The path to ISO certification: process, phases and best practices for your audit

Introduction: Taking the fear out of the audit process

The decision is made: your organisation wants, or has, to be certified to an ISO standard – whether for information security (ISO 27001), quality (ISO 9001), environment (ISO 14001) or artificial intelligence (ISO 42001).

Yet before the start there is often uncertainty and open questions: How exactly does the external audit run? How long does the process take? And what happens if the auditor finds deviations?

This guide takes you step by step through the entire certification cycle and shows how to steer confidently around typical mistakes.

The 3-year certification cycle at a glance

An ISO certificate is generally valid internationally for three years. The cycle is divided into the following fixed milestones:

[Pre-evaluation / gap analysis] (optional)
             │
             ▼
[Stage 1 audit: document review and readiness]
             │
             ▼
[Stage 2 audit: on-site / remote certification] ──► Certificate issued (3 years)
             │
             ▼
[1st surveillance audit (after 12 months)]
             │
             ▼
[2nd surveillance audit (after 24 months)]
             │
             ▼
[Recertification audit (before the 3 years expire)]

The phases of the initial certification audit in detail

Phase 0: The preliminary assessment (pre-evaluation / gap analysis)

Before the official audit, an optional preliminary assessment is often advisable. An auditor takes an unprejudiced look at your management system to determine whether the system is ready for audit or whether critical gaps still need to be closed. This prevents expensive surprises in the actual audit.

Phase 1: The Stage 1 audit (readiness assessment)

In the Stage 1 audit the certification body primarily reviews your documentation:

• Are the policies, process descriptions and scopes defined in conformity with the standard?
• Has an internal audit already been carried out?
• Is there a management review?
• Is the organisation ready for the main audit?

Result: you receive a report with pointers to any gaps. These can be closed before Phase 2.

Phase 2: The Stage 2 audit (main audit / certification audit)

The audit team now checks on site (or remotely, where the conditions allow) whether the management system is actually lived in practice:

• Interviews with employees from different departments (from leadership level down to case handlers)
• Sample checks of real projects, tickets, supplier documents or system configurations
• Inspection of the sites, server rooms or production halls

Result: if there are no major nonconformities, the audit team recommends that the ISO certificate be issued.

Phases 3 and 4: The annual surveillance audits

A management system must not go to sleep after certification. After 12 and 24 months the certification body checks, in shorter surveillance audits, whether the system is continually maintained and improved.

Phase 5: Recertification

Before the 3-year period of validity expires, a comprehensive recertification audit takes place, which restarts the cycle for a further three years.

The 4 most common stumbling blocks in the audit – and how to avoid them

1. Actions from internal audits that have not been closed:
   Problem: Defects were found in the internal audit, but no corrective actions were taken before the external audit.
   Solution: Assign an owner and a realistic deadline to every deviation. The auditor checks precisely whether you take defects seriously.
2. Contradiction between documentation and lived practice:
   Problem: The manual says: “Every code release is countersigned by the security officer.” In the interview the developer says: “We stopped doing that two years ago.”
   Solution: Adapt documents to reality. A pragmatic, lived process is a hundred times better for the auditor than a theoretical ideal process.
3. Missing evidence and records:
   Problem: Training or emergency drills were carried out, but documented nowhere.
   Solution: “If it is not written down, it did not happen.” Keep simple attendance lists and short minutes.
4. Exam anxiety in the team:
   Problem: Employees react nervously or freeze in the interview.
   Solution: Prepare the team mentally: auditors are not police officers hunting for faults, but independent companions who want to confirm the conformity of the system as a whole.

Conclusion

An ISO audit is not an insurmountable obstacle, but a project that can be planned clearly. With structured preparation, a healthy self-assessment and the right certification partner, the procedure becomes a valuable stocktake that measurably moves your organisation forward.

Start your certification process now:
Use the ICB network of more than 178 specialist auditors in more than 48 countries for your next audit. Submit a no-obligation enquiry today via our pricing page.