may also speak with key members of your team. This is not an interrogation. They are trying to understand how your system works and whether the planned Stage 2 audit can be completed effectively.
What does Stage 1 produce?
At the end of Stage 1, you should have a clearer understanding of:
Any gaps or concerns that need attention
Whether the proposed certification scope is accurate
Which parts of the business the auditor will sample at Stage 2
What evidence you need to make available
The planned timing and focus of Stage 2
Think of Stage 1 as an early warning system. It gives you an opportunity to correct weaknesses before the full certification audit.
That is valuable for a small business. Finding a gap early is far better than discovering it when the auditor is testing the system in real-world conditions.
Stage 2: Test implementation and effectiveness
Stage 2 is the full certification audit. This is where the auditor examines whether your management system is operating as planned and meeting the requirements of the relevant ISO standard.
The focus moves from “What have you documented?” to “What do you actually do, and can you show that it works?”
What happens during Stage 2?
Your auditor may:
Interview business owners, managers and employees
Follow processes from beginning to end
Review completed records and evidence
Observe how work is carried out
Check training and competence records
Examine customer feedback or complaints
Review supplier and purchasing controls
Test corrective actions
Assess objectives and performance measures
Review internal audit findings
Examine management review outputs
Check that risks are being managed
Compare your documented procedures with actual practice
For ISO 9001, the auditor may follow a customer order through quoting, delivery, feedback and after-sales support.
For ISO 27001, they may examine how you manage access, incidents, assets, suppliers, backups, staff awareness and information security risks.
The central question is consistency. If your procedure says that customer complaints are recorded, can you show the records? If your information security policy says access is reviewed regularly, can you demonstrate that the reviews take place?
That is what effectiveness means in practical terms.
How far apart are Stage 1 and Stage 2?
There is no single timetable that applies to every organisation. The gap depends on:
The size and complexity of your business
The scope of certification
The number and seriousness of Stage 1 findings
How long your system has been operating
The availability of your audit team and certification body
How quickly you can provide evidence and complete corrective actions
For many small businesses, Stage 2 takes place several weeks or a few months after Stage 1. This gives you time to address findings, complete planned activities and build a useful body of records.
The important point is not to treat the gap as a holiday from your management system. Use it actively.
Between the two stages, you should:
Correct the issues raised at Stage 1
Complete your internal audit
Hold your management review
Make sure key processes are operating consistently
Gather records in an organised way
Brief staff on their responsibilities
Confirm that your certification scope remains accurate
If too much time passes or your business changes significantly, the certification body may need to revisit readiness before proceeding. Confirm the expected timetable directly with your certification body.
The most common reasons small businesses stumble between the stages
1. The system exists on paper but not in daily work
This is one of the most common problems. A business creates policies and procedures, but employees continue working in the old way.
Your documents should reflect how your business genuinely operates. Avoid creating an impressive-looking system that nobody uses.
2. Internal audits are left until the last minute
An internal audit is not a box-ticking exercise. It is your opportunity to test your own system before the certification auditor does.
A rushed internal audit may fail to identify important gaps. It may also leave you without enough time to correct them.
3. Management review is treated as a meeting with no outcomes
Your management review should demonstrate that leadership understands system performance and is making decisions.
Useful outputs may include:
Actions to improve processes
Decisions about resources
Responses to recurring problems
Changes to objectives
New risks or opportunities
Follow-up on previous actions
4. Corrective actions are vague
“Staff reminded” is rarely enough on its own. A strong corrective action explains:
What went wrong
Why it happened
What will prevent it happening again
Who is responsible
When the action will be completed
How you will check that it worked
5. Employees do not understand their role
Your team does not need to memorise the ISO standard. However, they should understand the parts relevant to their work.
They should be able to explain:
What they are responsible for
Where they find current procedures
What records they complete
What they do if something goes wrong
Who they report issues to
6. The certification scope is inaccurate
Your scope should clearly describe the activities, services, sites and information covered by your management system.
A scope that is too broad may create unnecessary work. A scope that is too narrow may fail to represent what your business actually does.
How to arrive at Stage 1 fully prepared
Preparation is not about trying to predict every question the auditor might ask. It is about knowing your business, understanding your risks and being able to demonstrate that your system is practical.
Before Stage 1, check that:
Your policies are approved and current
Your certification scope is clear
Responsibilities are assigned
Your key processes are documented
Relevant risks have been assessed
Objectives are measurable and monitored
Internal audit activity is planned
Management review is scheduled
Staff understand the system
Records can be located quickly
Expertise can help you prepare through our ISO 9001 Document Readiness Review, which includes a documentation review and gap analysis.
If you are preparing for information security certification, our ISO 27001 Document Readiness Review can help you identify documentation weaknesses before the certification process moves forward.
You can also use our Pre-Audit Consultation for practical advice on preparing your business systems for ISO 9001 or ISO 27001.
Stage 1 vs Stage 2 ISO audit: the simple comparison
Area | Stage 1 | Stage 2 |
Main purpose | Check readiness | Confirm certification compliance |
Primary focus | Documentation, scope and planning | Implementation and effectiveness |
Auditor asks | “Is the system ready?” | “Does the system work in practice?” |
Evidence | Policies, processes, risks and plans | Records, interviews, observations and results |
Outcome | Findings, readiness assessment and Stage 2 plan | Audit findings and certification recommendation |
Certification decision | Not normally made here | Based on the Stage 2 outcome and certification review |
You do not have to face your first audit alone
Your first certification audit may feel unfamiliar, but it should not feel mysterious. Stage 1 gives you a structured opportunity to identify and address gaps. Stage 2 confirms whether your management system is genuinely part of the way your business operates.
The strongest preparation is practical preparation. Build a system your people can use, keep evidence as you work and deal with problems honestly and promptly.
Expertise supports small businesses and start-ups with ISO set-up, gap analysis, internal audit support and ISO auditing for ISO 9001 and ISO 27001. Our team of experts can help you understand what is required and move towards certification with greater confidence.
Do not wait until the certification audit is booked to discover a problem. Get in touch with Expertise today and take the next step towards a well-prepared, effective management system.
Sources
Comments