Initial certification
| Stage | What is examined |
|---|---|
| Stage one | Readiness: scope, documentation, the register of legal requirements, has an internal audit been done, has a management review been held |
| Stage two | Effectiveness: evidence on site, in records and in interviews that the system works |
What most often stops stage one is that the internal audit and the management review have not yet been carried out. Both are requirements of the standard itself, and the external audit looks for them.
After the certificate
- Surveillance audits — at regular intervals through the cycle, narrower in scope.
- Recertification — at the end of the cycle, a broader audit of the whole system.
- Special audits — after a major change, a serious complaint or an incident.
Relation to the internal audit
An internal audit is not a rehearsal for the external one — but done well it finds most of what the external audit would raise. The reverse holds too: every finding raised externally also raises the question of why the internal audit did not see it.
The scope statement
A certificate's scope states which activities and which sites it covers. Referring to the certificate for an activity outside that scope causes problems both commercially and at audit.
Preparation
The most useful preparation is to take the clauses one by one and write beside each the record that satisfies it. Any clause left blank is a finding to close before the audit.