If the word “audit” makes you nervous, you are in good company. It is one of the most common things I hear from small business owners across Kent when their certification date starts creeping up on the calendar.
But an ISO audit does not have to be the stressful experience most people expect. If your system is working the way it should be, the audit is simply someone coming in to confirm that. The businesses that struggle are usually the ones who have built a system that looks great on paper but does not match how the business actually runs day to day.
So here is what I have seen work, what auditors are really looking for, and how to go into your audit feeling prepared rather than panicked.
What is an ISO Auditor Actually Looking For?
The auditor is not trying to catch you out. Their job is to check that your management system, whether that is ISO 9001, ISO 14001 or ISO 45001, is real, working and improving over time.
They will look at three things: –
- Your documentation. Does it exist, is it current and does it reflect how you actually work?
- Your people. Do your team understand the system and their role within it?
- Your evidence. Can you show that the processes in your documentation are actually being followed?
That last one is where most small businesses come unstuck. Having a procedure written down is not enough. You need to show it is being used.
The Most Common Mistakes Small Businesses Make Before an ISO Audit
Leaving Everything Until the Last Minute
A management system that has been neglected for eleven months and frantically updated in the weeks before an audit is obvious to an experienced auditor. The records will not add up and the team will not know the answers to basic questions.
Not Completing Your Internal Audit
An internal audit is a requirement of the standard, not optional. It is also one of the best things you can do to prepare because it finds the gaps before the certification body does. Many small businesses skip it or rush through it and then regret it.
Management Not Being Engaged
Auditors will want to speak to whoever leads the business. If senior management cannot demonstrate they understand the system and are actively involved in it, that is a problem.
What to Do in the Weeks Before Your Audit
Review Your Internal Audit Findings and Close Any Outstanding Actions
Go back through any nonconformities or observations from your last internal audit. If actions were agreed, make sure they have been completed and documented properly.
Check Your Documentation is Current and Reflects How You Actually Work
Out of date procedures, old version numbers and unsigned documents are easy wins for an auditor to flag. Do a quick sweep and make sure everything reflects current practice.
Brief Your Team Before the Auditor Arrives
Your employees do not need to know the standard inside out but they should understand what they do, why they do it and where the relevant records are kept. A nervous team that cannot answer basic questions does not give an auditor confidence.
Review Your Management Review Records
This is a common area where small businesses fall short. Your management review needs to cover the right topics and be properly recorded. If it was done informally with no notes taken, that will not satisfy the auditor.
Know Where Your Evidence is Before the Day
Know where everything is and make sure it is accessible. An auditor asking to see something and being met with a frantic search through old emails does not look good.
On the Day Itself
Stay calm and be honest. If you do not know the answer to a question, say so rather than guessing. Auditors are experienced at spotting when someone is winging it and an honest “I am not sure, let me find that for you” is far better than a confident wrong answer.
If a finding is raised, do not panic. Minor nonconformities are not the end of the world. They give you something concrete to improve before your next surveillance or recertification audit.
A Word on Internal Audits
One of the best things a small business can do before any ISO audit is carry out a proper internal audit first. Not a quick checkbox exercise but a genuine look at whether the system is working as it should.
The standard says you cannot audit your own system, which is where having an independent consultant carry out your internal audit makes a real difference. A fresh pair of eyes will find things you have become blind to, and finding them before the certification body does is always the better outcome.
If you are a small business in Kent and you want support with your internal audit or audit preparation, that is exactly what I do. Get in touch here.
FAQ
How long does an ISO audit take for a small business?
The time is takes a small business to be audited for ISO 9001,14001, 45001 varies depending on the size of the business, how many full time employees there are, how many sites and how many standards. If you are a typical business going for 1 standard certification audits may be 2 days and surveillence 1 day.
What happens if I fail my ISO audit?
You cannot technically fail an ISO audit outright. If significant nonconformities are found, the certification body will give you time to address them before making a certification decision. Minor nonconformities are noted and followed up at your next surveillance visit. The key is to go in properly prepared so that any findings are minor rather than major.
Do I need to do an internal audit before my certification audit?
Yes. An internal audit is a requirement of ISO 9001, ISO 14001 and ISO 45001. You must be able to show evidence that an internal audit has been completed before your Stage 2 certification audit takes place.
Can I do my own internal audit?
The standard requires that your internal auditor is independent from the area being audited. For most small businesses that means you cannot audit your own work. Many small businesses use an external consultant for this reason, which also means the findings are more objective and credible.
How do I know if my business is ready for an ISO audit?
A good indication is whether your internal audit found significant gaps. If your system is being followed consistently, your records are up to date and your team can talk confidently about what they do and why, you are likely in good shape. If you are not sure, a gap analysis before your audit date is a sensible investment.
