The ultimate guide to ISO compliance audits: preparation & success

Most people’s first reaction to the word ‘audit’ is a small internal flinch. This, I think, is completely fair enough. However, an ISO compliance audit isn’t an inspection designed to catch you out. It’s a health check on the way your organisation actually runs, and if you approach it that way, it becomes one of the more genuinely useful things you’ll do all year.

This ultimate guide to ISO compliance audits walks through what these audits are, the different kinds you’ll come across, how to prepare without losing your mind, and how the whole certification ecosystem fits together.

What is an ISO compliance audit?

A quick bit of housekeeping first, because the terminology trips people up. ISO is the International Organisation for Standardisation, based in Geneva. They write the standards. They don’t certify anyone, but they can guide you through achieving ISO certification. This is a common misunderstanding, and it matters – so hold onto it; we’ll come back to it…

An ISO compliance audit checks whether your management system does what the relevant standard requires. Someone (internal or external) gathers evidence, looks at how things work in practice, and forms a view on where you meet the requirements and where you fall short.

And yes, there is even an ISO standard for auditing itself: ISO 19011. It gives guidance on how management system audits should be planned and carried out, from the principles of auditing to building an audit programme and understanding what competent auditors should know. If you are setting up an internal audit function, this is one of the main reference points, whichever ISO standard you are working towards.

So why bother? Three honest reasons:

• It tells leadership how the system is really performing, not how everyone hopes it’s performing.
• It catches problems before an external auditor does, which is a much cheaper place to catch them.
• Finally, it produces the evidence of continual improvement that every ISO management system standard demands.

That last can sound a bit like box-ticking until you realise the box is genuinely worth ticking.

The different types of ISO audits

First party. Second party. Third party.

A first-party audit is you auditing yourself. Internal audits, in other words. ISO 9001, ISO 27001 and the rest all require these at planned intervals. They’re not optional, and you certainly shouldn’t try and fudge them the week before certification and hope nobody notices. Organisations that treat internal audits as a real exercise tend to sail through external ones much more easily than those that don’t.

A second-party audit is typically a customer audit of a supplier. It is less about certificates and more about commercial trust – can the customer rely on you, your processes and your controls enough to keep the relationship going?

Finally, a third-party audit is the one that ends in a certificate on the wall. It’s carried out by an independent certification body, and it comes in stages:

Stage 1 could be described as the ‘desk audit’. The auditor reads your documented system, your policies, procedures, registers, etc, and works out whether you’re ready for the real thing. Think of it as a dress rehearsal with notes.

Stage 2 is the main event. Here the auditor is checking whether the system on paper is the system in practice. This is where non-conformities get written up, and where any gap between what you wrote and what you actually do gets exposed.

After that, surveillance audits happen each year across a three-year cycle. Lighter touch, checking the system hasn’t quietly drifted. Then at the three-year mark you recertify, which is essentially another Stage 2.

The main ISO standards and what their audits look at

The mechanics of an audit are much the same across standards. What changes is the subject matter.

ISO 9001 is quality management, and it’s the big one, the most certified management system standard on the planet. Audits look at how you control processes, meet customer requirements, deal with things that go wrong, and improve over time.

ISO 27001 is information security, built around an ISMS. You assess your information security risks and put in controls to address them. Audits here lean harder on documentation and on evidence that you’ve made risk-based decisions rather than just installed some antivirus and called it a day.

ISO 22301 covers business continuity, and it’s one of the more grounded standards to audit because the underlying question is blunt: if something serious goes wrong, can the organisation keep running? An auditor will want to see a proper business continuity management system behind that. So a business impact analysis, continuity risks and strategies that actually make sense for the business, plans that have been tested rather than just written, records of the exercises, the lessons that came out of them, and some sign that leadership is genuinely checking whether recovery within the promised timescales is realistic.

ISO 42001 is the new one, the AI management system standard. It gives organisations a structured way to govern how they build, supply and use AI. That means an audit isn’t really about the model itself; it’s about everything around it. Who owns the AI policy, how risks and impacts get assessed, what controls sit across the data and the system lifecycle, and whether there’s enough transparency, accountability and human oversight to stand the whole thing up if someone challenges it.

There are plenty more, obviously. ISO 14001 for environmental management, ISO 45001 for health and safety, ISO 13485 for medical devices, ISO 22000 for food safety, ISO 50001 for energy, and the list keeps going.

The subject changes each time, but the logic doesn’t: work out what matters, keep it under control, check it’s working, improve it, and be ready to prove you did all of that.

Compliance, certification, accreditation

These are not synonyms, and the difference actually matters.

Compliance is just meeting the standard’s requirements. You can be perfectly compliant and hold no certificate at all. Plenty of organisations self-declare, especially where no customer is demanding proof.

Certification is when an accredited body assesses you and confirms, independently, that you meet the standard. That’s when you get the certificate, with a defined scope written on it.

Accreditation sits a layer above all of this. Essentially, it’s the thing that stops certification being a free-for-all.

An accreditation body (UKAS in the UK) checks that the certification bodies themselves are competent and impartial, measuring them against – you guessed it – another ISO standard (ISO 17021). So the accreditation body watches the certification body, which audits you. A chain of oversight, if you will.

Learn how to choose the right ISO certification body for you. 

Tying it all together internationally is the IAF, the International Accreditation Forum, whose ‘Multilateral Recognition Arrangement’ means a UKAS-accredited certificate is recognised in member countries abroad. Handy if you sell across borders. And for the truly keen, CASCO is the ISO committee that writes the conformity assessment standards like 17021 in the first place.

You’ll be pleased to know that you don’t need to memorise all of this, but if a certification body can’t tell you who accredits them, walk away.

How to prepare for an ISO compliance audit

This is the part that decides whether the audit goes smoothly or painfully, so it gets the most attention.

Start by actually reading the standard

Buy it from ISO or BSI and read the thing properly before you build anything. I know that’s unglamorous advice but it’s also the advice most often ignored, and you can usually tell.

Do a gap analysis

This is where you go through the standard clause by clause and mark yourself honestly: are we doing this, half doing this, or not doing this at all? It’s the single most useful thing you can do early, because it turns a vague “we need to get certified” into an actual list of work. If you haven’t got the internal expertise or the objectivity to do it yourself, this is a sensible thing to bring an ISO consultant in for. An outside eye tends to find the gaps you’ve learned to stop seeing.

Learn how Taggstar started with an ISO gap analysis to achieve compliance.

Build the system to close those gaps

Write the policies and procedures, put the controls in, train the people who own them, then run the system long enough to generate actual evidence that it works. Everything sits on the PDCA cycle: plan it, do it, check it, act on what you learn.

Make yourself a checklist

A decent audit checklist links each requirement to the evidence you’d expect to see. Something like:

• The clause you’re checking
• What it actually requires, in plain English
• What evidence you’d expect (a document? a record? an interview? watching someone do the thing?)
• What you found
• The verdict: compliant, minor non-conformity, major non-conformity, or “not broken but could be better” (in ISO we call this last one an OFI – Opportunity for Improvement).

The trap is turning this into a tick-box exercise. “Is there a procedure?” is a weak question. “Is the procedure being followed, and can you show me the records that prove it?” is the question that finds real problems.

Pick internal ISO auditors who can be objective

People shouldn’t audit their own work, for the obvious reason that it isn’t auditing; it’s marking your own homework. ISO 19011 spells out what auditor competence looks like: they know the standard, they know how to audit, and they can weigh up evidence without bias. Formal auditor training isn’t strictly required by the standards, but it’s cheap insurance and gives everyone a shared method.

Learn more about ISO 27001 internal audits here. 

Get comfortable with “objective evidence”

This is a phrase auditors use constantly, and it just means verifiable proof that something happened. Records might include risk assessments, minutes, training logs or test results; documents might include policies and procedures; and evidence can also come from maintained equipment, labels, observations and interviews. Records usually carry the most weight. Where an activity has taken place but no record exists, the auditor may not have enough evidence to confirm conformity, even if the work was genuinely done.

Time and money

This varies enormously. A small firm starting ISO 9001 may be ready in four to six months, while ISO 27001 in a bigger or more complex organisation can take a year or longer. Budget for the standard itself, the internal time needed to build and run the system, auditor training, certification body fees and any consultancy support you choose to bring in. It’s always worth comparing quotes, but look closely at what’s included. A cheaper route can be tempting, but the real value is in getting a system that is practical, credible and ready to stand up to scrutiny.

Read our ultimate guide to ISO consultancy costs. 

***

Reading all that back, it’s a lot. Reading a standard cover-to-cover, running an honest gap analysis, building the system, training auditors, generating evidence, and doing it on a timeline that usually has an external audit bearing down on it.

Plenty of organisations do manage it in-house, and if you’ve got the expertise and the capacity, there’s no reason you can’t. But it’s worth being honest with yourself about both.

This is the work our Evalian ISO consultants do day in, day out, across ISO 27001, ISO 9001, ISO 22301 and now ISO 42001, and a lot of what we bring isn’t just knowing the standard; it’s knowing where organisations often trip up and heading it off before an auditor finds it.

Whether that’s running the gap analysis for you, acting as a second pair of eyes on a system you’ve already built, or taking the whole implementation off your plate, the point is you don’t have to work it out from a blank page. We’ve done it enough times to know what good looks like.

Learn more about Evalian’s ISO consultants in our recent video 

Running the audit itself

Your internal audit programme should cover the whole system across the three-year cycle, hitting the riskier areas more often. Make sure it exists as a documented and reviewed schedule.

The audit runs in a fairly set order. There’s an opening meeting to agree scope, objectives and how findings get handled, and this should be short and to the point. Then the ‘real work’. Sampling records, reading documents, talking to people, watching how things are actually done. The auditor’s job is to gather enough evidence to make a fair call on each requirement.

At the closing meeting, the findings are presented. Non-conformities get explained and graded. A minor one is a slip or an isolated gap. A major one is either a whole requirement missing or a failure that runs right through the system, and certification bodies won’t hand you (or let you keep) a certificate while a major sits open. Opportunities for improvement can also get raised, where nothing’s technically wrong but there’s objectively a better way of doing something.

Whatever gets found needs corrective action, which means a root cause analysis – a mandatory requirement for any nonconformities, with a plan to fix that you then track to completion.

Root cause analysis = “Why did this actually happen?” Not just “what happened?”

Feeding into all of this is the management review, the formal sit-down where leadership looks at audit results, customer feedback and performance data and decides what to change and what to resource. It’s mandatory across the main standards, and it’s often one of the first things an external auditor will ask to see.

Why it’s worth the effort

The commercial case is blunt: a lot of doors won’t open without a certificate. Public sector tenders, regulated industries, big corporate supply chains – they’ll often refuse to shortlist you without accredited ISO certification. So it’s a barrier removed, and sometimes a barrier raised against competitors who haven’t bothered.

But the operational benefit is the one people underrate. A system that’s genuinely working means fewer mistakes, fewer things falling through the cracks when someone’s on holiday or leaves, and problems spotted before they become expensive. Risk reduction especially. ISO 27001 is the clearest example – organisations that work through the risk assessment properly almost always turn up vulnerabilities nobody knew were there. This is the same story with safety under 45001 and environmental exposure under 14001.

Choosing an ISO certification body (and checking they’re legit)

The non-negotiable check is accreditation. Make sure the body is accredited by UKAS (or an equivalent IAF member abroad) for your specific standard, and verify it, either through the IAF CertSearch database or straight with UKAS.

Past that, look at whether they know your sector, what their customer service is like, and how they audit. Some bodies fit small organisations better, some are built for big enterprises.

Prices swing more than you’d think, so a second or third quote pays for itself. And be wary of anyone offering to certify you suspiciously fast. A certificate you got too easily isn’t an asset; it’s a question mark hanging over your credibility, and sharper procurement teams do check the accreditation of whoever issued it.

What ISO does and, more importantly, doesn’t do

ISO’s role is narrow: it develops standards. National standards bodies, technical experts and industry specialists agree the content, and ISO publishes it. It doesn’t audit organisations, and it doesn’t issue certificates.

That distinction matters more than it first appears. When a company describes itself as ‘ISO certified’ but can’t produce a certificate from an accredited body, the claim is weaker than it sounds.

Complying with a standard and being independently certified to it are not the same thing, and the space between the two is where misleading claims tend to sit. ISO’s rules also prohibit using its logo on products or websites to imply certification. Genuine false claims can be reported to the IAF or the relevant national accreditation body.

Get support from expert ISO compliance auditors

None of this is a one-off exercise.

The three-year cycle, the annual surveillance audits and the ongoing management reviews all exist for the same reason: a management system is meant to keep improving.

If you’d like support with any part of it, whether outsourcing your internal audits, ISMS Management, a gap analysis or a full implementation across many of the ISO standards our team covers, contact us using the form below.

“It’s been a delight to deal with Evalian – they are exemplars of good, professional service. My initial web inquiry instigated a same-day meeting with Joe Allsopp, who instantly discovered what we needed (support for an internal ISO27001 audit). A proposal followed sooner than promised, which we were pleased to accept. Then we met with Jack Salzmann – the most knowledgeable, engaging and helpful auditor you could wish to know. Jack led us through 3 days of intense audit with empathy, spirit and professionalism. He has coached us to become a better business. I look forward to working with them again.” – Nick Delacamp, A24