ISO 9001 certification audit: what to expect and how to prepare

The certification audit is usually the most nerve-wracking moment in the whole process — and, almost always, it turns out less daunting than expected if you've arrived well prepared. Here's what actually happens.

Who does the auditing

The audit is carried out by an independent certification body, accredited in Spain by ENAC (the National Accreditation Body), to guarantee the auditor is competent and impartial. It's not done by your consultant, precisely so the certificate holds real value with third parties.

Stage 1: document review

The first visit (or remote review, depending on the body) checks that your document system is complete and that you're ready for stage 2: that the scope is well defined, that the minimum required records exist, and that there are no serious gaps that would waste time in the next stage. If something's missing, the auditor points it out and gives you room to fix it before continuing.

Stage 2: day-to-day verification

Weeks after stage 1, the auditor visits your company and checks that the system isn't just paper: they interview staff from different roles, review real records (training, indicators, non-conformities), and observe how things actually work in practice. This is where it shows whether the team has internalized the system or only the person who wrote it knows it.

What the auditor typically asks for

• Evidence that internal audits and a management review have been carried out.
• Training records for staff relevant to their role.
• Real examples of non-conformities found and how they were closed.
• Results for indicators and quality objectives, even if not all were met — what matters is that they're measured and analyzed.
• Staff being able to explain, in their own words, how the system affects their daily work.

How to actually prepare

• Don't improvise the week before. A system that's been generating real evidence for months defends itself; one dressed up at the last minute doesn't.
• Prepare the team, not just the documentation. The auditor talks to people, not just reads papers.
• Don't hide non-conformities. Having non-conformities found and well managed is a sign the system works — hiding them is far worse than showing them resolved.

What happens if they find a non-conformity?

It depends on severity. A minor non-conformity (a one-off or partial failure) usually still allows certification, with a deadline to fix it and document that you have. A major non-conformity (something systemic, or affecting a key requirement of the standard) can delay certification until it's fixed and verified. It's not the end of the world — it's exactly the kind of situation the corrective action process exists for.

After certification

The certificate is valid for three years, but the certification body carries out shorter annual surveillance audits to check the system is still alive — plus a full recertification audit at the end of the cycle.