An ISO audit is a systematic, independent check of whether an organization’s management system meets the requirements of an ISO standard (such as ISO 9001 or ISO 13485) and is actually working in practice. Audits are how certification is earned and kept — and for most quality managers, they’re the moment the whole system is put to the test. This guide explains what an ISO audit is, the different types, what happens during one, how findings work, and how to prepare so the audit is a confirmation rather than a scramble.

What is an ISO audit?

An ISO audit is a structured evaluation in which an auditor gathers objective evidence — documents, records, and interviews — and compares it against the requirements of a standard and your own procedures. The goal is twofold: conformity (does the system meet the requirements?) and effectiveness (is it actually achieving its intended results?). An auditor isn’t looking to catch you out; they’re sampling evidence to decide whether your quality system can be trusted to do what it claims.

Types of ISO audit

Audits are classified by who performs them and by their stage in the certification cycle.

By who performs them:

• First-party (internal) audit — you audit yourself. Required by ISO 9001 Clause 9.2, internal audits are your early-warning system before anyone external arrives.
• Second-party audit — a customer or other interested party audits a supplier.
• Third-party (certification) audit — an independent certification body audits you to grant or maintain certification.

By stage in the certification cycle:

• Stage 1 — a readiness/documentation review to confirm you’re prepared for the full audit.
• Stage 2 — the main certification audit, examining implementation and effectiveness.
• Surveillance audits — periodic (usually annual) checks that you’re maintaining the system.
• Recertification — a fuller audit, typically every three years, to renew the certificate.

What happens during an ISO audit

Most audits follow the same arc:

• Audit plan — the auditor shares scope, schedule, and what they’ll examine.
• Opening meeting — confirming scope, logistics, and method.
• Evidence gathering — the heart of it: reviewing documents and records, and interviewing people about how they actually do the work.
• Findings — the auditor records conformities and any gaps against requirements.
• Closing meeting — the auditor presents findings and next steps.
• Audit report — the written record, including any nonconformities you must address.

The recurring theme is traceability: an auditor picks a thread — a document, a complaint, a training record — and follows it to see whether the system holds together end to end.

Audit findings: nonconformities and observations

• Major nonconformity — a significant failure to meet a requirement (for example, a required process is absent, or a breakdown risks product/compliance). Usually must be resolved before certification is granted or kept.
• Minor nonconformity — an isolated lapse that doesn’t break the whole system but still needs correction.
• Observation / opportunity for improvement (OFI) — not a nonconformity, but a risk or a suggestion worth acting on.

Nonconformities are closed through corrective action: investigate the root cause, act, and verify effectiveness. How cleanly you close findings is itself a signal of a healthy quality system.

How to prepare for an ISO audit

Audit readiness isn’t a last-minute project — it’s the by-product of running the system well. The essentials:

• Keep document control current — no obsolete revisions in use; approvals and distribution controlled. This is where many findings originate.
• Run your internal audits — and actually close what they find.
• Close CAPAs with effectiveness evidence — open or weakly closed corrective actions attract scrutiny.
• Hold your management review — and keep the records.
• Keep training records current — tied to the document revisions people work to.
• Be able to retrieve evidence fast — if assembling records takes days, the audit will feel like one.

How QMS software makes you audit-ready

The difference between a calm audit and a stressful one usually comes down to whether your evidence is already there. QMS software keeps it there: controlled documents with a complete audit trail, internal audit management, CAPA, training tied to release, and management review — all connected, so when an auditor pulls a thread, the whole record follows in seconds. That’s the readiness an eQMS is built to give, and it’s exactly how TLM helps small-to-mid teams walk into an ISO 9001 or ISO 13485 audit prepared rather than panicked. If an audit is on your horizon, book a demo and we’ll show you what audit-ready looks like on your processes.

Frequently asked questions

What is an ISO audit?

An ISO audit is a systematic, independent check of whether an organization’s management system meets the requirements of an ISO standard (such as ISO 9001 or ISO 13485) and is working effectively in practice. An auditor gathers objective evidence — documents, records, and interviews — and compares it against the standard and your own procedures.

What are the types of ISO audit?

By who performs them: first-party (internal) audits you run on yourself, second-party audits a customer runs on a supplier, and third-party (certification) audits run by an independent certification body. By stage: Stage 1 (readiness/documentation review), Stage 2 (main certification audit), periodic surveillance audits, and recertification (typically every three years).

What is the difference between a major and minor nonconformity?

A major nonconformity is a significant failure to meet a requirement — for example a required process is missing or a breakdown risks product or compliance — and usually must be resolved before certification is granted or kept. A minor nonconformity is an isolated lapse that doesn’t break the whole system but still needs correction. An observation or opportunity for improvement is neither, but worth acting on.

How do I prepare for an ISO audit?

Keep document control current (no obsolete revisions in use), run your internal audits and close what they find, close CAPAs with effectiveness evidence, hold and record your management review, keep training records current and tied to document revisions, and make sure you can retrieve evidence quickly. Readiness is the by-product of running the system well, not a last-minute project.

How often do ISO surveillance audits happen?

After certification, a certification body typically conducts surveillance audits annually to confirm you’re maintaining the system, with a fuller recertification audit usually every three years to renew the certificate. Internal audits should run on your own planned schedule throughout the year.