What a certification audit actually samples

Most preparation for a certification audit is spent on the wrong thing. Organisations polish the manual and neglect the records, because the manual is what they wrote and the records are what happened. An auditor spends very little time on the first and almost all of it on the second.

The audit is a sampling exercise

Nobody reads a quality system end to end in three days. An auditor takes a small number of threads and pulls each one as far as it goes. The skill is in choosing threads that reveal whether the system is real.

So they pick a recent order and follow it: the enquiry, the contract review, the plan, the checks, the release, the invoice, any complaint. Or a recent hire, and follow competence: the requirement for the role, the evidence they meet it, the induction, the training records, the authorisation. Or an incident, and follow correction: the report, the investigation, the root cause, the action, the check that it worked.

Each thread crosses six or seven clauses. A gap anywhere on the thread is found, and it is found in the context that makes it matter.

What gets pulled, almost every time

• The most recent internal audit, and what happened to its findings.
• The last management review, and whether it decided anything.
• The most recent nonconformity, and whether the root cause is credible.
• The training records of one person doing a job that matters.
• The calibration or verification record of whatever equipment accepts or rejects work.
• The newest supplier, and how they were approved.
• A change made recently, and whether it went through the change process.

Every one of those is a record with a date on it. That is the point: the auditor is testing whether the system was used, not whether it was written.

What this means for preparation

A week before the audit, stop editing documents. Instead, walk one of those threads yourself, end to end, as if you were the auditor. You will find what they will find — usually a record somebody meant to complete, an action closed without evidence, a training matrix that has not caught up with a leaver.

Fix what you can. Where you cannot, raise it yourself as a nonconformity before the audit. An organisation that has already found its own problem and started on it is in a completely different position from one that is shown the problem.

The uncomfortable implication

If the records exist because the work generates them, the audit is uneventful. If they exist because somebody assembled them for the audit, it shows — dates cluster, handwriting matches, the whole file was signed on one afternoon. Auditors see that pattern constantly and it is the fastest route to a major finding, because it suggests the system exists for the certificate rather than for the work.