Passing the Certification Audit: stage 1, stage 2, surveillance, recertification

14 modules · about 79 minutes · final test with 37 questions, 30 correct to pass · certificate of participation as PDF

What this course is about

The certification audit is the day the whole QMS was built for – and the day small companies respect most. Wrongly, if you know how it runs: an auditor of the certification body checks the documentation in stage 1 and the company in stage 2, according to a plan he sends beforehand, with questions that have been the same for 30 years.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 14

The certification procedure: application, stage 1, stage 2, decision, surveillance, recertification

The procedure is the same for all accredited certification bodies — it is in ISO/IEC 17021-1, and the accreditation body checks that they keep to it. Whoever knows it knows at every point what comes next.

Timeline initial certification (empirical value): enquiry week 0 · contract week 2 · stage 1 week 6 · stage 2 week 10 · certificate week 14. With pressure six weeks, at leisure three months. The critical path is the audit date — certification bodies are often booked eight weeks ahead.

Non-accredited bodies follow the same basic sequence, often shortened: one audit (online), certificate for one year, annual renewal with audit. No accreditation mark, but the same standard and the same documentation — which is why a change in either direction is possible at any time.

📄 The three-year cycle with timeline, phases, participants and deliveries of the company (German – English version to follow)

The one sentence that changes everything: the auditor is not looking for errors in order to fail you — he is looking for evidence in order to be able to certify. The certification body earns from certified customers over three years, not from failed ones. Whoever has evidence and knows where it is, passes.

Module 2 of 14

Accredited or not: what the mark means and who needs it

An accreditation is the authorisation of a certification body by the national accreditation body (in Germany DAkkS, in the UK UKAS, in the USA ANAB, and so on) — it checks that the body works to ISO/IEC 17021-1 and allows it to put the accreditation mark and the IAF mark on the certificate. The mark says: this body has itself been checked. It says nothing about whether the company is better than one certified without accreditation.

When accredited is necessary — and how you find out: read the wording of the requirement. If it says “accredited”, the name of the accreditation body, “IAF” or “under ISO/IEC 17021”: yes. If it says “certified to ISO 9001”, “e.g. EN ISO 9001”, “or equivalent”: in practice usually no — but ask the customer and record the answer in writing (checklist in the course “Deciding on ISO 9001”). Public tenders under procurement law frequently demand “accredited”; industrial customers with supplier evaluation often do too; craft and service customers almost never.

The two-stage route: first non-accredited (fast, inexpensive, certificate in weeks), after one year of a practised system switch to an accredited certification body when a customer demands it. Documentation and evidence are the same; the accredited audit becomes easier with a year of records.

Checking whether a certificate is genuine: accredited certificates are listed in IAF CertSearch and in the database of the body; non-accredited ones in the database of the body (QR code on the certificate). A certificate without a verifiable number, without scope or without expiry date is worthless — and a “certificate without audit” for a fee is fraud on the company's customers.

What plays no role: the size of the body, the logo, the name. An accredited certificate of a small regional body is as valid as that of a large one — that is the point of accreditation.

Module 3 of 14

Choosing a certification body: comparing quotations with the anonymised price survey

Certification bodies calculate by audit time × day rate + ancillary items — and with accredited bodies the audit time is not a matter of negotiation but is in IAF MD 5: by effective number of employees.

Effective employees: full-time = 1, part-time = 0.5, casual = 0.25; seasonal staff by peak; temporary workers count. With two sites with the same activities sampling is possible (IAF MD 1). Complexity may lower the time by up to about 30 % (simple service, no design) or raise it.

The price survey — 178 quotations from 14 bodies to small companies in Germany, 2021 to 2026, anonymised into ranges (net, in euros, one site, ISO 9001 alone, as of October 2026). Day rates in other countries differ, but the proportions between the sizes and between year 1 and surveillance are similar everywhere:

What explains the ranges: day rate 1,100 to 1,600 euros (large houses at the top, regional bodies at the bottom) · ancillary items: certificate fee 150 to 400, items “preparation”, “report”, “administration”, travel costs by expense · online audit saves travel costs, not audit days · combination with 14001/45001: integrated audit 20 to 30 % cheaper than separate · second site 0.5 to 1 day.

The ten questions to the certification body (before signing the contract, answers in writing): audit time and day rate separately? All ancillary items? Travel costs flat rate or by expense — auditor from the region? Prices fixed for all three years? Online audit possible (stage 1, surveillance)? Who is the auditor, sector experience? Deadline for closing nonconformities? Certification decision in how many weeks? Termination at the end of the cycle, change possible? Accreditation certificate and scope of the body (does it cover my sector)?

📄 Price survey (anonymised) and quotation comparison over three years with formulas — three quotations side by side (Excel) (German – English version to follow)

Compare over three years, never over the first: a quotation with a cheap year 1 and expensive surveillance audits costs more in the cycle. The Excel converts three quotations side by side to the three-year price.

Status of the figures: October 2026; ranges are empirical values from the German market, not a price list of any provider.

Module 4 of 14

Application, contract and the certification body's audit plan

After the quotation come two documents the company reads carefully — and one it fills in carefully.

The application questionnaire (9.1.2) is the basis of the audit time and of the certificate. Details that must be right:

The certification contract regulates for three years: access for audits (also unannounced in case of complaints), duty to inform of significant changes (legal form, site, scope, number of employees considerably changed), rules on the use of certificate and mark, complaint and appeal procedure, termination (usually only at the end of the cycle), payment. Check two things: are the prices of all three years fixed? What happens if you fail (follow-up audit, costs)?

The certification body's audit plan comes two to four weeks before the audit (9.2.3): date, times, clauses per time block, requested interview partners, place (on site / online). A typical stage 2 plan for a company with 12 employees:

Feedback on the plan: if an interview partner is missing (holiday), a time block is too short or the order does not fit the company (production runs only in the morning), the company writes back immediately. The auditor gladly changes the plan — but not on the audit day.

📄 Checklist for the application questionnaire and contract review — the details that must be right (German – English version to follow)

Module 5 of 14

Stage 1: the document review — what the auditor reads and what he makes of it

Stage 1 is not an examination you have to pass — it is the readiness review: the auditor determines whether the system is far enough for stage 2 to make sense, and plans stage 2. The standard names the objectives (9.3.1.2.1): review the documentation, understand the site and special features, evaluate the status of implementation (above all KPIs, processes, objectives, internal audit, management review), plan resources for stage 2, and name points that could become nonconformities in stage 2.

What must be available — and what the auditor does with it:

The rule behind it: internal audit and management review must have taken place before stage 1 — with real evidence. A system needs at least three months of operation for records to exist (orders, complaints, KPIs, briefings). Whoever books stage 1 too early gets the point “implementation not verifiable” and loses time.

The stage 1 report names “areas of potential nonconformity” — these are not nonconformities but notes on what is to be clarified by stage 2. They are worked through and brought to stage 2 with evidence. The interval to stage 2: two to eight weeks — long enough for the points, short enough that nothing changes.

Online or on site: stage 1 is possible online with most bodies (screen sharing, documents in advance); stage 2 with production usually on site, with pure service providers often online. That is in the quotation.

Preparation in one hour: annual folder (course Management Review) as a PDF package or share link; manual with current status; handover sheet on top. The auditor who gets a handover sheet knows where to look — and notes that as a strength.

📄 Stage 1 checklist: the documents, the auditor's check points, the typical stage 1 points and how to resolve them (German – English version to follow)

Module 6 of 14

The 20 places where small companies fail in the certification audit

Certification auditors always find the same places in small companies — not because the companies are bad but because the evidence is missing. The ranking from more than 1,000 accompanied audits, with the evidence that closes each place:

Major nonconformity candidates (a whole clause not implemented or systematic failure): internal audit not carried out (6) · management review not carried out (7) · no supplier evaluation of critical suppliers (2) · release without inspection of safety-relevant products (12) · complaints systematically not recorded (9). Everything else usually becomes a minor nonconformity.

📄 The 20 places as a ten-minute check before the audit — per place evidence, location, done (German – English version to follow)

The check before the audit: print the 20 lines, fetch the evidence per line and note the location. What is not found in ten minutes, the auditor does not find either — and that is the finding. Empirical value: companies that pass this check with 18 of 20 get at most minor nonconformities in the certification audit.

Module 7 of 14

Stage 2: the audit day — opening, walk-through, interviews, closing

Stage 2 is the day in the company. The auditor follows his plan (module 4), and the day has three fixed parts:

Opening meeting (15 minutes): the auditor introduces himself, confirms scope and plan, explains how he classifies findings and what happens at the end, asks about changes since stage 1 and about safety and confidentiality rules. The company introduces the MD, the quality manager and the contact persons and says where the auditor works (a room with a table, a socket, access to the annual folder — not the boss's office with the telephone).

Conducting the audit (6 to 7 hours): according to plan — interview with management, walk-through, interviews per process. The method is always the same: “Take your last …” — order, complaint, goods receipt, new employee, measuring instrument. Then he follows the case through the evidence. For the company that means: the last order must be presentable — not the best one.

The walk-through is the part you cannot prepare — and the part that decides. The auditor sees: drawing revision at the workplace, measuring equipment with or without label, quarantined part with or without identification, customer-supplied item with or without order number, inspection labels on forklift and ladder, policy on display, cleanliness. And he talks to the employee: “What are you doing right now, how do you know how to do it, what happens if something does not fit?” Three questions that check 8.5.1, 7.2 and 8.7 in two minutes.

Accompanying person: the quality manager accompanies the whole day, notes every question and every finding, fetches evidence and organises interview partners. The MD is present at the beginning, for clauses 4–6 and 9.3 and at the end — not the whole day (that looks like control). A consultant may be present but does not answer for the company.

Closing meeting (30 minutes): the auditor summarises: strengths, findings with classification and clause, next steps (deadlines, decision), recommendation to the certification body. For every finding the company asks which evidence is expected for closing — and notes it. Arguing about the classification is pointless; an appeal goes formally through the body (contract) and is practically never necessary for small companies.

📄 Audit day: sequence, ten rules of behaviour, room and evidence, walk-through check, employee preparation in 20 minutes (German – English version to follow)

Preparing employees — 20 minutes in the meeting before the audit: what an audit is (not a test of the person), the three questions of the walk-through, “answer in your own words”, “I don't know” is allowed, where policy and objectives are displayed. Do not learn answers by heart — auditors notice that within a minute.

Module 8 of 14

Major and minor nonconformity: what the classification means and how to close

Every finding of the certification auditor has one of three classifications — and the classification decides what is to be done by when:

The action record — one sheet per nonconformity that the auditor expects (and which is identical to the complaint sheet of the course “Complaints”):

1. Correction: what was fixed immediately (label attached, record made up, order confirmation sent)?
2. Cause: why could it happen (five whys — “no rule”, “no deputy”, “list not maintained”)?
3. Corrective action: what prevents the repetition (rule, list, check point, briefing)?
4. Evidence: proof of implementation (changed template, record, list with date, photo).
5. Effectiveness: when and with what will it be checked (for the action plan).

For major nonconformities the auditor checks points 1 to 4 before the decision — usually from documents, for workshop topics by a short follow-up audit (half a day, chargeable). For minor nonconformities the plan suffices (points 1 to 3 with date); points 4 and 5 he checks in the surveillance audit.

The eight misconceptions small companies have about nonconformities:

📄 Action record per nonconformity (correction, cause, corrective action, evidence, effectiveness) with two completed examples (German – English version to follow)

Module 9 of 14

The certification decision, the certificate and its logo

After the audit it is not the auditor who decides on the certificate — 17021-1 requires that a person or a committee not involved in the audit reviews the report and the actions and decides (9.5.1). That is the second safeguard of the procedure: the auditor recommends, the body decides.

Sequence: audit report (usually within two weeks) → company closes major nonconformities and submits action plans for minor ones → auditor evaluates → certification decision (two to four weeks) → certificate by post/PDF, entry in the database of the body (and, for accredited ones, in IAF CertSearch).

What is on the certificate — and what the company checks before it uses it:

Use of certificate and mark (regulated in the contract, 17021-1 clause 8.3): permitted on letterhead, website, quotations, vehicles, exhibition stands — always with reference to the company. Not permitted: on the product, the packaging or test reports in a way that could be understood as product certification; not for sites or activities outside the scope; not after suspension or withdrawal. The mark of the body and the accreditation mark only in the form supplied by the body.

Suspension and withdrawal (9.6.5): the body suspends the certificate if surveillance audits do not take place on time, major nonconformities are not closed or marks are misused — usually with six months to remedy, then withdrawal. In practice: keeping surveillance dates is the whole art.

Making the certificate known internally: team meeting (the team earned it), display, customer information (e-mail to main customers with PDF — gladly with a note on the scope), website, signature, Google Business Profile. A certificate that only lies in the folder has missed its purpose.

📄 Checklist certificate: check details, rules of use, announcement, dates for the annual calendar (German – English version to follow)

Non-accredited certificates: same details, without accreditation/IAF marks, often valid for one year with annual renewal after audit, verifiable via QR code and the database of the body. The same rules of use apply.

Module 10 of 14

Surveillance audit and recertification: the cycle after the certificate

The certificate is valid for three years — on condition that surveillance takes place annually. The cycle:

Date traps: surveillance 1 counts from the decision, not from the audit day · recertification needs audit and decision before expiry — so audit three months beforehand · auditor's holiday, company holidays, season: dates half a year in advance. The annual calendar (course Management Review) contains the dates.

Recertification from 2027: recertifications from 2027 are carried out to ISO 9001:2026 — recommendation of the Academy, at QM-Dienstleistungen Holger Grosser and OnlineCert binding from 1 January 2027. Frame under Global ACI: accredited bodies certify to 2026 as soon as their accreditation decision is in place (at the latest 30 September 2027); from 31 March 2028 new and initial certifications only to 2026; transition by 30 September 2029. A 2015 certificate ends on 30 September 2029 at the latest — even if it was issued only in 2027.

What the auditor asks first in the surveillance audit: “What became of the findings of the last audit?” The action plan with status and effectiveness is the answer — which is why every audit day begins with it. Then: changes (personnel, sites, products, scope), internal audit and management review of the year, complaints, KPIs, samples according to plan. A company with a complete annual folder and handover sheet is done after four hours.

Duty to inform (contract, 17021-1 clause 8.5): report significant changes unprompted — legal form, owner, address, site new or closed, scope extended (new service), number of employees considerably changed (audit time), significant changes to the system. An e-mail suffices; unreported changes are a finding in the audit and can make the certificate invalid for the new site.

Changing the certification body: possible within the cycle — with accredited bodies as a transfer (IAF MD 2): the new body checks the valid certificate, the last audit report and open nonconformities, carries out a transfer audit (often as surveillance) and issues its own certificate with the original expiry date. Reasons: price, auditor, service, merger of the body. At the end of the cycle the change is without transfer: new initial certification with stage 1 (often shortened) and 2. From a non-accredited to an accredited certification body: new initial certification, but with three years of records — the audit becomes easy.

📄 Date planner certification cycle (Excel): decision, surveillance 1 and 2, recertification with deadlines and lead times (German – English version to follow)

Special audits (9.6.4): audits announced at short notice in case of complaints, after changes or to lift a suspension — rare for small companies; the contract allows them.

Module 11 of 14

The online audit: technology, evidence, walk-through by camera

Since 2020 online audits have been everyday practice — IAF MD 4 regulates when and how certification bodies may use information and communication technology. For small companies that means:

Technology: video conference (the body specifies the system), screen sharing for documents, a second device (smartphone, tablet) with camera for the walk-through — the auditor says where he wants to look; the quality manager walks through workshop or warehouse with the camera, shows measuring equipment, labels, identification, talks to employees in front of the camera. Test a stable connection in the company beforehand.

Preparation:

1. Documents as a share link (annual folder as PDF package, manual, lists) two days in advance — or screen sharing with the folder open; never “I'll send it afterwards”.
2. Contact persons per time block sit ready (the auditor's plan); change without searching.
3. A quiet room, one device for the conference, a second for documents, camera device charged.
4. Evidence from the company photographed in advance (labels, display, quarantine shelf) — as a supplement, not as a replacement for the camera walk-through.
5. Data protection: show customer data only as far as necessary (order file with customer name is usual; personnel files only the records); no recording of the audit without the consent of both sides.

Typical mishaps: document not found (the folder structure from the course Manual solves that) · screen sharing shows the inbox (second screen or share only the window) · camera walk-through with echo and backlight (test beforehand) · employees do not know that they will be interviewed in front of the camera (meeting beforehand).

What does not work online: smelling cleanliness, feeling stock levels, seeing the inspection station out of the corner of your eye. Auditors know that and ask online more precisely for proof — more documents, less impression. For a company with good records that is an advantage.

📄 Checklist online audit: technology, documents, room, camera walk-through, data protection (German – English version to follow)

Module 12 of 14

Practice case: Waldner Joinery — playing through the stage 2 audit

Waldner Joinery (fictitious) — 14 employees, windows and front doors, interior fit-out and made-to-measure furniture, CNC, two installation teams — has been certified to ISO 9001 by a non-accredited body since March 2024. A new major customer demands an accredited certificate; so Waldner changes at the end of the cycle to an accredited certification body — for it that is an initial certification with stage 1 and stage 2. Prepared according to this course series: manual 28 pages, four lists, internal audit in October, management review in November, stage 1 online in December without points. Stage 2 takes place on 20 January 2027 on site, one auditor, 2.5 days are planned as 1.5 days stage 2 (stage 1 was one day).

What is available (download 11): the certification body's audit plan · the course of the day as minutes: 25 questions of the auditor with the answers of the company and the evidence shown · three situations the auditor noted:

1. During the walk-through a drawing rev. A lies at the CNC workplace, the order folder names rev. B (cable duct); the operator says the new drawing is “not printed yet”. In the change register of the manual the rule “change note withdraws the old drawing” has stood since November; in three further folders checked the revision is right.
2. The subcontractor for cutting (class A, outsourced) has had grade 5 (the worst grade) for quality in the supplier evaluation for two years; the action “look for an alternative” has been “open” since 2025; the defect tally sheet shows six supplier defects of the subcontractor in the year; goods receipt checks its deliveries with inspection level 1 (visual).
3. The qualification matrix names for “final inspection and release” the foreman (3) and journeyman 1 (2); the inspection record of order 2026-187 bears the initials of journeyman 2 (level 1 — in training), while the foreman was ill. The briefing record of journeyman 2 shows “final inspection demonstrated on 10 December, independent from –”.

Your task (90 minutes):

1. Classify the three findings (major / minor / observation) and give reasons with clause and the definition from module 8.
2. Write the action record for each finding (correction, cause, corrective action, evidence, effectiveness).
3. Decide as the certification body: certificate immediately, after closing, or repeat stage 2?
4. Which three strengths would the auditor note?

📄 Waldner: audit plan, minutes of the audit day with 25 questions and evidence, three findings to classify (German – English version to follow)

📄 Waldner: model solution — classification with reasoning, three action records, certification decision, strengths (German – English version to follow)

Where most people go wrong: finding 1 is a minor nonconformity (isolated case; the rule exists and works in three of four folders) — not major · finding 2 is the major nonconformity: critical supplier with systematic defects for two years without action and with too low an inspection level — 8.4.1/8.4.2 systematically not fulfilled · finding 3 is a minor nonconformity on 7.2/8.6 (release by a person not authorised in an isolated case) — and the corrective action is not “train journeyman 2 faster” but “deputy rule: if the foreman is absent, journeyman 1 releases; journeyman 2 only intermediate inspection until authorised”.

Time balance Waldner: major nonconformity closed in six weeks (subcontractor changed after sampling, inspection level 3 for cutting, supplier evaluation with mandatory action from grade 4 in the manual); evidence by documents, no follow-up audit; certificate eight weeks after stage 2.

Module 13 of 14

Evidence: the annual folder for the certification body — and the calendar until recertification

Everything the certification body needs lies in the annual folder from the course “Management Review and Year End” — and the handover sheet on top tells it where to look. Before the audit (stage 1 or surveillance) the company delivers as a share link or PDF package:

The four-question preparation — per clause (4 to 10) four questions the quality manager asks himself: which document proves it? Where is it? Who answers the auditor's question? What is the “last case” I show? A table with seven lines, one hour before the audit — and the day runs.

The certification calendar over three years:

Retention: audit reports of the certification body at least 3 years (one certification cycle); certificates and action records 10 years. They prove the certification history to customers and authorities and are the basis of the transfer when changing the body.

📄 Certification readiness grid: 20 criteria before stage 1 / stage 2 / surveillance (German – English version to follow)

Below 28 of 40: do not book stage 1 yet; work through the 20 places (module 6). From 34: book the audit — the system is ready.

What follows: ISO 9001:2026 (published 16 September 2026). Under the transition rules of Global ACI, from 31 March 2028 accredited initial certifications are issued only to 2026; existing 2015 certificates must have made the transition by 30 September 2029 — in the surveillance or recertification audit. Recommendation of the Academy: recertifications from 2027 are carried out to ISO 9001:2026 (binding at QM-Dienstleistungen Holger Grosser and OnlineCert). The course “Transition to ISO 9001:2026” shows what changes and how the transition fits into the surveillance audit.

Module 14 of 14

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

37 questions, one correct answer each. You need 30 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result