What actually happens in a stage one and a stage two audit
Both stages have objectives written into the rules that certification bodies themselves are audited against. Knowing what those objectives are turns the audit from something that happens to you into something you can prepare for precisely. Here is the whole thing, clause by clause.
The short answer
- Stage one asks whether you are ready. It reviews your documented system, checks your understanding of the standard, confirms your scope, and checks that internal audits and management review are planned and performed.
- Stage one must tell you where stage two is likely to find problems. The rules require its conclusions to record areas of concern that could be raised as nonconformities later. That is a free preview, and most clients never ask for it in those terms.
- Stage two asks whether it is real. It evaluates implementation and effectiveness, on site, against six specific areas.
- Majors must be closed before you can be certified. Minors need an accepted corrective action plan. That difference is the one that decides whether your certificate slips.
- The person who decides is not the person who audited you. That is a rule, not a courtesy, and it is why charming your auditor achieves nothing.
Stage one
What stage one is actually for
Stage one is commonly described as a documentation review. That undersells it and causes people to prepare for the wrong thing. The rules give it seven objectives, and only the first is about documents.
- Review your documented management system. The part everyone expects.
- Assess whether you are ready for stage two. A judgement, not a checklist.
- Check your status and your understanding of the standard. Whether you know what the requirements mean, not whether you can quote them.
- Gather the information needed to confirm scope. Sites, processes, equipment, and how control is exercised across them.
- Review your statutory and regulatory obligations. Which laws actually bind you, and whether you know.
- Agree the stage two arrangements with you and focus the planning. Stage one is what makes stage two targeted.
- Check that internal audits and management review are planned and performed. Note the word performed.
That last objective is where first time clients lose stage one most often. Internal audit and management review are not pre audit formalities you can run the week before. The rules have stage one specifically checking whether they have happened.
Stage one is not always entirely on site. The rules require only that it is planned so its objectives can be met, and that you are told in advance which activities will be on site. Stage two is different. It takes place at your site.
The useful bit
The free preview almost nobody asks for
This is the single most valuable thing in this article, and it is written into the rules.
Stage one has to produce documented conclusions, and those conclusions must cover three things: whether the stage one objectives were met, whether you are ready for stage two, and the areas of concern that could be classified as nonconformity during stage two.
Read that again. The certification body is required to tell you, in writing, where it expects stage two to find problems. That is a map of your likely findings, handed over before the audit that counts, with time to act on it.
Most clients file the stage one report and wait for the stage two date. The organisations that get through stage two cleanly treat that list as the only to do list that matters between the two stages, and they close every item on it with evidence rather than with intent.
Stage two
What stage two evaluates
Stage two evaluates implementation, including effectiveness. The distinction matters: a system can be fully implemented and still be judged ineffective if it is not achieving anything. The rules name six areas it must cover.
| Area | What the auditor is really testing | Where it usually goes wrong |
|---|---|---|
| Information and evidence of conformity | That the system described on paper is the system actually in use | Procedures written for the audit that nobody on the floor recognises |
| Performance against objectives and targets | That you set measurable objectives and know whether you met them | Objectives with no measure, or a measure nobody has looked at since |
| Statutory, regulatory and contractual compliance | That you know which obligations bind you and can show you meet them | A legal register copied from a template and never localised |
| Operational control of processes | That the controls described are applied in practice | Controls that exist in the office and not in the plant |
| Internal auditing and management review | That both happened, properly, and produced something | An internal audit that found nothing and a review with no decisions |
| Management responsibility for the policy | That leadership owns this rather than delegating it to a coordinator | A director who has not read the policy they signed |
Notice how few of these are about documents. Stage one is where documents are judged. Stage two is where the auditor talks to the people doing the work and traces claims back to evidence.
Readiness
Check your stage two readiness
Tick only what is genuinely true today, not what will be true by the audit. The check is built on the six areas stage two must cover.
What is actually in place
Tick what is true to see where stage two would press hardest.
Indicative only. Your certification body decides what it audits and how it grades what it finds.
If internal audit, management review or the records history are unticked, that is where to put the next few weeks. Those three are the hardest to recover late, because none of them can be created retrospectively without it being obvious.
Findings
Major, minor, and what each one costs you
The grading of a finding decides whether your certificate slips, so it is worth understanding what follows from each.
- Major
- Must be closed before certification can be granted. Not planned, not promised, closed and verified. There is also a hard outer limit: if the correction cannot be verified within six months of the last day of stage two, the certification body has to run another stage two before it can recommend you. A major also has to be reviewed by someone other than the auditors who raised it.
- Minor
- Needs an accepted corrective action plan, not completed action. The body reviews your plan, accepts it, and verifies the work later, often at the first surveillance audit. Minors do not usually delay the certificate. Several minors clustered in one area sometimes get reconsidered as a major, because together they suggest the process itself is not working.
- Opportunity for improvement
- No obligation attached. A suggestion. You do not have to act on it and it does not affect the decision. Treat it as free advice from someone who has seen a lot of systems.
Whatever the grade, the rules require the finding to be recorded against a specific requirement of the standard, with a clear statement and detailed objective evidence. If you receive a finding that does not name a clause or does not say what was actually seen, you are entitled to ask for both.
A boundary worth knowing
What your auditor is not allowed to do
When an auditor raises a nonconformity, the rules say they must not suggest its cause or how to solve it. People read that as unhelpfulness. It is not. It is the line that keeps certification independent: a body cannot audit a solution it designed itself.
Two practical consequences follow.
- Do not expect your auditor to consult. Asking what they would do puts them in an awkward position and they will decline. Analysing the cause and choosing the correction is your work, and the rules put it on you explicitly.
- Do expect precision. They must tell you the requirement and the evidence. That is enough to work from, and if it is missing you should ask.
This is also the honest answer to why a consultant and a certification body have to be different organisations, and it is one of the questions worth asking anyone you are considering hiring. We go through the others in how to choose an ISO consultant in Pakistan.
The decision
Who actually decides
The audit team does not grant your certificate. They make a recommendation. The decision is taken by people who meet two conditions: they have the right competence, and they are not the people who carried out your audit.
They work from a defined set of inputs: the audit report, your responses to any nonconformities, confirmation of the information in your application, confirmation that the audit objectives were met, and the team’s recommendation.
The audit report itself is a substantial document. The rules list eighteen things it must contain, including the scope and the dates, which activities were on site and which were not, the findings with their evidence, anything left unresolved, an explicit statement that the audit was based on sampling, and the team’s recommendation. The report belongs to the certification body, not to you, although you receive it.
The practical lesson is simple. Your certificate is decided from a document, by someone you will never meet, on the strength of recorded evidence. Build for the record, not for the room.
Preparation
How to prepare, honestly
- Before stage one
- Have the system written and running, and both mandatory activities done. Internal audit and management review are checked at stage one. Everything else at stage one is survivable. Those two are what gets a stage two date pushed back.
- Between the stages
- Work the stage one concerns list and nothing else. It is the certification body telling you where it expects to find problems. Close each item with evidence, and say so in writing before stage two.
- Before stage two
- Brief the people, not just the managers. Stage two talks to the people doing the work. They do not need to quote the standard. They need to be able to say what they do, where it is written down and what they do when it goes wrong.
- During stage two
- Answer what is asked, show the evidence, do not volunteer tours of unrelated areas. Being helpful and being expansive are different things. If you do not know, say you will find out and then find out.
- After stage two
- Treat majors as urgent and minors as scheduled. Get the cause analysis right rather than fast. A correction that treats the symptom will come back at surveillance.
If you are still working out how long all of this takes, we have set out which parts of the timeline are fixed by the rules and which are in your hands in how long ISO certification really takes.
Questions
Frequently asked questions
What is the difference between stage one and stage two?
Stage one asks whether you are ready. It reviews your documented system, your understanding of the standard, your scope and your legal obligations, and checks that internal audit and management review have been performed. Stage two evaluates whether the system is actually implemented and effective, on site, against six specific areas.
Can we fail stage one?
Stage one does not usually produce a pass or fail. It produces documented conclusions about your readiness. If you are not ready, stage two is deferred rather than failed, and the certification body may repeat all or part of stage one before proceeding.
Does stage one have to be on site?
Not necessarily. The rules require only that stage one is planned so its objectives can be met and that you are informed in advance of any on site activities. Stage two takes place at your site.
What is the difference between a major and a minor nonconformity?
In practical terms, a major has to be closed and verified before certification can be granted, while a minor needs an accepted corrective action plan that is verified later. If a major cannot be verified within six months of the last day of stage two, another stage two is required.
Will the auditor tell us how to fix a finding?
No, and they are not permitted to. The rules say an auditor must not suggest the cause of a nonconformity or how to resolve it. They must tell you which requirement was not met and what evidence they saw. Analysing the cause and choosing the correction is your responsibility.
Who decides whether we get the certificate?
Not the audit team. They make a recommendation, and the decision is taken by competent people who were not part of your audit, working from the audit report, your nonconformity responses and the team’s recommendation.
What is in the audit report?
The rules list eighteen required items, including the scope, dates and places with on site activity identified, the findings with their evidence, unresolved issues, a statement that the audit was based on sampling, and the team’s recommendation. The report is owned by the certification body, although you receive a copy.
How much evidence do we need before stage two?
Enough history that the auditor can see the system running rather than starting. Three months of records is a reasonable working minimum for most requirements, and anything with a monthly or quarterly cycle needs to have completed at least one of them.
Sources
- ISO/IEC 17021-1:2015, clause 9, for the stage one objectives and outputs, the stage two coverage, nonconformity handling, the audit report contents and the certification decision.
- The practical observations about where organisations lose stage one and stage two are our own project experience and are presented as experience, not as requirements.
Next step
Find the findings before the auditor does
A pre audit against the same six areas stage two has to cover is the cheapest way to know where you stand. You get the list of likely findings while there is still time to close them with evidence rather than with a plan.
Book a free consultationWhat it costs
We work with businesses across Pakistan, including Lahore, Karachi and Islamabad.