Certification audit
A certification audit is the external audit a certification body runs before it issues a certificate, in two stages. Stage 1 checks you are ready: scope, documents, risk work, an internal audit and a management review. Stage 2, usually some weeks later, tests that the management system works in practice by sampling evidence and interviewing people.
Where the term appears
No clause in ISO 27001, ISO 9001, ISO 13485 or ISO 42001 defines it. The two stages come from ISO/IEC 17021-1, the rules certification bodies follow. Stage 1 is often partly remote and ends with a list of concerns that could become nonconformities at stage 2; for ISO 27001 the auditor reads the Statement of Applicability here. Stage 2 is the effectiveness audit. A certificate then runs for three years, with surveillance audits at least once a year in between and a recertification audit before it expires. The ISO 27001 hub explains certification for that standard.
What can hold you up
Stage 1 concerns left open can delay stage 2. A major nonconformity at stage 2 normally has to be closed, with evidence, before the certificate is issued. The auditor also wants records showing the system has run for a while, not only that it was set up. Most organisations check their audit readiness against these points before they book.
How Sted uses it
- Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
- Audit readiness is visible to administrators only for now.
- Only evidence from the last 12 months counts towards readiness.
Sted does not audit or certify you. The certification body runs both stages and decides.
Related terms
- Certification body: who runs the audit.
- Internal audit: often confused with it; your own audit, which stage 1 checks you held.
- Management review: checked at stage 1, and expected to have been held before stage 2.
- Evidence: what stage 2 samples.
- Nonconformity: what either stage can raise.