Short answer: An ISO audit follows a plan agreed in advance. After an opening meeting, auditors sample evidence through interviews, observation and records, compare it with the standard's requirements, grade any nonconformities and present the results at a closing meeting. The audit team recommends; an independent decision maker decides.
Before the audit: the audit plan
The certification body sends a plan in advance. It lists the objectives, criteria, scope, sites and shifts to be covered, the processes to be audited and when, the team members and their roles, and any observers. Audit time is calculated using the international rules in IAF MD 5, based on the effective number of personnel and the risk and complexity of the activities.
The opening meeting
A short meeting with management confirms the scope and plan, explains that conclusions are based on samples, covers confidentiality and how findings will be graded, and explains complaint and appeal routes.
Collecting evidence
Auditors follow processes rather than reading documents in isolation. A typical trail starts with a customer requirement, follows it into planning and production records, checks how output is verified and released, and ends with how problems are handled. Evidence is recorded with specifics: record numbers, batch numbers, dates and the role of the person interviewed.
- Interviews with people who do the work, on every relevant shift.
- Observation of activities, for example a metal-detector check on a packing line.
- Records sampled across time, not just the most recent ones.
Findings and grading
Where evidence shows a requirement is not met, the auditor writes a nonconformity with the requirement, the evidence and a clear statement. It is graded major or minor according to its effect on the system. Opportunities for improvement may also be noted, but auditors do not provide solutions.
The closing meeting
The lead auditor presents findings and grading, timelines for corrective action and the audit recommendation, and records any disagreement. The organisation then submits correction, root cause analysis and corrective action, and the file goes to an independent technical reviewer and certification decision maker.
Next step
A walk-through of a certification audit day: the plan, the opening meeting, how auditors sample evidence, how findings are graded, and the closing meeting.
See the full certification process
