ISO audit process in Croatia is practical and evidence-driven. Auditors are less interested in polished documents and more focused on whether systems actually work in day-to-day operations. Here’s what they really check:

• Defined scope and applicability
  Auditors confirm that the ISO scope accurately reflects your real activities, services, and locations, not a generic or overstated description.
• Risk-based thinking in practice
  They expect documented risks and opportunities tied to your operations, along with actions that are actually implemented and reviewed.
• Operational control and consistency
  Processes must be clearly defined, followed by teams, and consistent across departments. Verbal explanations without records don’t hold up.
• Documented procedures and usable records
  Policies, SOPs, and records should reflect how work is done, not copied templates. Auditors often test this by interviewing staff.
• Internal audits and management review
  Internal audits must be meaningful, with findings, corrective actions, and follow-up. Management reviews must show decisions, not just signatures.
• Competence and training evidence
  Auditors verify that employees are trained for their roles and understand the system, especially in regulated or client-facing functions.
• Corrective actions and improvement
  Nonconformities must be analysed, corrected, and prevented from recurring. Open or weak actions are common audit failures.

What this really means is simple. ISO certification majorly depends on system maturity, not paperwork volume.