The audit is the part of ISO certification most businesses worry about, usually because no one has explained what it involves. It's more structured, and less adversarial, than people expect. Here's exactly what happens, who does it, and how to be ready.
Who runs the audit
The certification audit is carried out by an independent, accredited certification body, not by your consultant. That separation is the point: the auditor's job is to verify, impartially, that your management system meets the standard. A consultancy like IMSM gets you ready for that audit and supports you through it, but can't sit in the auditor's chair. See what is ISO certification for how accreditation makes the certificate trusted.
Before the audit: gap analysis and internal checks
Well before the certification body arrives, two things happen. A gap analysis compares how you currently operate against the standard and identifies what's missing. Then, once the system is built and running, you run your own internal audit and a management review, checking the system yourself so nothing is a surprise when the external auditor looks.
Stage 1: the documentation review
The certification audit itself happens in two stages. Stage 1 is a readiness check: the auditor reviews your documented system, confirms the scope, and makes sure you're genuinely ready for the full audit. It's also where they flag anything that would stop Stage 2 going smoothly, so you have time to fix it.
Stage 2: the certification audit
Stage 2 is the main event. The auditor looks for evidence that your system is not just written down but genuinely in use: they interview staff, sample records, and trace how you handle things like non-conformance, supplier management and improvement. If the system meets the standard, the certification body issues your certificate.
What auditors actually look for
Less "gotcha", more "show me". Auditors check that what the standard requires is happening in practice and that you can evidence it. Findings are graded: a minor non-conformity is a small gap you correct within an agreed time; a major non-conformity is a significant failure that must be closed before the certificate is issued. A clean audit with a couple of minor findings is a normal, good outcome.
After certification: surveillance and recertification
Certification isn't one-and-done. The certificate runs on a three-year cycle: the certification body returns for lighter surveillance audits (usually annually) to confirm the system is still working, then a fuller recertification audit at the end of the three years. Budget for these ongoing audits from the start, see what ISO certification costs in Australia.
How to walk in ready
The businesses that find the audit painless are the ones whose system reflects how they actually work, rather than a manual written for the auditor and never used. That's exactly what a done-for-you build aims for: a lean system your team uses day to day, so the evidence the auditor wants already exists. We also attend and support you through the audit itself.
Want to be audit-ready without the guesswork?
Get my fixed-fee quote →Tell us your standard, your headcount and your sites, and we'll scope the whole path to a successful audit for a single fixed fee, quoted within 24 hours. Start here.