A Stage 1 audit checks your documents and your readiness. A Stage 2 audit checks whether your shop floor follows those documents. You must pass both to earn an ISO 9001 certificate.
Stage 1 is often done remotely. The auditor reads your quality manual, procedures, and key records, then hands you a list of "areas of concern" to fix. Stage 2 happens on site, usually a few weeks later. The auditor walks your floor, pulls records, and interviews your operators.
This guide covers what auditors check at each stage, what small manufacturers commonly fail, the difference between major and minor nonconformities, and what happens in years 2 and 3 after you pass.
Why certification takes two audits
Certification bodies (also called registrars) are accredited under ISO/IEC 17021-1. That rule requires the initial certification audit to run in two stages. Total audit time comes from the IAF MD 5 tables and is based mostly on your headcount. For a 10-100 person manufacturer, plan on roughly 2 to 7 auditor-days across both stages.
The two-stage design protects both sides. Stage 1 catches paperwork gaps before the registrar sends a team to your plant. It is cheaper to fix a missing record after a one-day remote review than to fail a multi-day on-site audit.
What auditors check at Stage 1
Stage 1 is a documentation and readiness review. Many registrars run it remotely, by video call and shared files, especially for small, low-risk shops. It often takes about a day. The auditor is answering one question: is this company ready for Stage 2? To answer it, they check:
- Your scope statement. What products, processes, and sites will the certificate cover? Any exclusion (design, clause 8.3, is the common one) must be justified in writing.
- Your documented information. Quality policy, measurable objectives, and the procedures and records the standard requires.
- Proof that you have run at least one full internal audit (clause 9.2).
- Proof that you have held at least one management review (clause 9.3), with minutes covering the required inputs and outputs.
- A working corrective action process with real entries (clause 10.2).
- Logistics for Stage 2: which processes, shifts, and people the audit team will need to see on site.
The output is a Stage 1 report with a list of areas of concern. These are not formal nonconformities. They are warnings: if this looks the same at Stage 2, it becomes a finding. You then get a window, usually a few weeks, to close them before Stage 2.
What auditors check at Stage 2
Stage 2 is the real conformity audit, and it happens on site. The auditor is no longer asking whether you have a system on paper. They are asking whether the shop runs the way the paper says. The core method is sampling and tracing. The auditor picks a shipped order and follows it backward through your system:
- The customer PO and your order review.
- The purchase orders behind it, and whether those suppliers are on your approved list (clause 8.4).
- In-process and final inspection records for that order.
- The calibration status of every gauge named in those records (clause 7.1.5).
- The competence and training records of the operators who signed them (clause 7.2).
- Any nonconforming material tied to the order. Was it tagged, segregated, and dispositioned under clause 8.7?
Auditors also interview operators, often away from their managers. Common questions: "How do you know this part is good?" "What do you do when one fails?" "Where is the current drawing?" Operators do not need to recite clause numbers. They need to describe practice that matches your procedures.
At the closing meeting, the auditor presents the findings and either recommends certification or does not. That recommendation goes to an independent reviewer at the certification body, who makes the final decision. After a clean Stage 2, the certificate usually arrives within a few weeks.
Stage 1 vs Stage 2 at a glance
| Stage 1 | Stage 2 | |
|---|---|---|
| Purpose | Readiness and documentation review | Full conformity audit |
| Location | Often remote | On site |
| Typical length | About a day for a small shop | One to several days, set by IAF MD 5 |
| Focus | Documents, mandatory records, scope | Floor practice, sampled records, interviews |
| Who talks to the auditor | Quality manager and top management | Operators, supervisors, every process owner |
| Output | Areas-of-concern list | Nonconformities (major or minor) plus a certification recommendation |
| What "failing" means | Stage 2 gets postponed | Certificate withheld until findings close |
What commonly fails Stage 1
The same gaps show up over and over at small manufacturers:
- No management review yet. Clause 9.3 requires a real meeting with minutes, not a plan to hold one "before the audit."
- No internal audit yet (clause 9.2), or one that skipped whole departments.
- An empty corrective action log. Zero entries under clause 10.2 reads as "this process has never been used," not as "we have no problems."
- An undefined or vague scope. "Machining" is not a scope. "CNC machining of aluminum components at 123 Main St" is.
- Missing mandatory records: calibration (7.1.5), competence (7.2), supplier evaluation (8.4).
- A system too young to have records at all. Procedures written last week cannot show three months of use.
What commonly fails Stage 2
- Floor practice that does not match the procedure. The procedure says torque to spec and record the value; the operator eyeballs it. This is one of the most common Stage 2 findings.
- Orphan records. Forms with blank fields, missing signatures, or no link to any procedure. Also the reverse: a procedure that calls for a record nobody keeps.
- Uncalibrated gauges in use (clause 7.1.5). One expired sticker on a caliper at an active workstation is an easy finding.
- Operators working with no competence record (clause 7.2). This bites hardest with new hires and temps.
- Purchases from suppliers who are not on the approved list (clause 8.4).
- Nonconforming parts sitting unmarked next to good stock, with no record under clause 8.7.
Major vs minor nonconformity
A minor nonconformity is an isolated lapse in a system that otherwise works. One missed calibration. One skipped signature. A major nonconformity is a breakdown: a required process that does not exist, the same failure repeated across the sample, or a failure likely to send bad product to a customer.
| Finding | What it means | What happens next |
|---|---|---|
| Minor | Isolated lapse in a working system | Certification can still be recommended. You submit root cause and a corrective action plan under clause 10.2, typically within 30-90 days. The auditor often verifies it at the next surveillance visit. |
| Major | Systemic breakdown or a missing requirement | Certificate on hold. You must fix the issue and show evidence, typically within about 90 days. The registrar may require a follow-up visit. Miss the window and you may repeat part or all of Stage 2. |
A handful of minors at a first Stage 2 is normal, and registrars expect them. What sinks companies is arguing with the finding instead of writing a solid corrective action. Note also that a cluster of related minors can be rolled up into one major.
Surveillance audits in years 2 and 3
An ISO 9001 certificate runs on a three-year cycle. Passing Stage 2 starts the clock. In years 2 and 3, the registrar returns for one surveillance audit each year. These are shorter than the initial audit, roughly a third of the time under IAF MD 5. Surveillance samples only part of your system, but a few things get checked every visit: internal audits, management review, customer complaints, progress on past corrective actions, use of the certification mark, and any changes to your operation. At the end of year 3, you sit a recertification audit. It is close to a full Stage 2 in depth, and it resets the cycle.
Surveillance is where systems drift. Keep internal audits (9.2) and management reviews (9.3) on schedule between visits. Letting those lapse is one of the most common surveillance findings.
Getting ready: your options
Before you call a registrar, be honest about where you stand. You need documentation that covers the standard, and then about three months of records generated by using it. To get the documentation, you can write it yourself from the standard (cheapest, slowest), hire a consultant, or buy a documentation package. ISO Delivered, for example, offers a free Public QMS Visibility snapshot at /free-assessment that scans your company's public surface, a $500 Readiness Report, and an $8,000 flat-fee package of about 44 documents (4 manuals and policies, 15 procedures, 10 work instructions, 15 forms) delivered 2-4 weeks after a questionnaire. It is not a certification body. Whatever route you take, you still choose a registrar, run the system for about three months, and sit both audits yourself.
Frequently asked questions
How much time passes between Stage 1 and Stage 2?
Usually a few weeks to three months. You set the gap with your registrar based on how many areas of concern you need to close. Most registrars want Stage 2 done within about six months of Stage 1; wait longer and they may require repeating Stage 1.
Can you fail a Stage 1 audit?
Not in the formal sense. Stage 1 produces areas of concern, not nonconformities. But if the gaps are serious, the registrar postpones Stage 2 until you close them. That delays certification and can add review cost.
Is Stage 1 always remote?
No. Remote Stage 1 is common for small, low-risk manufacturers, but the registrar decides. Complex sites, multiple locations, or scopes with special processes often get an on-site Stage 1.
What happens if we get a major nonconformity at Stage 2?
The certificate is withheld. You must show root cause, corrective action, and evidence that it worked, typically within about 90 days. The registrar may verify remotely or with a follow-up visit. If you miss the window, you may have to repeat some or all of Stage 2.
How many findings are normal at a first Stage 2?
Registrars commonly see a handful of minor nonconformities at a first certification audit, and a completely clean Stage 2 is rare. A few well-handled minors will not stop your certificate. A pattern of related minors can be combined into a major, so treat every root cause seriously.
Do surveillance audits cover the whole standard?
No. Each surveillance visit samples part of your system, so the full standard gets covered across the three-year cycle. But some items are checked every visit: internal audits, management review, complaints, corrective actions, and changes to your operation.