Third-Party ISO Certification Audits: Stage 1 vs Stage 2 Evaluation and Preparation
A Stage 1 audit evaluates whether your management system is ready for the main certification assessment. A Stage 2 audit evaluates whether that system has been implemented effectively and meets the applicable requirements. Together, the two stages make up the initial certification audit used by most management system certification schemes.
The distinction looks simple on paper, yet it catches many first-time applicants off guard. Some teams treat Stage 1 as a formality and reach Stage 2 with gaps the auditor flagged months earlier. Others assume that finishing one stage guarantees the next. Neither assumption is safe. Each stage has its own objectives, evidence and outcomes, and neither one delivers a certificate automatically.
This guide walks through the full ISO certification process. You will learn what happens in each stage, what auditors check, which documents and records matter, how long the gap between stages can be, what drives ISO certification cost and timeline, and how to prepare. It explains Stage 1 audit requirements and Stage 2 audit requirements in plain language. You will also find checklists, a comparison table, practical examples and answers to common questions.
A note on scope: this page covers management system certification, such as quality, environmental, information security and occupational health and safety systems. It does not cover product certification or regulatory approval, which work differently and carry different requirements.
What Is an ISO Stage 1 Audit?
An ISO Stage 1 audit is the first part of the initial certification audit. Its job is to review your documented management system, understand your organization and site conditions, and decide whether you are ready for Stage 2.
ISO/IEC 17021-1, the international standard for bodies that audit and certify management systems, requires the initial audit to run in two stages. Stage 1 audit requirements come from the standard and from your certification body’s procedures, and they focus on readiness rather than full proof of performance. Stage 1 gives the auditor a clear picture of your system before the full assessment begins. It also gives you early warning of problems while there is still time to fix them.
During Stage 1, the auditor typically:
- Carries out an ISO documentation review: the policies, procedures and records your standard requires you to maintain.
- Confirms scope and context: the activities, products, services, locations and processes your system will cover.
- Evaluates site conditions: how your facilities, resources and operations support the system.
- Discusses readiness with your people: conversations with management and key staff show whether they understand the requirements.
- Checks internal audit and management review: whether both are planned and carried out to a level that shows readiness.
- Plans Stage 2: the auditor gathers what the certification body needs to size and schedule the main audit.
Stage 1 ends with documented conclusions on whether the Stage 1 objectives were met and whether you are ready for Stage 2. The auditor also names any areas of concern that could become nonconformities later. The certification body must share these conclusions with you before Stage 2 begins.
What happens during a Stage 1 audit?
Expect an opening meeting, a documentation review, interviews, a walk-through of key areas and a closing discussion of the results. Many certification bodies run part or all of Stage 1 remotely when their rules and the circumstances allow it.
What Is an ISO Stage 2 Audit?
An ISO Stage 2 audit is the main assessment of your management system, and it is the core ISO management system audit in the certification process. Stage 2 audit requirements go further than Stage 1 because the system must now work in practice. The auditor gathers evidence that your system is implemented, operating effectively and meeting the requirements of the standard you want certified against.
Stage 1 asks, “Is the system designed and prepared properly?” Stage 2 asks, “Does it work in daily practice?” To answer, the audit team looks beyond documents. They watch work being done, question the people doing it and test records against what your procedures say should happen.
A typical Stage 2 audit includes:
- Implementation assessment: evidence that each requirement of the standard is met in practice.
- Operational evidence: observation of processes, equipment, services and controls in operation.
- Employee interviews: questions that test awareness, competence and understanding of responsibilities.
- Process evaluation: how processes interact, are controlled and are measured.
- Records review: samples of records that prove activities took place as planned.
- Audit conclusions: a closing meeting, a report of findings and a recommendation to the certification body.
What happens during a Stage 2 audit?
The audit team opens with a meeting to confirm scope and plan, then audits processes across the sites and functions in scope. They record findings as they go. A closing meeting presents the results, including any nonconformities, and explains what happens next. Remote techniques may support some activities, but auditors still need reliable evidence of how work happens.
What is the difference between Stage 1 and Stage 2 audits? Stage 1 vs Stage 2 Audit: Key Differences
Stage 1 checks readiness and gathers planning information. Stage 2 checks implementation and effectiveness. Stage 1 asks whether you are prepared. Stage 2 asks whether the system performs as required.
Aspect | Stage 1 audit | Stage 2 audit |
Purpose | Confirm readiness for the main assessment | Confirm implementation and effectiveness |
Timing | First, once the system is documented and running | After Stage 1 concerns are resolved and the certification body agrees you are ready |
Audit focus | Documented information, scope, context, planning, readiness | Operations, controls, competence, performance, conformity |
Evidence | Documents, discussions, site conditions, status of internal audit and management review | Observed activities, interviews, records and performance data |
Site activities | Often lighter; may be partly or wholly remote where allowed | Broader; covers sites, functions and processes in scope |
Outcome | Documented readiness conclusions and areas of concern | Findings, a nonconformity list if any, and an audit recommendation |
Follow-up | Fix concerns before Stage 2; the certification body may adjust the plan | Address nonconformities; the certification body reviews and decides |
Remember that the two stages form one initial audit conducted in two parts. The European co-operation for Accreditation (EA) has clarified that Stage 1 findings should still feed into the overall initial audit report. In other words, what the auditor learns in Stage 1 does not disappear when Stage 2 starts.
What Do Auditors Check During a Stage 1 Audit?
During Stage 1, auditors check that your management system exists on paper and in early practice, and that it covers the right scope. Exact items depend on the standard, but most Stage 1 audits cover the areas below.
- Management system documentation: the policy, procedures and other documented information the standard requires, and how you control them.
- Scope: a clear statement of what the system covers, including sites, activities and any justified exclusions.
- Organizational context: the issues and interested parties that shape your system, as far as the standard requires.
- Objectives: measurable goals linked to your policy, with plans to achieve them.
- Risk and opportunity assessment: how you identify and address risks. For information security this includes the risk assessment and treatment process, and for environmental or safety systems it includes aspects, hazards and legal obligations.
- Internal audit arrangements: a programme, criteria and auditor impartiality, and evidence that audits have started or are properly scheduled.
- Management review: that top management has reviewed, or is about to review, the system with the right inputs.
- Readiness for Stage 2: whether resources, people and processes are in place for a full assessment.
Hypothetical example: a 60-person parts manufacturer submits a complete quality manual and procedure set. During Stage 1, the auditor finds that no internal audit has happened and no management review is planned. The auditor records both as areas of concern and advises the certification body that the company should close them before Stage 2. The paperwork was fine. The system was not yet ready.
What Do Auditors Check During a Stage 2 Audit?
During Stage 2, auditors check whether the system operates as described and delivers results. They sample evidence across the system and test it against both the standard and your own documented rules.
- Operational implementation: whether work follows your processes and the planning you documented.
- Employee competence and awareness: whether people know the policy, their role and how their work affects system performance.
- Process controls: whether controls such as inspection, approvals, access rules or monitoring work consistently.
- Records: whether records are complete, current and consistent with what the auditor observes.
- Performance monitoring: whether you measure, analyze and act on results against your objectives.
- Compliance with applicable requirements: whether you identify and meet the statutory, regulatory and customer requirements that apply to your scope.
- Internal audit and management review: whether both are completed and lead to action.
- Evidence of effective operation: whether the system achieves its intended results and improves over time.
Hypothetical example: a procedure requires gauges to be calibrated every six months. The auditor samples three gauges on the shop floor and finds two overdue. Staff cannot say who tracks calibration. This could support a nonconformity, because the requirement was documented and not fulfilled in practice.
How to Prepare for Stage 1 and Stage 2 Audits
Good preparation turns audits from a test into confirmation. The checklists below work as a starting ISO audit checklist. Adapt them to your standard and scope.
Stage 1 audit checklist
- Define scope: confirm sites, processes, products and services, and document any exclusions with reasons.
- Complete required documentation: policy, objectives, procedures and records the standard requires.
- Set up document control: approved versions, clear ownership, controlled access and retention rules.
- Complete a risk and opportunity assessment: record the results and treatment decisions.
- Run a full ISO internal audit cycle: cover all in-scope requirements, or have a sound plan if the standard allows phasing.
- Hold an ISO management review: include all required inputs and record decisions and actions.
- Brief key staff: managers and process owners should explain the policy, objectives and their roles.
- Open the corrective action log: show that issues from internal audits are being tracked and resolved.
Stage 2 audit checklist
- Close Stage 1 concerns: keep evidence of each action taken.
- Prove operation over time: keep records that show the system has run long enough to give meaningful evidence.
- Verify staff awareness: brief everyone in scope and confirm they can explain how their work links to the system.
- Check records quality: confirm records are legible, dated, approved and retrievable.
- Review performance data: gather monitoring results, trends and the actions you took.
- Complete corrective actions properly: address root causes, not only symptoms, and check effectiveness.
- Run a refresher internal audit: test high-risk areas and recent changes before the auditors do.
- Prepare logistics: arrange guides, rooms, access, secure remote platforms and a document-retrieval plan.
How do you prepare for a Stage 2 audit? Close every Stage 1 concern, collect evidence that the system works, rehearse with a targeted internal audit and make sure your people can explain their roles. A calm, organized audit usually reflects months of steady habits, not a final-week rush.
What documents are required for an ISO certification audit? The standard sets the minimum. Most systems need a scope statement, policy, objectives, risk or compliance assessments, procedures where required, internal audit results, management review minutes, corrective action records and evidence of competence. Your certification body will tell you what it wants to see before each stage.
Common Reasons for ISO Audit Delays and Nonconformities
Most delays and ISO audit nonconformities trace back to a small set of causes.
- Incomplete documentation: required documents missing, outdated or not approved.
- Weak implementation: procedures exist but people do not follow them.
- Missing records: work happened, but no one can prove it.
- Ineffective corrective actions: the team fixes the symptom, and the problem returns.
- Inadequate employee awareness: staff cannot explain the policy or their responsibilities.
- Inconsistent process controls: controls work in one department or shift but not another.
- Skipped internal audit or management review: the most common reason Stage 2 cannot start on schedule.
Findings, nonconformities and certification decisions
People often mix up ISO audit findings, nonconformities and certification decisions, as if they meant the same thing. They do not.
- Audit finding: the result of comparing audit evidence with audit criteria. According to ISO 19011, a finding can indicate conformity, nonconformity or an opportunity for improvement.
- Nonconformity: a requirement that is not fulfilled, as defined in ISO 9000.
- Certification decision: the certification body’s determination after it reviews the audit results and any corrective actions. Under ISO/IEC 17021-1, the decision is made by people other than those who carried out the audit.
Many certification bodies grade nonconformities as major or minor, but terminology and criteria vary by body and scheme. Ask your certification body how it classifies findings and what it requires for each class. A finding does not automatically mean certification is refused, and a clean audit does not automatically mean certification is granted.
Can an organization fail a Stage 1 audit? Stage 1 does not usually produce a pass or fail grade. It produces conclusions about readiness. If the auditor decides you are not ready, the certification body normally will not proceed to Stage 2 until you resolve the concerns, and it may repeat part of Stage 1.
What Happens After Stage 1 and Stage 2 Audits?
After Stage 1, you receive documented readiness conclusions and fix any areas of concern. After Stage 2, you receive the findings and respond to any nonconformities. The certification body then reviews the results and decides whether to grant certification.
After Stage 1:
- Review the conclusions: note every area of concern and assign an owner.
- Act on concerns: complete fixes and keep the evidence.
- Confirm Stage 2 arrangements: agree dates, scope and resources with the certification body.
After Stage 2:
- Respond to nonconformities: analyze root causes and submit corrections and corrective action plans within the timeframe the certification body sets.
- Provide evidence: for more serious findings, the body may need to verify the fix before recommending certification.
- Wait for the decision: an independent review follows and may request more information.
- Maintain the system: if certification is granted, an ISO surveillance audit normally follows at least annually within the certification cycle, with recertification before the certificate expires.
Certification is not automatic after either stage. The certification body must be satisfied that the evidence supports a decision.
How Long Between Stage 1 and Stage 2 Audits?
There is no universal interval. It depends on how ready you are, what concerns Stage 1 raised, how the audits are arranged and what your certification body and scheme require.
ISO/IEC 17021-1 asks certification bodies to consider your needs when setting the gap, so you have time to resolve concerns. Guidance from EA adds a second point: the interval should not become so long that the Stage 1 conclusions stop being reliable. If significant changes occur, the certification body may decide that part or all of Stage 1 needs repeating. It must justify and communicate that decision.
Plan with your certification body early. Share any major changes, such as a new site, a restructure or a new process, as soon as they occur.
ISO Certification Audit Cost and Timeline
ISO certification cost and timeline vary because every organization is different. No honest source can quote a fixed price or guaranteed schedule without understanding your situation. Your ISO certification timeline depends on the same variables. The main factors are:
- Organization size and workforce: more people and processes generally need more audit time.
- Number of sites: each additional location adds audit effort and may require sampling decisions.
- Complexity and risk: higher-risk activities and complex processes often need longer audits.
- Scope: broader scope means more to review.
- Management system maturity: a well-run system with solid records moves faster than one built from scratch.
- Standard and scheme: some standards and sector schemes add requirements.
- Integrated audits: combining several standards can reduce duplication, subject to the certification body’s rules.
Certification bodies determine audit duration using accreditation and scheme rules, such as IAF MD 5 for certain management systems. Separate from audit fees, you may spend on consulting, training, internal resources and ongoing surveillance audits. When you compare ISO certification services, request written quotes from several certification bodies, and ask what is included.
Does the Stage 1 and Stage 2 Process Differ by ISO Standard?
The general principles stay the same across management system certification, but details depend on the standard and certification scheme. Most schemes follow the two-stage model in ISO/IEC 17021-1. Beyond that, each standard has its own content, and some have sector-specific rules for certification bodies.
- Content differs: an information security audit examines risk treatment and applicable controls, while a food safety audit looks at hazard control and prerequisite programmes.
- Specialist rules exist: for example, ISO/IEC 27006 covers bodies certifying information security systems, and ISO 22003-1 covers food safety.
- Scheme owners add requirements: some programmes set extra conditions on audit duration, unannounced visits or auditor competence.
- Not every ISO standard is certifiable: some give guidance only, so check before you plan.
ISO certification requirements therefore differ from one standard to the next. Always confirm them with your certification body for the standard you are pursuing.
Current Audit Practices: Remote Techniques, Digital Records and Risk-Based Planning
ISO Audit practice keeps evolving, though the core principles stay stable.
- Remote audit techniques: IAF MD 4 sets rules for using information and communication technology in audits, and certification bodies may use remote methods where permitted, appropriate and agreed. Prepare secure platforms and make sure staff can share evidence quickly.
- Digital document management: controlled electronic systems make versions and approvals easier to prove. Make sure access rights and retention are clear.
- Risk-based audit planning: auditors increasingly focus time on higher-risk processes. Your own risk assessment helps them target sensibly.
- Integrated management systems: many organizations run several standards under one framework, which reduces duplicated documents and audits where the certification body allows combined audits.
- Evidence-based performance monitoring: auditors expect objective data, not statements. Track results over time and show actions taken.
How QCert360 Supports ISO Audit Preparation
At QCert360, we provide ISO certification consulting that helps organizations prepare for audits through consulting, training and documentation support. Our role is advisory. Certification decisions always belong to the independent certification body that audits you, and no consultant can promise an audit result.
We can support you with:
- ISO gap assessment: a review of your current practices against the standard, with a prioritized action list. This works as a practical ISO certification readiness assessment.
- ISO implementation support: help designing and putting processes in place that fit how your business works.
- Documentation support: drafting and organizing policies, procedures and records, and setting up document control.
- Employee training: awareness sessions so your people can explain their roles during interviews.
- Internal audit preparation: support for building an internal audit programme and running audits that test readiness for each stage.
- Corrective action support: guidance on root cause analysis and verifying effectiveness.
- ISO audit support and coordination: help preparing for audit logistics and communicating with your chosen certification body, including surveillance audit support after certification.
If you are comparing ISO certification consultants, ask what each one will do, how they separate advice from certification, and whether they will prepare your people as well as your paperwork. If accreditation matters to your customers, check that your chosen certification body is accredited for your standard and scope. Independence matters too: under ISO/IEC 17021-1, certification bodies must stay impartial and cannot provide consultancy to the clients they certify.
Ready to prepare with confidence? Contact QCert360 to talk through ISO implementation support, a gap assessment or ISO audit preparation services for your organization. Our team can help you plan a realistic path to Stage 1 and Stage 2.
Frequently Asked Questions
- What is the main purpose of each audit stage?
Stage 1 confirms that your management system is ready for the full assessment and gathers planning information. Stage 2 verifies that the system is implemented and effective.
- Is a Stage 1 audit mandatory?
For schemes that follow ISO/IEC 17021-1, yes. The initial certification audit has two stages. Your certification body can explain how it arranges them.
- Can an organization fail a Stage 1 audit?
Stage 1 produces readiness conclusions rather than a certificate decision. If concerns are serious, the certification body may delay Stage 2 or repeat part of Stage 1.
- What documents are required for an ISO certification audit?
Requirements depend on the standard. Typical items include scope, policy, objectives, risk assessments, required procedures, internal audit reports, management review records and corrective action evidence.
- How long between Stage 1 and Stage 2 audits?
No universal interval applies. It depends on readiness, the concerns raised and certification body rules, so agree the plan with your certification body.
- Can Stage 1 and Stage 2 audits be combined?
They are two stages of one initial audit, and the certification body must conclude Stage 1 before Stage 2. Some schedule them close together when readiness is clear, but that is the certification body’s call.
- What happens if nonconformities are found at Stage 2?
You analyze causes and submit corrections and corrective action plans. The certification body reviews them, may verify some fixes, and then reaches its decision.
- How do you prepare for a Stage 2 audit?
Close Stage 1 concerns, run an internal audit, hold a management review, brief staff and collect evidence that the system operates. The preparation section above has a full checklist.
- How much does an ISO certification audit cost?
It varies with size, sites, scope, complexity and system maturity. Ask certification bodies for written quotes based on your details.
- Can audit dates be rescheduled?
Often yes, but it depends on the certification body’s terms. Tell them early if you need to move dates, and ask about any notice period or fees.
- What happens after an ISO certification audit?
You act on any findings, the certification body reviews the outcome and decides, and certified organizations then face surveillance audits and eventual recertification.
- Who decides whether we are certified?
The certification body decides, through a review by people who did not conduct the audit. Consultants, including QCert360, do not make that decision.
Our Services
ISO Standards
- ISO 9001 Certification
- ISO 14001 Certification
- ISO 45001 Certification
- ISO 22000 Certification
- ISO 17025 Certification
- ISO 27001 Certification
- ISO 13485 Certification
- ISO 20000-1 Certification
- ISO 41001 Certification
- ISO 22716 Certification
- ISO 50001 Certification
- ISO 22301 Certification
- ISO 29993 Certification
Product Certifications
Other international standards
- FSSC 22000 Certification
- HIPAA
- HACCP Certification
- SA 8000 Certification
- GMP Certification
- GDPR
- GDP Certification
- GLP Certification
- Certificate of Conformity
QCert360 provides a wide range of services including ISO certification, audit support, compliance consulting, and training. They specialize in helping businesses achieve global standards and certifications like ISO 9001, ISO 27001, ISO 14001, and many others. Their team ensures a seamless experience from consultation to certification, supporting clients at every stage.
The time it takes to achieve certification can vary depending on the complexity of the standard and the readiness of your organization. On average, it takes about 3 to 6 months. QCert360 works closely with clients to streamline the process, ensuring that all requirements are met efficiently and within a reasonable timeline.
QCert360 is a trusted partner with years of experience in helping businesses obtain international certifications. Their expert consultants provide tailored solutions, ensuring your organization not only meets but exceeds industry standards. With a customer-centric approach, they focus on offering end-to-end support to simplify the certification journey.
QCert360 serves a wide range of industries including manufacturing, healthcare, information technology, education, and services, among others. They customize their certification solutions to meet the unique requirements of each industry, ensuring relevance and compliance with global standards.
Yes, QCert360 provides ongoing support even after certification. They offer services like surveillance audits, recertification guidance, and consultancy to help maintain and improve your certification status. Their team ensures that your organization stays compliant and up-to-date with any changes in certification standards.
Getting started with QCert360 is simple. You can contact them via their website to request a consultation. Their team will assess your needs, discuss the best certification options for your business, and outline the steps involved. From there, they’ll guide you through the entire process, ensuring you’re prepared for certification.
QCert360 stands out due to its customer-focused approach, industry expertise, and comprehensive service offerings. Their team doesn’t just help you obtain certification but works to ensure your organization thrives in compliance with international standards. They also offer personalized consultation, making the process smoother and more efficient, ensuring long-term success for your business.
The cost of certification varies depending on factors such as the type of certification, the size and complexity of your organization, and the specific industry requirements. QCert360 offers competitive pricing and provides tailored quotes based on your unique needs. They ensure transparency and work with you to find the most cost-effective solution for your certification goals.
Yes, QCert360 offers internal audit services to help assess and improve your organization’s processes. Their expert auditors conduct thorough reviews of your systems and operations to ensure they meet required standards. They also provide actionable recommendations to help enhance efficiency and compliance, making sure you’re fully prepared for external audits.
If your organization doesn’t pass an audit or certification assessment, QCert360 works with you to understand the reasons for non-compliance and provides support to rectify the issues. They offer guidance on corrective actions and help you prepare for a re-assessment. Their goal is to ensure your organization meets the necessary standards for certification, and they will be by your side to make the process as smooth as possible.
