Stage 1 and Stage 2 audits: what to expect at each

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

Certification is a two-stage audit, and the two stages examine different things. Preparing for the wrong one is the most common way companies get an unpleasant surprise.

This applies to both ISO 14001 (environmental management) and ISO 45001 (occupational health and safety management). Your auditor comes from your certification body, which is also called a registrar.

Stage 1: are you ready?

The requirements for Stage 1 come from the international standard that certification bodies must follow (ISO/IEC 17021-1, clause 9.3.1.2.2). At this stage the auditor is judging whether you are ready, not whether you comply.

The auditor will:

• Review your management system documentation
• Evaluate the conditions at your site and your preparedness for Stage 2
• Review how well you understand the requirements of the standard, focusing on how you identified key performance, significant aspects, processes, objectives and operation.
• Gather information on your scope, processes, locations, and the legal and regulatory requirements that apply to you
• Review the resources you have allocated for Stage 2 and agree on the details
• Evaluate whether your internal audits and management review are being planned and performed

That last item is where companies get caught. The Stage 1 auditor must evaluate whether internal audits and management review are being planned and performed, so "we'll do those before Stage 2" is the wrong answer at Stage 1.

The standard does not require a completed audit cycle by then. In practice, though, most certification bodies want at least one internal audit under way and a management review held or firmly scheduled. Teams often treat both as Stage 2 homework and arrive at Stage 1 with neither.

Stage 1 typically takes 1 day, and is sometimes conducted remotely or partly remotely.

What to expect: Stage 1 findings are normal and expected, because this is a readiness review. Findings here are cheap, while the same gaps found at Stage 2 are expensive.

Stage 2: does it work?

Stage 2 has its own clause in the certification bodies' standard (clause 9.3.1.3). Its purpose is to evaluate implementation and effectiveness, meaning whether the system is in place and whether it works.

The auditor will assess:

• Information and evidence that you conform to all requirements of the standard
• How you monitor, measure, report and review performance against key performance objectives and targets
• Your management system and performance with regard to legal compliance
• Operational control of your day-to-day work
• Internal auditing and management review
• Management responsibility for your policies

"Effectiveness" is the word that matters. Stage 1 was a document review, and Stage 2 is not. It asks whether the system is running and producing results, and the answer comes from records, interviews and what the auditor observes on the floor.

Expect the auditor to interview people who are not managers. For ISO 45001 that is no accident, because clause 5.4 of that standard requires consultation and participation of non-managerial workers, and the most direct way to verify it is to ask them.

Stage 2 typically takes 1 to 3 days, or more depending on size and scope.

Between the stages

The interval is usually 2 to 8 weeks, which is long enough to close Stage 1 findings but not so long that the Stage 1 picture goes stale. If your interval is much longer, the certification body may need to revisit its Stage 1 conclusions.

After Stage 2

The auditor classifies each nonconformity as major or minor. Major nonconformities must be corrected, with evidence, before a certification decision. Minor nonconformities typically need a corrective action plan, which is verified at the next surveillance audit (the yearly audit that follows certification).

The certification decision is made by someone who was not on the audit team. The decision makers must be different from the people who carried out the audit, and must have appropriate competence (clause 9.5.1.1). That is why your auditor cannot tell you on the last afternoon that you passed.

Then the cycle repeats

• A 3-year cycle, beginning with the certification decision (clause 9.1.3.2)
• A surveillance audit at least once a calendar year, except in recertification years. The first surveillance audit takes place no more than 12 months from the certification decision date. Both requirements are in clause 9.1.3.3.
• What a surveillance audit must cover (clause 9.6.2.2). It is an on-site audit, though not necessarily a full audit of the system.
• Recertification (the renewal audit), planned to be completed before your certificate expires (clause 9.6.3)

If you let a certificate lapse, you may be starting over, not renewing. → What drives certification cost and timeline

How to prepare

For Stage 1: have the documented system complete, internal auditing genuinely under way, and a management review held or scheduled. For ISO 14001, know your significant environmental aspects, and for ISO 45001, know your hazard identification and risk assessment. In both cases, know them well enough to explain them without reading from the document.

For Stage 2: have records, because every clause you claim to meet should have evidence that it ran. Make sure floor staff know the policy exists and understand their part in it, and for ISO 45001, make sure they can describe how they were consulted.

For both: do not over-document, because a system with fewer procedures that people actually follow audits better than a complete manual nobody has read. Auditors quickly find the gap between the document and the practice, and that gap is where findings come from.