ISO 9001 Audit: How to Prepare, What Auditors Look For, and Common Nonconformities

Types of ISO 9001 Audits

There are three types of audits you will encounter:

Internal audits (first-party): Conducted by your own trained auditors to verify your QMS is working. ISO 9001 requires these at planned intervals. They are your opportunity to find and fix problems before someone else does.

Customer audits (second-party): Conducted by your customer or their representative. These focus on your ability to meet the customer’s specific requirements and may cover areas beyond ISO 9001.

Certification audits (third-party): Conducted by an accredited certification body (registrar). These determine whether your QMS meets ISO 9001 requirements and whether you will receive or maintain certification.

How to Prepare for a Certification Audit

6 to 8 Weeks Before the Audit

• Complete your internal audit cycle. Every process in your QMS scope should have been audited at least once since the last external audit. Address all findings with corrective actions.
• Conduct management review. Ensure your most recent management review covers all required inputs (audit results, customer feedback, process performance, corrective actions, changes, improvement opportunities) and produces documented outputs.
• Review document control. Verify all controlled documents are current revision, obsolete documents are removed from use, and the master document list is accurate.
• Check calibration records. Ensure all measurement equipment is calibrated and within its calibration interval. If any equipment is overdue, address it immediately.

2 to 4 Weeks Before the Audit

• Review open corrective actions. Close any open CAPA (Corrective and Preventive Action) items or document a clear plan for completion. Auditors will ask about the status of open corrective actions.
• Brief your team. Everyone who may interact with the auditor should understand the audit process, their role, and how to respond to questions. The key message: answer the question asked, provide evidence, and do not volunteer information that was not requested.
• Review the audit plan. The certification body will provide an audit plan listing which areas, processes, and clauses will be covered each day. Ensure the right people are available for each section.
• Prepare records. Have recent records readily accessible: training records, inspection data, CAPA files, management review minutes, internal audit reports, and customer complaint logs.

The Week of the Audit

• Organize a clean workspace. This is not about impressing the auditor. It is about ensuring that documents are findable and processes are visible.
• Assign a guide. Designate someone to escort the auditor through the facility. This person should know the QMS well and be able to locate documents and records quickly.
• Prepare an opening meeting space. The auditor will hold opening and closing meetings. Have a meeting room available with access to your QMS documentation.

What Auditors Actually Look For

Auditors are trained to look for three things: conformity, effectiveness, and evidence.

Conformity: Do your processes match what the standard requires and what your own documentation says? If your procedure says you inspect every 50th part, but operators inspect every 100th part, that is a nonconformity.

Effectiveness: Is the process achieving its intended results? Having a corrective action procedure is not enough. The auditor wants to see that corrective actions actually prevent recurrence.

Evidence: Auditors work from objective evidence, not assumptions. They will ask to see records, data, and documented results. “We always do that” is not evidence. A signed inspection record is.

Common Audit Techniques

• Process approach auditing: The auditor follows a process from input to output, checking that it is defined, controlled, measured, and improved at each step.
• Sampling: Auditors select samples of records, products, and transactions. They cannot review everything, so they sample and look for patterns.
• Traceability trails: Starting with a customer order and tracing it through the system: from order entry to production planning to manufacturing to inspection to shipping.
• Interviewing: Auditors talk to people at all levels, from top management to shop floor operators. They want to see that everyone understands their role in the QMS.

The 10 Most Common ISO 9001 Nonconformities

1. Document control failures: Obsolete documents in use, missing approvals, or uncontrolled copies on the shop floor.
2. Ineffective corrective actions: Corrective actions that address symptoms rather than root causes, or that lack verification of effectiveness.
3. Incomplete internal audits: Not all processes or clauses are covered, auditors are not competent, or findings are not followed up.
4. Management review gaps: Required inputs missing (such as customer feedback or audit results), or the review produces no actionable outputs.
5. Training and competence: No evidence that personnel are competent for their roles, or training records are incomplete.
6. Calibration lapses: Measurement equipment used beyond its calibration due date, or no documented procedure for handling out-of-calibration situations.
7. Nonconforming product control: Nonconforming material not segregated, disposition not documented, or no evidence of customer notification when required.
8. Supplier evaluation gaps: No documented criteria for evaluating and selecting suppliers, or evaluations not performed at planned intervals.
9. Objectives without measurement: Quality objectives that are not measurable, not monitored, or not communicated to the organization.
10. Risk and opportunity gaps: No evidence of risk-based thinking applied to planning, or risks identified but no actions taken to address them.

How to Handle Nonconformities

When the auditor identifies a nonconformity, stay calm and professional. The auditor will explain the finding, cite the clause of the standard that is not met, and document the objective evidence.

Minor nonconformity: A single lapse or isolated issue. You typically have 60 to 90 days to implement corrective action and provide evidence to the certification body. Certification is not affected.

Major nonconformity: A systematic failure or a breakdown that affects the ability of the QMS to achieve its intended results. A follow-up audit (on-site or documentation review) is required to verify correction. Certification is withheld or suspended until the major is closed.

For both types, the corrective action must address the root cause, not just the immediate symptom. Auditors will verify that the correction prevents recurrence, not just fixes the instance that was found.

Frequently Asked Questions

How often are ISO 9001 audits?

After initial certification, surveillance audits occur annually (typically covering about one-third of the QMS each year). A full recertification audit is conducted every three years.

Can I choose which auditor conducts my audit?

You cannot select a specific auditor, but you can object to an assigned auditor if there is a conflict of interest. You can also request an auditor with specific industry experience. The certification body makes the final assignment.

What if I disagree with a finding?

Discuss it with the auditor during the closing meeting. If you believe the finding is incorrect, present your evidence. If the disagreement is not resolved, all certification bodies have a formal appeals process.

Do auditors inspect products?

Auditors are not product inspectors. They audit the management system and its processes. However, they may observe inspection activities, review inspection records, and verify that product requirements are being met through the QMS processes.

Should I hire a consultant to help prepare?

A pre-audit assessment by a consultant or experienced quality professional can identify gaps before the certification body does. This is especially valuable for first-time certifications. The cost of a pre-audit ($1,000 to $3,000) is usually far less than the cost of a failed audit.

What is the difference between an ISO 9001 audit and an IATF 16949 audit?

An IATF 16949 audit covers everything in ISO 9001 plus the automotive-specific requirements (APQP, PPAP, FMEA, SPC, MSA, product safety, customer-specific requirements). IATF audits are longer, more detailed, and conducted by auditors with automotive manufacturing experience.