How to prepare for your certification audit

2026-09-25 6 min readBy the ICS technical team

The certification audit is not an exam you pass by improvising. Auditors do not look for a perfect company; they look for evidence that the system you designed is actually running. Most nonconformities in a first audit come from the same place: the process happens, but nothing proves it happened.

Two to three months before

• Confirm the scope in writing. Which sites, which processes, which activities are covered. Ambiguity here causes problems on the audit day.
• Check that every documented process reflects reality. A procedure describing how things used to be done is worse than having no procedure.
• Identify the legal and regulatory requirements that apply to your activity, and keep evidence that you comply with them.

One month before

• Run the internal audit. It is a requirement of the standard and, in practice, your rehearsal. It should cover every clause and every process in the scope.
• Hold the management review. With attendance, inputs and decisions recorded. Auditors always ask for it.
• Close the findings from your own internal audit. Arriving with open internal findings and no action plan is a bad signal.
• Review your indicators. Objectives without measurement, or measurement without analysis, is one of the most common findings.

Two weeks before

• Prepare the records, not just the procedures. Training records, calibration certificates, supplier evaluations, complaint handling, corrective actions. This is where audits are won or lost.
• Brief your team. Nobody needs to memorize the standard. Everyone should be able to explain what they do, how they know they are doing it right, and what they do when something goes wrong.
• Check document control. Current versions available where the work happens, obsolete copies withdrawn.
• Confirm logistics: access, safety induction, a room for the auditor, and the availability of the people who will be interviewed.

On the audit day

Answer what is asked, show the evidence, and do not improvise explanations. If something is not being done, saying so openly with an action plan is far better than constructing an answer the records will contradict ten minutes later. Auditors are experienced; inconsistencies surface quickly, and they damage credibility more than the original gap.

And if there are nonconformities

It is normal, including in well-run organizations. A finding is not a failure: it is a defined deadline to correct something, with evidence of the correction. What matters is addressing the root cause rather than patching the symptom, because the next audit will look at exactly that point.