ISO Certification Audit Stage 1 vs Stage 2: What Each Audit Checks

Key Takeaways:

• An initial ISO certification audit always runs in two parts: Stage 1 checks whether the management system is ready to be audited, and Stage 2 checks whether it actually works.
• Stage 1 is mostly about design and readiness: scope, documented information, internal audit and management review. Its findings are warnings, not a verdict.
• Stage 2 is about evidence on the floor: records, interviews and observation across every process in scope.
• A major nonconformity at Stage 2 blocks the certificate until it is corrected and verified. Minor ones need an accepted corrective action plan.
• The gap between the two stages exists so that Stage 1 concerns can be fixed. Use it.

The iso certification audit stage 1 vs stage 2 question usually arrives a few weeks before the certification body does, when a quality manager is handed an audit plan and realizes there are two visits, not one. The two stages are not a rehearsal and a performance. They ask different questions, look at different evidence and end in different outcomes, and a plant that prepares for both the same way tends to be over-prepared for the first and under-prepared for the second.

This guide sets out what each stage checks, how auditors go about it, and what to have ready. It applies whichever management system standard is being certified, including the current ISO 9001:2026 and the 2015 edition that many certified plants are still transitioning from.

Why Certification Audits Come in Two Stages

Certification bodies do not choose the two-stage format; it is required of them. Accredited certification bodies are themselves audited against ISO/IEC 17021-1, the standard that governs how management system certification is carried out, and that standard requires an initial certification audit to be conducted in two stages. In Canada, the body that accredits them is the Standards Council of Canada, which is why it is worth confirming a certification body's accreditation before signing with one.

The logic is practical. Sending a full audit team to a site whose system is not ready wastes the client's money and produces a long list of nonconformities that helps nobody. Stage 1 exists to catch that early. It gives the lead auditor enough understanding of the operation to plan Stage 2 properly, and it gives the organization a clear list of what needs attention while there is still time to act.

Important: Stage 1 and Stage 2 together make up one initial certification audit. A certificate cannot be issued on the strength of Stage 1 alone, however well it goes.

What a Stage 1 Audit Checks

Stage 1 is a readiness review. The auditor is trying to answer one question: is this management system far enough along that a Stage 2 audit will be meaningful? To answer it, the auditor works through a fairly consistent set of topics.

• Documented information. The auditor reviews the documents the standard requires, such as the scope statement, the policy, objectives and the procedures the organization has decided it needs. For ISO 9001:2015, this draws on clause 4.3 for scope and clause 7.5 for documented information. A dedicated document control process makes this part quick, because current versions are easy to produce.
• Scope and boundaries. The auditor confirms what the certificate will cover: which sites, which products and services, which processes. Any requirement the organization claims does not apply has to be justified.
• Site conditions. A walk through the facility shows the auditor what Stage 2 will involve: shifts, hazards, outsourced processes and how large the audit sample needs to be.
• Understanding of the standard. Short conversations with managers show whether the people running the system know what its key processes, risks and objectives are.
• Internal audit and management review. The auditor checks that both have been planned and carried out. Under ISO 9001:2015 these are clause 9.2 and clause 9.3, and their records are the single best indicator of readiness.
• Legal and customer requirements. The auditor looks for evidence that applicable statutory, regulatory and customer requirements have been identified.

Stage 1 is often done on site for manufacturers, although certification bodies may carry out part of it remotely when the operation is simple. Either way, the output is a written report. It lists areas of concern, which are issues that would be raised as nonconformities if they were still present at Stage 2. They are not nonconformities yet.

That distinction matters. An area of concern carries no formal consequence, but it is a precise description of what the Stage 2 auditor will look for first.

What a Stage 2 Audit Checks

Stage 2 is the certification audit proper. The question changes from "is the system ready?" to "is the system implemented, and is it effective?" The audit takes place at the organization's site and covers every process within the scope.

Where Stage 1 leans on documents, Stage 2 leans on evidence gathered three ways: records, interviews and observation. An auditor will pick a job, a batch or a purchase order and follow it through the system, asking the people who did the work to show how it was done. The procedure is only the starting point. What counts is whether the work matches it and whether the result is what the system intended.

A Stage 2 audit normally examines:

1. Conformity with every applicable requirement of the standard, clause by clause, across the processes in scope.
2. Performance against objectives. The auditor looks at how results are monitored, measured and reviewed, and what happened when a target was missed.
3. Operational control. This is the largest part for a manufacturer: planning, purchasing, production, inspection, calibration, and control of nonconforming product.
4. Compliance obligations. The auditor checks the organization's ability to meet legal and contractual requirements, not legal compliance itself.
5. Internal audit and management review, now tested for substance. Were audit findings acted on? Did management review produce decisions?
6. Leadership. Top management is interviewed about the policy, the objectives and how the system supports the direction of the business.

The audit ends with a closing meeting where findings are presented. The audit team then makes a recommendation, and a separate person at the certification body, someone who was not on the audit team, makes the certification decision.

Stage 1 vs Stage 2 at a Glance

How Nonconformities Are Graded

Stage 2 findings are graded, and the grade decides what happens next.

A major nonconformity is one that affects the capability of the management system to achieve its intended results. Typical causes are a required process that is absent or has broken down, or a pattern of smaller failures that points to a systemic problem. A certificate is not issued while a major nonconformity is open. The organization has to correct it and address the cause, and the certification body has to verify that the fix worked, which can mean a follow-up visit. Certification bodies generally require this to be completed within about six months of the end of Stage 2. Past that point, a new Stage 2 is normally needed.

A minor nonconformity is a lapse that does not undermine the system as a whole, such as a single overdue calibration or one training record that cannot be found. For minors, the certification body needs to accept the organization's corrective action plan, and the auditor checks that it was carried out at the next visit.

Illustrative example: A 45-person machine shop in Kitchener passes Stage 1 with two areas of concern: the internal audit covered production but skipped purchasing, and management review had not yet been held. The shop uses the following five weeks to audit purchasing and hold the review, with minutes and actions recorded. At Stage 2 the auditor checks both first, finds them complete, and raises only one minor nonconformity for a gauge that was past its calibration date. The shop submits a corrective action plan and the certificate is issued.

Key Consideration: Treat a nonconformity as a requirement to fix a cause, not only a symptom. An auditor who sees a recalibrated gauge but no change to how calibration due dates are tracked will raise the same finding again.

How to Prepare for Each Stage

Preparation should follow the question each stage asks.

For Stage 1, the work is to have the system designed, documented and started. Complete at least one full internal audit cycle and one management review before the auditor arrives. Have the scope written down and be ready to justify any exclusion. A structured gap analysis at the start of the project is what makes this stage uneventful, because the gaps were found and assigned months earlier. A plant that wants an early read on where it stands can take the free readiness assessment before booking a certification body.

For Stage 2, the work is to have the system running long enough to leave a trail. Auditors need records to sample, and a system that went live the week before has none. Most certification bodies expect to see a few months of operating records. The second priority is people. Operators and supervisors will be asked how they do their work and where the instruction for it lives, so brief them on what to expect and on the fact that showing the auditor a document is a perfectly good answer.

Between the stages, close every area of concern from the Stage 1 report and keep evidence that each one was closed. Record keeping for internal audits and management review pays off here, because both are examined at both stages.

After Stage 2: The Certification Cycle

A certificate is valid for three years, and it comes with conditions. The certification body returns for surveillance audits, normally once a year, each covering part of the system. Before the three years end, a recertification audit reviews the whole system again and the cycle restarts. Customers can confirm that a certificate is genuine and current through IAF CertSearch, the international database of accredited certifications.

The practical point is that Stage 2 is not the finish. The disciplines that got the system through it, internal audit, corrective action and management review, are the same ones surveillance audits test every year. ISO's own overview of what ISO 9001 certification involves makes the same point: certification confirms a working system, and the system has to keep working.