Running the external audit

Scope: the third-party certification audit, stage 1 to closure · Who: the officer who hosts the certification body · Prerequisites: a management system already operating · First result: one audit

1. Why this exists (the failure mode it prevents)#

An external audit is a sampling exercise. The auditor asks for a small number of records and reasons from them to the whole management system. What the auditee does before and after either makes that sample easy to draw or makes it look thin.

The failure mode has four moves, usually together. Evidence is hunted in the fortnight before the auditor comes. Questions are answered from memory, because nobody can find the record. Findings are accepted at the closing meeting without being read. Corrective action is then written as a single word: fixed.

Each move surfaces predictably. Hunted evidence produces a nonconformity worded around an inability to demonstrate. An unread finding produces a correction aimed at the wrong requirement. A finding closed as fixed returns at the next surveillance audit against the same clause.

The cost is a date, not a rebuke. Certification is decided by people who read the report, not by the audit team, and the decision carries conditions. Where a major nonconformity is open, those conditions are unmet until the correction and corrective action are reviewed, accepted and verified ¹. A system that genuinely works can still lose a certificate date to a badly run audit week.

This playbook is the audit-week counterpart to Building an ISMS people actually use, sections 3.6 and 3.7. That playbook makes the records exist; this one makes them findable and closable.

2. Definitions (only the ones that cause disputes)#

Requirement text in both auditing standards is copyright and is paraphrased throughout. Only clause numbers and titles are cited.

Term	Working definition	Source
Certification audit, internal audit	A certification audit is carried out by an auditing organization independent of the client and of the parties relying on certification. An internal audit is the organisation's own conformity check.	ISO/IEC 17021-1:2015 clause 3.4 2; ISO/IEC 27001:2022 clause 9.2 3
Stage 1 and stage 2	The two stages of an initial certification audit. Stage 1 establishes readiness; stage 2 evaluates implementation, including effectiveness, at the client's sites.	ISO/IEC 17021-1:2015 clauses 9.3.1.1 and 9.3.1.3 4
Audit criteria, audit evidence	The criteria are the requirements evidence is compared against: the normative document plus the organisation's own processes and documentation. Evidence is records, statements of fact or other information relevant to those criteria and verifiable.	ISO 19011:2018 clauses 3.7 and 3.9 5; ISO/IEC 17021-1:2015 clause 9.2.1.4 6
Audit finding, audit conclusion	A finding results from evaluating collected evidence against the criteria, and indicates conformity or nonconformity. A conclusion is the outcome once objectives and findings are weighed.	ISO 19011:2018 clauses 3.10 and 3.11 7
Major and minor nonconformity	A nonconformity is a requirement that has not been met. It is major where it undercuts the management system's ability to reach its intended results, minor where it does not. Several minors against one requirement can be classified as major.	ISO/IEC 17021-1:2015 clauses 3.11 to 3.13 8
Correction and corrective action	Correction deals with the detected instance; corrective action removes the cause. The certification body requires both, with the cause analysis, inside a defined time.	ISO/IEC 27001:2022 clause 10.2 9; ISO/IEC 17021-1:2015 clause 9.4.9 10
Certification cycle, surveillance, recertification	The first three-year cycle begins with the certification decision, later cycles with the recertification decision. Surveillance audits are on-site but not necessarily full system audits. Recertification confirms continued conformity, effectiveness and scope.	ISO/IEC 17021-1:2015 clauses 9.1.3.2, 9.6.2.2 and 9.6.3.1.1 11

3. The method — numbered steps, each with input, activity, output and owner#

Ten steps, in the order the audit imposes.

3.1 Know which audit you are in#

One audit programme covers the full cycle and every management system requirement. Initial certification is fixed in shape: a two-stage initial audit, surveillance in the first and second years after the certification decision, then recertification in the third year. Surveillance runs at least once a calendar year outside recertification years, the first within twelve months of that decision ¹². Each surveillance has a defined minimum: internal audits and management review, actions on earlier nonconformities, complaints, effectiveness, improvement progress, operational control, changes and marks ¹³. Recertification reads the previous surveillance reports and cycle performance, and can pull in a stage 1 after significant change ¹⁴.

• Input: the audit programme; the certificate cycle dates; open findings.
• Activity: identify the audit type and its minimum content; calendar the cycle; flag changes that could pull a stage 1 into recertification.
• Output: audit cycle plan: each audit, its type, its coverage, its deadlines.
• Owner: the management system owner; top management approves the dates.

3.2 Build the evidence architecture#

An evidence architecture is one index from every requirement to the record answering it, naming the process producing it, its location, its cadence and the accountable role. Evidence is obtained by appropriate sampling and then verified, through interviews, observation of processes and activities, and review of records ¹⁵. The criteria also include the organisation's own processes and documentation ⁶. Version, approver and distribution make a sampled record defensible ¹⁶.

• Input: the Statement of Applicability; the clause list; the document control register.
• Activity: one row per clause and per applicable control; walk three rows end to end and fix what cannot be retrieved.
• Output: evidence index, maintained continuously rather than rebuilt per audit.
• Owner: the management system owner; each row's accountable role owns its record.

3.3 Read the audit plan and settle the people#

The body sets the audit objectives and settles scope and criteria after discussion with the client ¹⁷. The plan carries the objectives, the criteria, the scope with the processes audited, the dates and sites, the expected duration, and the roles of team members and accompanying persons. Dates are agreed in advance, and the team's names arrive with time enough to object to a member ¹⁸. Name the auditee side too: a guide assists the audit team, an observer accompanies without auditing ¹⁹. The guidance standard makes planning and guide assignment distinct activities ²⁰.

• Input: the received audit plan; the evidence index; the roles matrix ²¹.
• Activity: map each session to index rows and to the role answering; brief one guide per team member; object to team composition in writing, in time.
• Output: audit plan acknowledgement: session, attendee, guide, records staged.
• Owner: the management system owner; process owners confirm their own sessions.

3.4 Treat stage 1 as an audit, not a formality#

An initial certification audit runs in two stages ²². Stage 1 reviews the documented information, evaluates site conditions with personnel, tests how far the organisation understands the standard, and gathers scope information on sites, processes and levels of control. Its last objective is decisive: whether internal audits and management reviews are planned and performed, and whether implementation substantiates readiness for stage 2 ²³. The written conclusions identify areas of concern that could become a nonconformity at stage 2, and stage 1 results can postpone or cancel stage 2 ²⁴. Stage 2 evaluates implementation and effectiveness on site, covering at least conformity, performance monitoring, statutory and contractual requirements, operational control, internal audit and management review ²⁵.

• Input: stage 1 documented conclusions; the areas of concern; the evidence index.
• Activity: turn every area of concern into a dated action with an owner; confirm the audit programme and review record predate stage 2 ²⁶.
• Output: stage 1 response log, closed or dated before stage 2.
• Owner: the management system owner; process owners hold individual actions.

3.5 Use the opening meeting#

The on-site process opens and closes with a formal meeting ²⁷. The opening meeting is held with the client's management and those responsible for the processes audited. It confirms the certification scope, the plan and its changes, the communication channels, the resources needed, confidentiality, safety, and the roles of guides and observers. It states the reporting method including any grading of findings, the conditions for early termination, the sampling basis and the language ²⁸. Two items repay attention: ask how findings will be graded before any exists, and confirm the channel by name ²⁹.

• Input: the audit plan; the acknowledgement from step 3.3; the attendance list.
• Activity: confirm scope, plan changes and channels; record the grading method; agree how record requests will be logged.
• Output: opening meeting note: attendance, scope, channel, grading method.
• Owner: the management system owner.

3.6 During the audit: supply, escort, communicate#

The team leader reports progress and concerns as the audit runs. Where evidence suggests the objectives are unattainable, or an immediate and significant risk appears, the team leader reports it. The response can extend to changing the plan, the objectives or the scope, or terminating the audit ³⁰. Nothing said in a corridor counts. Give what was asked for, in the version current in the audited period, and say plainly when a record does not exist. Volunteering adjacent documents widens the sample, not the scope ³¹. Escorting is a control, not hospitality. A guide is appointed by the client to assist the audit team ³². In practice that means retrieving records, finding the right person and logging every request.

• Input: the audit plan; the evidence index; the staged record set.
• Activity: log every request with time, record supplied and index row; answer the question asked; escalate a disputed point the same day.
• Output: evidence request log; daily note of concerns raised and answered.
• Owner: the guide for each session; the management system owner consolidates.

3.7 Findings: read the wording, agree the facts#

Findings are identified, classified and recorded so an informed certification decision can be made, and a nonconformity is never logged as an opportunity for improvement ³³. The wording rule is worth knowing by heart. A nonconformity is recorded against a specific requirement, states it clearly, and identifies in detail the objective evidence behind it. It is discussed with the client so the evidence is accurate and the nonconformity understood, and the auditor refrains from suggesting the cause or the solution ³⁴. So check that the requirement cited is the one the evidence engages, and that the evidence is described accurately.

Grading is the certification body's judgement, not a negotiation. A major is one that undercuts the management system's ability to reach its intended results; a minor is not. Several minors against one requirement can be classified as major ³⁵. Argue the facts and the requirement cited. Where disagreement stands, the team leader attempts to resolve it and unresolved points are recorded ³⁶. Before the closing meeting the team reviews findings, classifies nonconformities and agrees conclusions ³⁷. The auditee should copy that separation: facts first, grading second ³⁸.

• Input: draft finding wording; the cited requirement; the evidence request log.
• Activity: read each finding against the log; correct the factual description; confirm the requirement cited; record any diverging opinion in writing.
• Output: findings register rows: the finding as written, the clause cited, the agreed facts.
• Owner: the management system owner; the named process owner co-signs.

3.8 The closing meeting and the report#

The closing meeting is formal, attendance is recorded, and it presents the conclusions and the recommendation regarding certification. Nonconformities are presented so they are understood and the response timeframe agreed; the standard's own note is worth carrying into the room, that understood does not mean accepted. The meeting also covers the sampling basis, the reporting method and timeframe including grading, the handling of nonconformities and its consequences, the timeframe for a plan of correction and corrective action, and the appeal process. Unresolved diverging opinions are recorded and referred to the certification body ³⁹. A written report follows for each audit, owned by the body; the team may name opportunities for improvement but not solutions. Prescribed content includes the audit type, criteria, objectives and scope, and the findings with reference to evidence. It also includes unresolved issues, a sampling disclaimer, the recommendation, and verification of earlier corrective actions ⁴⁰. Read it against the meeting note; changed wording is worth querying ⁴¹.

• Input: the closing agenda; the findings register; the agreed response timeframe.
• Activity: record attendance and timeframes; confirm each finding's wording against the register; reconcile the issued report against the note.
• Output: closing pack: meeting note, wording as presented, agreed dates, reconciliation.
• Owner: the management system owner.

3.9 From finding to verified closure#

The body requires the client to analyse the cause of each detected nonconformity. It also requires the specific correction and corrective actions, taken or planned, described within a defined time ¹⁰. The management system standard asks the same from the other side: react, examine the cause, act on the cause, review effectiveness ⁹. It then reviews the corrections, causes and corrective actions, verifies effectiveness, and records the evidence of resolution. It tells the client whether an additional full audit, a limited audit, or documented evidence confirmed later will be needed ⁴². Those routes differ sharply in cost. Five parts make a submission complete: the finding as written, the agreed facts, the cause, the correction, and the corrective action with an owner and a date ⁴³.

• Input: the findings register; the response timeframe; the process owner per finding.
• Activity: analyse the cause without renaming the symptom; write correction and corrective action separately; set an effectiveness check date.
• Output: findings-to-closure tracker (see Findings-to-closure tracker); corrective action records.
• Owner: the process owner where the finding sits; the management system owner tracks closure.

3.10 The certification decision and what follows#

The decision is made by competent people who did not carry out the audit, and each decision is recorded ⁴⁴. Before deciding, the body checks that the audit team's information is sufficient. For any major, the correction and corrective actions are reviewed, accepted and verified. For any minor, the client's plan for correction and corrective action is reviewed and accepted ¹. That asymmetry is the most useful fact here. A minor needs an accepted plan; a major needs verified action. Where a major cannot be verified within six months after the last day of stage 2, another stage 2 precedes any recommendation ⁴⁵.

Recertification repeats the asymmetry against a harder deadline. Time limits are set for any major, and those actions are implemented and verified before certification expires. An incomplete audit, or a major still unverified at expiry, means recertification is not recommended ⁴⁶. Two duties run between audits. The certified client reports without delay any matter that may affect the system's capability to keep meeting the standard. Notifiable changes include status or ownership, management, sites, scope, and the system itself ⁴⁷. And certification is suspended where failures persist, or where audits are refused at the required frequency ⁴⁸.

• Input: the closure pack; the body's acceptance or rejection; the change log.
• Activity: confirm in writing which findings are accepted and which verified; calendar the next surveillance; report notifiable changes as they arise.
• Output: closure confirmation record; change notifications sent; next-audit plan.
• Owner: the management system owner; the management review record carries the decisions ⁴⁹.

4. Deliverables#

Six artefacts carry the method. Retention periods are organisational choices rather than requirements of any of the three standards; the defaults suit a three-year cycle.

Deliverable	Produced by	Format	Retention
Audit cycle plan	Step 3.1	document	whole cycle
Evidence index	Step 3.2	register	current version, plus the whole cycle
Audit plan acknowledgement	Step 3.3	document	per audit, whole cycle
Findings-to-closure tracker	Steps 3.7 and 3.9 · template	spreadsheet or register	whole cycle, plus one
Corrective action records	Step 3.9	records with evidence	whole cycle, plus one
Closing pack	Step 3.8	meeting note plus reconciliation	per audit, whole cycle

5. What the auditor will ask#

Every clause named below is registered with its verified reference in section 7. The phrasing follows how a certification-body auditor opens a line of enquiry: a request for a record, then a request for the decision behind it.

An audit that stays at document level is going well. One that moves to records, and then to the people who produce them, is where the index earns its cost.

6. Failure modes and how they surface as findings#

Five patterns account for most avoidable audit-week damage: the pattern, the wording it produces, the fix.

The root is the same in all five: the audit is treated as a performance, not a sample of something already running.

7. Mapping to the standards#

Every clause number and title below was read from the publisher's own text on the date shown. Requirement text is paraphrased; only clause numbers and titles are cited.

Clause	Title	Certification body	Auditee prepares	Verified
8.5.3	Notice of changes by a certified client	Requires changes affecting the system to be reported without delay	Change log; a notification route	47
9.1.3	Audit programme	Builds a cycle programme covering every requirement	Audit cycle plan with internal deadlines	50
9.2.3	Audit plan	Issues a plan, names the team, agrees dates	Acknowledgement mapping sessions to records	51
9.3.1	Initial certification audit	Audits in two stages, reporting readiness after stage 1	Stage 1 response log	52
9.4.2	Conducting the opening meeting	Covers scope, plan, channels, guides and grading	Opening meeting note	28
9.4.4	Obtaining and verifying information	Samples and verifies by interview, observation, record review	Evidence index; a request log	53
9.4.5	Identifying and recording audit findings	Records each nonconformity against a specific requirement	Factual check; disagreement in writing	54
9.4.7	Conducting the closing meeting	Presents conclusions; agrees the response timeframe	Closing pack: attendance, wording, dates	55
9.4.8	Audit report	Issues and owns a written report per audit	Reconciliation against the meeting note	56
9.4.9	Cause analysis of nonconformities	Requires cause analysis, correction and corrective action	Tracker rows carrying all three separately	10
9.4.10	Effectiveness of corrections and corrective actions	Reviews and verifies; states what else is needed	Evidence of closure; verification date	42
9.5.2	Actions prior to making a decision	Checks majors are verified, minors have an accepted plan	Submission split by grade	1
9.6.3	Recertification	Confirms conformity, effectiveness and scope before expiry	Majors verified before the expiry date	57

Clause	Title	Auditee-side activity	Verified
4	Principles of auditing	Read the seven principles before disputing a finding	58
6.3.2	Audit planning	Read the plan against the evidence index	59
6.4.2	Assigning roles and responsibilities of guides and observers	Name and brief one guide per team member	60
6.4.8	Generating audit findings	Check the description and the requirement cited	61
6.7	Conducting audit follow-up	Run cause and action to a verified date	43

Clause	Title	Record the audit samples	Verified
5.3	Organizational roles, responsibilities and authorities	Roles matrix naming who answers for each area	21
7.5.3	Control of documented information	Version, approver, distribution, retention	62
9.2.2	Internal audit programme	Cycle coverage of clauses 4 to 10 and applicable controls	26
9.3.3	Management review results	Minutes recording decisions with owners and dates	49
10.2	Nonconformity and corrective action	Tracker with cause, action, verification, closure date	9
Annex A	Information security controls reference	Every applicable control judged and traceable	63

8. Checklist#

Each item is observable. "Prepared" is not observable; a dated row in a register is.

• The audit cycle plan names each audit, its type and its expected coverage.
• The first surveillance date sits within twelve months of the certification decision date.
• The evidence index has one row per clause and per applicable control.
• Each index row names the record, its producing process, its location and its owner.
• One guide is named per audit team member, and each guide has been briefed.
• Every stage 1 area of concern has a dated action and an owner.
• The internal audit programme and the management review record both predate stage 2.
• The opening meeting note records the scope, channel and grading method.
• Every evidence request is logged with time, record supplied and its index row.
• Every finding was checked against the request log before its facts were agreed.
• Any diverging opinion is recorded in writing, not left as a conversation.
• Every tracker row carries cause, correction, corrective action, owner and due date.
• Every closed row carries evidence of closure, a verification date and a named verifier.
• Major findings are submitted as implemented and verified, not as a plan.

References#

Primary sources only. The two auditing standards were read as published documents; clause numbers and titles are cited and requirement text paraphrased. The management system clause titles were read on the ISO Online Browsing Platform, where they are visible without purchase.

1. ISO/IEC. Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements. ISO/IEC 17021-1:2015. First edition, 2015-06-15, prepared by the ISO Committee on Conformity Assessment (CASCO). Catalogue entry at https://www.iso.org/standard/61651.html; clause numbers and titles read from a licensed single-user copy ⁶⁴
2. ISO. Guidelines for auditing management systems. ISO 19011:2018. Third edition, 2018-07, prepared by Project Committee ISO/PC 302. Catalogue entry at https://www.iso.org/standard/70017.html; contents and clauses 3 to 5.1 read from the publisher's document preview ⁶⁵
3. ISO/IEC. Information security, cybersecurity and privacy protection — Information security management systems — Requirements. ISO/IEC 27001:2022. Contents and clause titles read at https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-3:v1:en ⁶⁶

Retention periods, calendar habits and internal deadlines above are organisational choices, not requirements of any of the three standards.

Standards and certification names are the property of their respective owners. GRCIDE is an independent publication and is not affiliated with, authorized, sponsored or endorsed by ISO, IEC, NIST or any other standards body.