An ISO audit is a rigorous assessment of your organization’s management system to ensure it meets internationally recognized standards. Audits help you check that your documentation is in order, that processes work as intended, and that your desired outcomes have been met.
Each type of audit comes with different requirements, from internal and surveillance audits to those conducted for ISO certification and recertification.
Discover the difference between these assessments and how to prepare for an ISO audit in this guide.
What Is an ISO Audit?
A management system must be regularly audited to ensure it meets its objectives. This is a thorough assessment of the system—from policies and processes to risk assessment and staff awareness training—to ensure that everything functions as intended and that nothing has been overlooked.
These assessments are especially important if you’re following specifications from the ISO (International Organization for Standardization). It’s a non-governmental body that develops best-practice approaches for establishing and maintaining management systems.
An ISO audit is a highly structured approach to the assessment process. It provides a standardized framework for evaluating your system, ensuring consistent and effective results aligned with globally recognized standards.
Depending on the type of audit, the process might be conducted by someone in your organization or a third party. It’s their job to identify any weaknesses in your management system. In some cases, this can be the final evaluation to gain ISO certification.
Download our free guide to learn more about the ISO certification process.
Types of ISO Audit
Your first task when preparing for an ISO audit is to determine what type of assessment you need. There are various ISO audits, and you’ll find specific requirements for many of the most common standards, including:
- ISO 9001—quality management
- ISO 14001—environmental management
- ISO 27001—information security management
- ISO 45001—occupational health and safety management
Thankfully, the ISO uses the same HSL (High-Level Structure) across these management system standards. It creates a consistent approach to implementation with similar requirements and terminology. However, it’s important to note that not all ISO standards have been aligned to this structure. Some older or more specialized standards may have different structures.
One of the biggest similarities is in the auditing process. For each standard, organizations are required to complete internal or external audits, but there are several specific types of assessment within this.
Internal Audit
This is the first type of audit you’ll perform as part of your implementation project. They are also known as First Party Audits.
It’s a chance to check your management system against the standard’s specifications, with the auditor pointing out any nonconformities and offering tips to improve your policies or processes.
Despite the name, internal audits don’t necessarily have to be conducted by someone in your organization. You might instead hire an ISO consultant on your behalf who can provide an expert, unbiased opinion.
Internal audits are often performed to prepare for ISO certification, but you can use the process whenever you want to assess your management system or improve efficiency.
Certification Audit
After completing an internal audit and making any necessary changes, you’re ready to certify.
An independent expert from a certification body, such as Orion Registrar, performs the certification audit. These are also known as Third Party Audits. They take a similar approach to what you did in the internal audit, reviewing documentation, testing procedures, checking conformity to customer and other applicable requirements, whether objectives are being met, and interviewing key personnel to determine whether they understand their responsibilities.
They’ll also highlight any parts of the management system that don’t meet the standard’s requirements, while some auditors offer guidance on how to fix these problems. Auditors may also point out areas of opportunity where while requirements are being met, the process, method or policy can be enhanced in some way to make the management system more effective and/or efficient. Auditors in Third PartyAaudits are not allowed to provide consulting or give recommendations on how to implement the system or fix areas found as non-conforming.
Certification audits are usually split into two parts—Stage 1, a documentation review and Stage 2, an on-site review. Each stage takes a few days, although there might be a gap of several weeks between them.
Once the auditor is satisfied with your management system, they’ll issue an ISO certificate.
It’s worth knowing that while the ISO defines the specifications for ISO standards, it doesn’t conduct any audits or issue certification itself—that is the role of an accredited independent certification body such as Orion Registrar.
Surveillance Audit
A surveillance audit is a form of audit that occurs after you’ve achieved certification. They’re conducted annually to ensure that your management system continues to meet the standards set out by the ISO.
Surveillance audits are typically conducted by external auditors from the certification body, not internally by the organization or a consultant. They are carried out to ensure ongoing compliance with ISO standards after certification has been achieved.
Recertification Audit
Most ISO certificates are only valid for a set period because an organization’s systems can evolve, and their conformity can slip over time.
For most management systems, the certificate lasts three years. To renew it, you must undergo a recertification audit of the complete management system.
The process for a recertification audit often includes a review of documentation, changes in the management system, and performance data since the last certification or surveillance audit.
Learn more about the three-year certification lifecycle.
ISO Audit Checklist
The key to a successful ISO audit is to prepare appropriately.
Each assessment has a particular set of requirements, depending on whether you’re performing it internally or externally and if you’re seeking certification or reviewing your conformity.
You also need to consider the unique aspects of your organization, its processes, and the people responsible for the audit process. Most importantly, you need to consider any specific requirements related to the ISO management system that you’re implementing, as well as any applicable customer or other interested party requirements.
But to give you a general idea of the ways you should prepare, we’ve created ISO audit checklists for internal and external audits.
Download our free ISO audit checklists:
Preparing for an Internal Audit
The internal audit is your organization’s first opportunity to evaluate the effectiveness of your management system. You are responsible for the process from beginning to end, meaning there’s a degree of flexibility about how you prepare. Nonetheless, it helps to have a carefully considered and communicated plan.
To prepare for an internal audit, you should:
- Document your objectives—clearly outline the goals and expectations of the internal audit.
- Determine the scope of your management system—identify the boundaries and processes within your organization that will be subject to the audit.
- Review documentation and performance data—set priorities and areas of focus based on the results of the review.
- Create an audit schedule—develop a timeline that includes key milestones, deadlines, and the sequence of audit activities.
- Define roles and responsibilities—assign specific roles to individuals involved in the audit process, clarifying who will lead the audit, who will be responsible for gathering information, and who will oversee corrective actions.
- Conduct a pre-audit briefing—communicate the objectives, expectations, and logistics of the internal audit to all involved parties.
Preparing for an External Audit
How you prepare for an external audit will differ from an internal audit. Your focus should be on identifying and fixing any weaknesses in your management system ahead of a third-party assessment.
To prepare for an external audit, you should:
- Perform an internal audit—evaluate your management system to determine whether it meets your desired outcomes.
- Identify nonconformities—document any weaknesses and highlight opportunities to improve your practices.
- Implement corrective actions—using your list of nonconformities, pinpoint specific ways to improve your management system and align it with the standard’s specifications.
- Monitor your performance—before instigating the certification audit, you must check that the management system works consistently over several months.
- Conduct a management review—share the findings of your monitoring with top management and determine whether you are ready for a certification audit.
Certification Support With Orion Registrar
You can learn more about ISO audits with Orion Registrar. We are an ANAB-accredited provider of certification services, and our team of experts can help you achieve audit success across a range of ISO standards.
Want to learn more? Read our guide: What Is ANAB Accreditation.
Contact Orion for a quote today.
