How audits run – and how to prepare for them.

Most findings arise not because something is missing but because it cannot be found during the visit. Knowing the process keeps that advantage.

An audit is a sample. An auditor cannot possibly examine everything in a few days and therefore selects – by risk, by history and by what strikes them in conversation. Understanding that selection logic is worth more than any checklist.

Examination always runs on evidence. The question is rarely “do you have a process” but “show me the last case”. Whatever cannot be shown within a few minutes counts, in practice, as absent.

The types and what separates them

Type	Who examines	What matters
Internal audit	Your own trained and independent person	Honesty. An internal audit without findings is a warning sign to the certifier, not a badge of quality.
Certification audit	Accredited certification body, in two stages	Stage 1 checks readiness and documentation, stage 2 the effectiveness as lived on site.
Surveillance audit	The same body, annually between certifications	Shorter, focused on changes, open actions and complaints.
Recertification	The same body, every three years	Looks at the whole cycle, including how things developed across the three years.
Customer audit	Your customer or an auditor they engage	Focused on the contract and the delivered service, often with the customer’s own checklist.
Supplier audit	You, at your supplier	The role reverses. The same rules apply the other way round – including the auditor’s qualification.
Regulatory inspection	The supervisory authority, sometimes unannounced	Not a consultation. What is not available is recorded, not discussed.

The typical run of a certification audit

Audit planIn advance: which areas, which times, which contacts.Review the plan and report absences early. A missing key person costs half a day.
Opening meetingIntroductions, confirmation of the plan, clarification of arrangements.First impressions form here. Being unable to describe your own scope cleanly invites closer examination.
Examination on siteConversations, inspection of records, observation of activities.The auditor follows traces. One answer produces the next question – so do not open topics nobody asked about.
Interim feedbackUsually a short daily readout.Use it. A misunderstanding can be cleared the same day; in the report it cannot.
Closing meetingPresentation of findings by severity.Objection is possible, but only with evidence. Arguing without records makes the position worse.
ActionsCorrections with root cause analysis, deadline and evidence of effectiveness.For major nonconformities, implementation decides the certificate, not the promise.

What auditors sample

These five moves appear in almost every audit, whatever the standard.

The most recent case: the last complaint, the last deviation, the last new supplier.
The oldest open item: an action whose deadline has passed.
The contradiction: a rule in the manual described differently in conversation.
The date: an approval granted after the first delivery.
The gap: a certificate whose scope does not cover the delivering site.

Preparation by type

Type	Preparation	Most common mistake
Certification audit	Evidence of the last twelve months at hand, open actions closed or dated	Producing documents shortly before the visit that look backdated.
Surveillance audit	Compile changes since the last audit, have complaints and internal audits ready	Assuming only last time’s topics will be repeated.
Customer audit	Know the contract and specifications, schedule quality and technical contacts	Receiving the customer with presentations instead of records.
Regulatory inspection	Define responsibilities and authorised spokespeople in advance, keep records current	Improvising. In an unannounced inspection, yesterday’s preparation decides.
Internal audit	Plan the programme on a risk basis, train auditors and ensure independence	Having a department audit itself and finding nothing.

The most effective preparation costs nothing: a week beforehand, run five samples yourself the way an auditor would draw them. Whatever you cannot find, they will not find either – but they will ask for it.

Findings and their weight

Major nonconformity: A requirement is not met, or the system fails systematically at one point. Without effective correction no certificate is issued or maintained.
Minor nonconformity: An isolated case or a smaller gap. The certificate is issued and the correction tracked.
Observation or opportunity: Not a nonconformity but a note. Ignore it and it returns in the next audit as one.
Root cause analysis: Required for every nonconformity: not what happened but why it could happen. A correction without a cause repeats itself.

The preparation that happens during the year

When evidence, deadlines and actions are kept continuously, the audit report is an export rather than an all-nighter. That is exactly what SCRM is built for.

Request a consultation Go to supplier audits Scope and depth