ISO Audit Coming Up? 10 Things I Would Check Before Your Auditor Arrives

An ISO audit date can seem comfortably far away, until suddenly it isn’t.

One of the biggest mistakes businesses make is assuming that because their policies and procedures exist, they’re audit-ready.

A management system needs to be more than a collection of documents. You need evidence that it is being implemented, monitored and improved.

1. Internal Audits
Have internal audits actually been completed? Check that findings have been recorded, actions allocated and non-conformities properly closed.

2. Management Review
Has management reviewed the system? There should be evidence of what was discussed, what decisions were made and what actions resulted.

3. Objectives
What objectives did the business set? Can you demonstrate progress? Objectives that sit untouched for 12 months can quickly raise questions about whether the management system is genuinely being used.

4. Risks and Opportunities
Have your risks changed? New customers, employees, suppliers, legislation, equipment and services can all change the risk profile of a business.

5. Legal and Other Requirements
Can you demonstrate that you’ve identified the legal and regulatory requirements applicable to your organisation and how you keep that information current?

6. Competence and Training
Don’t simply check certificates. Consider whether people have the necessary competence to perform their roles and whether you have evidence to support that conclusion.

7. Supplier Control
How do you approve suppliers? How do you monitor them? What happens if performance deteriorates?

8. Corrective Actions
Look back through previous audits, incidents, complaints and non-conformities. Were actions actually completed? Was the underlying cause addressed?

9. Communication and Awareness
Would employees understand the management system if an auditor spoke to them? They don’t need to recite ISO clauses. They should understand what is relevant to their role.

10. Evidence
Finally, ask one simple question: Can we prove it?

Saying something happens and demonstrating that it happens are two very different things during an audit.

A pre-internal audit or gap analysis provides an opportunity to identify weaknesses before your certification auditor does.

AA Compliance Compass Ltd supports organisations with ISO 9001, ISO 14001 and ISO 45001 gap analysis, internal auditing, management-system development and audit preparation.

Four weeks to go: test one piece of evidence

Select a corrective action marked complete. Can you find the original issue, the action taken, who completed it and evidence that it worked? If something is missing, agree an owner and completion date now. Repeat the check across the areas above and prioritise unresolved findings and missing operational evidence.

If this sounds familiar, call me on 07889 890234. I can complete a practical gap analysis and give you a prioritised action plan.