The seven most common findings in certification audits

2026-08-28 6 min readBy the ICS technical team

After enough audits, patterns emerge. The findings that appear in a first certification audit are remarkably repetitive, and almost none of them are about the company doing poor work. They are about the distance between what the organization does and what the organization can prove.

1. Objectives without measurement

Quality objectives written on a document, with no indicator, no target and no review. The standard asks for objectives that are measurable and monitored. Set fewer objectives, but measure them.

2. Internal audit that does not cover everything

An internal audit that reviewed three processes out of nine, or skipped entire clauses of the standard. The internal audit programme has to cover the whole system across the cycle, and be planned rather than improvised.

3. Corrective actions that treat the symptom

A finding closed with the phrase "personnel were retrained". If the root cause was not analysed, the problem returns and the auditor knows it. Document the analysis, not just the action.

4. Suppliers that were never evaluated

Purchasing criteria defined on paper, with no record of any supplier having been evaluated against them. Keep it simple: a criterion, a periodic evaluation, and evidence that it happened.

5. Uncontrolled documents

Obsolete versions circulating in the workplace, or the current procedure available only on somebody’s computer. Whoever does the work needs the valid version where the work happens.

6. Training with no evidence of competence

Attendance lists as the only record. The standard asks for competence, not attendance: some evidence that the person can actually perform the task.

7. Management review reduced to a formality

A meeting with no minutes, without the inputs the standard requires, and with no decisions recorded. It is one of the first things an auditor asks for, and one of the easiest to prepare properly.

The pattern behind all seven

In every case the activity usually does happen. What is missing is the record that proves it. If you only have time for one thing before your audit, review your records rather than your procedures.