What Happens During an ISO Certification Audit? Stage 1, Stage 2 and Beyond

Stage 1 is a readiness review. The certification body checks that management system documentation exists, covers the intended scope, and that the business is genuinely prepared for a full assessment. Significant gaps identified here are usually raised before Stage 2 proceeds, giving the business a chance to address them.

Stage 2 is the main assessment. The auditor examines evidence that the system is implemented and operating in practice - typically through site visits, staff interviews, and sampling records - rather than reviewing documents in isolation. This is where the difference between a system that exists on paper and one that is genuinely followed becomes apparent.

Following certification, surveillance audits are carried out periodically, usually annually, to confirm the system continues to operate effectively between full assessments. These are generally narrower in scope than the original Stage 2 audit but still involve site visits and evidence sampling.

A full recertification audit takes place at the end of the three-year certification cycle, reassessing the whole system against current requirements, including any changes to the standard itself since the original certification.

Throughout this process, findings are categorised by severity. Understanding this distinction matters, since it determines what response is expected and how quickly.