What an ISO 9001 Auditor Actually Checks on Stage 2 Day — And How to Be Ready

A Stage 2 auditor is not looking for perfect documentation. They are looking for evidence that your business operates the way your documentation says it does, and that you know what to do when something goes wrong.

That distinction matters more than most businesses realise in the weeks before their audit. They spend time polishing their Quality Manual, reformatting procedures, making sure every clause number lines up. The auditor spends their day on the shop floor, in the project office, at the warehouse bench, asking your people to show them things, not describe them.

What follows is what a Stage 2 audit actually looks like from inside the room, drawn from sitting in on Stage 2 certification audits with Kaiso clients across construction, manufacturing, and professional services.

Stage 1 and Stage 2 are completely different assessments

Stage 1 is a document review. The auditor checks that your Quality Management System is designed correctly: that you have a Quality Policy, that your scope is defined, that your procedures address each applicable clause, that you have a plan for internal auditing and management review. It happens at a desk, usually remotely, a few weeks before Stage 2.

Stage 2 is an operational evidence audit. The question is no longer "does this system exist?" It is "is this system being followed?"

That shift from design to operation is where most first-time certification attempts get into trouble. A business can pass Stage 1 with a thorough, well-structured QMS and still collect nonconformances at Stage 2 because the system they documented and the system they actually run are two different things.

How the auditor samples: the audit trail

Auditors do not work through your QMS alphabetically by clause number. They pick a point of entry, almost always a real customer order, and follow the evidence backwards and forwards through your operation.

The sequence looks like this: they ask for a customer order from the past few months. Then they trace it through contract review (Clause 8.2: was the order reviewed for feasibility before acceptance?), production planning (Clause 8.1: was the process planned?), any inspection or quality checks during production (Clause 8.5), delivery records (Clause 8.2.4), and any post-delivery complaints or feedback (Clause 8.2.1). At each step, they ask for the record that shows it happened.

If one link in that chain has no record, that is a potential nonconformance. Not because your procedure is wrong (the procedure might be excellent), but because there is no evidence the procedure was followed on that job.

This is the audit trail methodology, and it is the thing most pre-audit preparation misses. You are not being tested on whether you have a corrective action procedure. You are being tested on whether the corrective action from the last complaint was actually opened, investigated, and closed.

The three conversations your Stage 2 auditor will have

The quality manager is usually the most prepared person in the building on audit day. The auditor knows this, and they plan around it. Their day is structured to reach three different types of people, deliberately, to test whether the system lives beyond the one person who built it.

Top management (Clauses 5 and 9): The auditor will speak to a director or senior leader (not the quality manager) and ask about strategic direction and quality objectives. They want to know whether leadership is genuinely engaged with the QMS: what the quality objectives are for this year, how performance is tracked, when the last management review was held, and what came out of it. The management review minutes are the key record here.

Process owners (Clause 8): The operations manager, project engineer, warehouse supervisor, production lead: whoever runs the work, not the quality function. Auditors ask process owners to explain how their area operates: how orders are planned, how jobs are assigned, how they handle a defect if they find one mid-process. The process owner needs to be able to explain their own procedure. If they have never read it, or if what they describe does not match what was written, that is a gap.

Front-line staff (Clause 7.2): Auditors routinely speak to someone on the line or in the field: a production worker, a site supervisor, a service technician. They ask that person to describe what they do when they find a quality problem. They are looking for competence evidence: has this person been trained, is there a record of that training, do they know how the system works in practice?

The quality manager does not control any of these three conversations. They can facilitate access, provide records, and answer follow-up questions. But the auditor is deliberately testing whether quality exists outside the quality function.

What a nonconformance looks like when it is raised

Receiving a nonconformance on Stage 2 day is not a certification failure. It is a normal part of the process, and how it is handled in the room and in the days that follow determines whether the certificate issues on schedule.

Nonconformances come in two grades:

Minor nonconformance: A single, isolated instance of a requirement not being met, or a systematic gap that does not represent a complete breakdown of a process. The corrective action does not need to be completed before the auditor leaves. Typically, you have 30 to 90 days (depending on your certification body) to submit documented evidence that the root cause has been identified and resolved. The certificate can issue once the response is reviewed and accepted.

Major nonconformance: A systemic failure to meet a requirement, or a situation where a critical process has no evidence of operation at all. A major NC means the certificate cannot issue until a follow-up audit confirms the issue has been corrected. It is a significant outcome and requires a structured corrective action with a root cause analysis.

The practical difference between a minor and a major often comes down to how broadly the gap runs. One missing training record for one employee is minor. No training records for any employee hired in the past 12 months is major.

Five Stage 2 findings Kaiso sees most often

Across our delivery work in construction, manufacturing, engineering, and professional services, the same five gaps surface in Stage 2 audits with regularity. None of them are exotic. All of them are preventable.

1. Competency records missing for recent new hires. The process exists: induction checklist, skills matrix, training sign-off. But two people joined in the last four months, and nobody has updated their records in the system. The auditor picks one of them to speak to. The gap is visible immediately.
2. Customer complaints logged but corrective action not formally closed. The complaint is in the register. There is a note that the issue was resolved. But there is no root cause documented, no corrective action record, no evidence of verification that the fix worked. Clause 10.2 requires the full loop. Logging without closing is a nonconformance.
3. Supplier evaluation criteria exist but evaluation records do not. The procedure says suppliers are assessed annually against defined criteria. The approved supplier list exists. But when the auditor asks for the actual evaluation records, the evidence of the assessment actually being conducted, they are not there. The system was designed. The work was not done.
4. Internal audit conducted but findings not actioned. The internal audit happened on schedule. The report exists, with findings raised. But the corrective actions from those findings were never formally opened, tracked, or closed. The audit function completed its work; the response to it did not.
5. Quality objectives set but no measurement records. The business has quality objectives: on-time delivery rate, defect rate, customer satisfaction score. They are in the Quality Manual. But when the auditor asks how performance against those objectives is being tracked and reported, there is no data. The targets existed on paper and nowhere else.

Every one of these findings comes from the same structural pattern: a control was designed, implemented at the point of certification, and then not maintained. The audit trail reaches a step where the evidence should be and finds nothing.

What changes when an expert is in the room

Most businesses face their Stage 2 audit with their quality manager or operations director as the primary point of contact for the auditor. That person knows their business well. What they often do not know is how to frame evidence in the language auditors expect, how to respond when an NC is being raised, or how to challenge a finding they believe is incorrect.

Having an experienced ISO consultant in the room changes what the auditor is working with. Not because they deflect questions, but because they read the audit as it is happening.

Auditors move quickly through an evidence trail, and they do not announce when they are approaching a gap. A quality manager focused on retrieving records often does not register that the auditor is building a finding until the words are already being written down. A consultant who has sat in on dozens of these audits recognises the signals earlier, and can surface the relevant evidence or start shaping the corrective action response before the NC is formally raised.

When a nonconformance is recorded, the auditor expects the business to acknowledge the gap and indicate how it will be addressed. The phrasing matters. A vague response ("we'll look into it") leaves the door open for the auditor to probe further; a specific, credible one ("we'll implement monthly competency record reviews with sign-off from the operations manager") tends to close it. Whether a finding stays minor or becomes the starting point for a broader systemic inquiry often turns on that exchange.

Going in without representation is a reasonable call when the team has been through this before. For a first certification, the cost of getting that exchange wrong is a follow-up audit.

Preparing your operations team for Stage 2 questions

The quality manager cannot be everywhere on audit day. The auditor will be in the warehouse, the production bay, the project office. The people in those spaces need to be ready without being scripted.

Scripting is the wrong approach. Auditors are experienced at recognising rehearsed answers, and a rehearsed answer that does not match the procedure is worse than an honest one that reveals a gap. What you want is genuine familiarity with the relevant parts of the system.

For a production supervisor, that means being able to explain how they raise a nonconforming product (Clause 8.7), where the inspection records go, and what they do if something arrives from a supplier that does not meet specification. They do not need to know it is Clause 8.7. They need to know what they actually do, and there needs to be a record that they did it.

For the management team, it means being able to speak to the quality objectives without being briefed five minutes before: what they are, how they are measured, whether the business is on track, and what was discussed at the most recent management review.

A practical pre-audit walkthrough (running through the audit trail your auditor is likely to follow, checking that the evidence exists at each step, and letting your team answer realistic questions from someone who knows the standard) is more valuable than any amount of document formatting.

That walkthrough is exactly what Kaiso's expert review covers in the weeks before Stage 2. We follow the trail before the auditor does, surface the gaps while there is still time to close them, and make sure the people the auditor will speak to are ready for the conversation.

If you are approaching your Stage 2 audit and want to understand what maintaining the QMS after certification requires, or how a surveillance audit differs from Stage 2, those pieces cover the before and after. For audit day itself, Kaiso's Managed tier includes expert representation on Stage 2, so the auditor's questions go to someone who knows what to do with them.

Frequently asked questions

What is the difference between a Stage 1 and Stage 2 ISO 9001 audit?

Stage 1 is a document review: the auditor confirms your QMS is designed to meet the standard, checks your scope is defined, and confirms the organisation is ready for Stage 2. Stage 2 is an operational evidence audit: the auditor verifies that the system you documented is actually being followed in practice, by sampling real transactions, records, and people. Passing Stage 1 does not mean Stage 2 is straightforward; the gap between design and operation is where most first-time certification attempts collect findings.

Can a business fail ISO 9001 certification at Stage 2?

A business does not "fail" in the way an exam fails. If the auditor raises only minor nonconformances, the certificate can issue once documented corrective actions are submitted and accepted, typically within 30 to 90 days. A major nonconformance means a follow-up audit is required before the certificate issues. The audit process is designed to be corrective, not punitive; most businesses that receive findings at Stage 2 still achieve certification in the same cycle.

What evidence does an ISO 9001 auditor expect to see?

Auditors look for records that show a process was followed on real transactions: not templates or examples, but completed documents: a signed contract review form, a populated production planning record, a closed corrective action with root cause documented, a training record for the specific employee they are standing next to. The evidence needs to exist in proportion to the scale of the operation. An auditor who sees a procedure, an example form, and nothing else will note the gap.

How long does a Stage 2 ISO 9001 audit take?

For a small business (under 20 people), a Stage 2 audit typically runs one full day. Larger or multi-site organisations may require two or more days. The certification body sets the audit duration based on headcount and scope when the engagement is contracted. The auditor uses that time to follow at least one complete audit trail, conduct all three categories of conversation, and sample evidence across each applicable clause.

Who should be present during a Stage 2 audit?

At minimum: the quality manager or QMS coordinator, a senior leader who can speak to management review and quality objectives, and the process owner for each major operational area the auditor will visit. Front-line staff do not need to be formally present; the auditor will approach them in their work area. If the business is working with a compliance partner, having that expert in the room on Stage 2 day materially changes the outcome when findings are raised.