Introduction
Preparing for an ISO certification audit requires more than simply reviewing documents. An internal audit allows an organisation to evaluate whether its management system is properly implemented, maintained and aligned with the requirements of the relevant ISO standard.
By conducting an internal audit before the certification audit, organisations can identify nonconformities, address weaknesses and ensure that there is sufficient evidence to demonstrate that their processes are working effectively.
What Is an Internal Audit?
An internal audit is a systematic and documented process used to evaluate whether an organisation’s management system conforms to defined requirements and is effectively implemented and maintained. The audit should be based on objective evidence such as documents, records, interviews and observations of actual processes. It should also be conducted objectively and impartially. An internal audit is not simply a document-checking exercise. Auditors should compare what is required, what is documented and what is actually being done.
Why Is an Internal Audit Important Before ISO Certification?
A certification audit is conducted by an independent certification body. Before reaching that stage, an internal audit gives the organisation an opportunity to assess its own readiness.
A well-conducted internal audit can help to:
Remember:
The purpose is not to make the organisation appear perfect.
Instead, it is to identify issues early enough for appropriate action to be taken.
How to Conduct an Internal Audit Before ISO Certification
Understand the Applicable ISO Requirements
Start by reviewing the requirements of the ISO standard relevant to your organisation.
The audit criteria should be clearly defined so that auditors know what requirements
they are assessing.
The organisation should also consider its own policies, procedures, processes and
applicable legal or regulatory requirements when determining the audit criteria.
Plan the Internal Audit
Prepare an audit plan based on the organisation’s processes and the areas that
need to be assessed.
The plan should define the audit scope, criteria, areas or processes to be audited,
responsibilities and schedule.
Audits should be planned so that relevant processes are covered appropriately
rather than focusing only on documentation.
Review Relevant Documents and Records
Before or during the audit, review the documents and records relevant to the
processes being audited.
Depending on the organisation and ISO standard, these may include:
- Policies and procedures
- Work instructions
- Process records
- Training or competency records
- Risk-related information
- Monitoring and measurement results
- Previous audit findings
- Corrective action records
- Management review records
The auditor should check whether documents are controlled and whether records
provide evidence that processes have been carried out as required.
Conduct the Audit and Collect Evidence
During the audit, gather objective evidence through methods such as interviews,
observation and review of documents and records.
Do not rely only on what employees say. Where appropriate, verify their statements
against actual records or observed practices.
For example, if a procedure requires employees to complete a specific record,
the auditor should check whether the record exists, is properly completed and
reflects the actual process.
The auditor should remain objective and record evidence that supports each finding.
Identify and Document Audit Findings
The audit findings should clearly distinguish between conformity, nonconformity
and opportunities for improvement where applicable.
If a requirement has not been met, the nonconformity should be documented clearly
and supported by objective evidence.
Requirement
Evidence
Finding
This makes it easier for the organisation to understand what went wrong and
determine the appropriate corrective action.
Address Nonconformities Through Corrective Action
After the audit, the organisation should determine the cause of each nonconformity
and take appropriate corrective action.
Corrective action should address the cause of the problem rather than simply
correcting the immediate issue.
if the record was repeatedly missing because employees were not properly
trained or the process was unclear, the organisation should address that
underlying cause.
The organisation should maintain appropriate evidence of the actions taken.
Verify the Effectiveness of Corrective Actions
Corrective action should not be considered complete simply because an action
has been implemented.
A follow-up should be carried out to determine whether the action has effectively
addressed the nonconformity and prevented the problem from recurring.
The results of the follow-up should also be documented.
What Should You Check During the Audit?
Before the certification audit, focus on whether the management system is actually being implemented and supported by appropriate evidence.
Key areas may include:
Documentation and Records
Are required documents available, current and properly controlled? Are records maintained as evidence of completed activities?
Processes and Operations
Are employees following established procedures? Do actual practices match the organisation’s documented processes?
Roles and Competence
Do employees understand their responsibilities? Are appropriate competence and training records available where required?
Risks and Opportunities
Has the organisation identified and addressed relevant risks and opportunities according to the requirements of its management system?
Monitoring and Measurement
Are relevant processes being monitored or measured where required, and are the results being reviewed?
Previous Findings and Corrective Actions
Have previous audit findings been addressed? Is there evidence that corrective actions were effective?
Management Review
Where required by the applicable ISO standard, has management reviewed the management system and its performance?
Common Issues Found During Pre-Certification Internal Audits
Internal audits may reveal issues that could affect certification readiness.
Common examples include:
01
Procedures Do Not Reflect Current Practices
Procedures may not reflect how activities are currently carried out.
02
Incomplete or Missing Records
Required records may be incomplete, missing or not properly maintained.
03
Unclear Roles and Responsibilities
Employees may not be fully clear about their responsibilities within the management system.
04
Processes Are Not Consistently Followed
Established processes may not be consistently followed in actual practice.
05
Corrective Actions Not Verified for Effectiveness
Corrective actions may have been implemented without sufficient evidence that their effectiveness has been evaluated.
06
Inconsistent Document Versions
Different or outdated versions of documents may be in use, indicating weaknesses in document control.
07
Insufficient Objective Evidence
There may be insufficient evidence to demonstrate that required activities have been carried out.
What Should You Do After the Internal Audit?
Once the audit is completed, review and prioritise the findings.
Identify the Problem
Determine the Cause
Implement Corrective Action
Verify Effectiveness
Close the Finding
Keep Appropriate Records
Keep appropriate records of the findings, corrective actions and follow-up activities. These records can also help demonstrate how the organisation manages and improves its management system.
Final Preparation Before the Certification Audit
Before the certification audit begins, the organisation should confirm that the management system is properly implemented and supported by appropriate evidence.
Internal Audits Completed
The planned internal audits have been completed.
Nonconformities Addressed
Identified nonconformities have been addressed appropriately.
Corrective Actions Verified
Corrective actions have been implemented and their effectiveness has been evaluated.
Documents and Records Available
Relevant documents and records are available.
Employees Understand Their Responsibilities
Employees understand the processes and responsibilities relevant to their work.
Practices Match Documented Processes
Actual practices are consistent with documented processes.
Management System Activities Completed
Required management system activities and reviews have been carried out.
Objective Evidence Available
Objective evidence is available to demonstrate implementation of the management system.
Conclusion
An internal audit is an important part of preparing for an ISO certification audit. It allows an organisation to assess whether its management system is properly implemented, identify areas that need attention and take corrective action before the certification audit.
By reviewing processes, checking objective evidence and following up on nonconformities, organisations can improve their readiness and ensure that their management system is effectively implemented and maintained. A well-planned internal audit also helps the organisation understand whether its processes are being consistently followed and whether sufficient evidence is available to demonstrate effective implementation.
When issues are identified during the audit, they should be addressed through appropriate corrective action and followed up to verify their effectiveness. This helps prevent recurring problems and supports the continual improvement of the organisation’s management system.
Ultimately, an internal audit should be used as an opportunity to identify gaps, improve processes and ensure that the organisation is adequately prepared before the certification audit begins.
Use the internal audit to identify and address issues early, verify that corrective actions are effective, and ensure that the management system is properly implemented before the certification audit.