Failed Your Stage 2 Audit? What a Re-Audit Actually Involves, and How to Pass It

The auditor has left. There is no certificate. In its place you have a report with findings graded major and minor, and a sinking feeling that months of work have gone to waste.

They have not. What happened to you has a precise name in the certification world, a set procedure, and a clear way back. Most companies that reach this point do get certified. They get there by understanding what the report actually says, instead of treating it as a verdict on the business itself.

What "failing" a Stage 2 audit actually means

Stage 2 is the implementation audit. The certification body's auditor has interviewed your people, watched your processes run and sampled your records. A "fail" at this stage rarely means the auditor packed up and refused you outright. It means the certification decision cannot be made yet, because the findings are too serious to close on paper.

Every finding starts from the same definition. Under ISO/IEC 17021-1, the standard that governs how accredited certification bodies audit and certify management systems, a nonconformity is simply the non-fulfilment of a requirement. What decides your next steps is the grade attached to it.

Read your report with that table open. A Stage 2 with only minors is not a failure at all in practical terms — it is a pass with homework. A Stage 2 with one or more majors is the situation this guide is about. The certificate is on hold, not cancelled, and the clock rules below now apply to you.

The first thing the body asks for: correction, cause, corrective action

ISO/IEC 17021-1 requires the certification body to ask you to analyse the cause of each nonconformity and describe the correction and corrective action you will take, within a defined time. Three words in that sentence matter, and companies mix them up constantly.

Correction is the immediate fix for the specific instance found. The missing calibration record is produced. The unsigned review sheet is completed. Root-cause analysis asks why it happened at all. Corrective action is the change that stops it happening again, anywhere in the system, not just in the file the auditor opened.

Here is the difference in one picture. A correction is mopping the floor under a leaking pipe. It is necessary, and the floor does need mopping. But the auditor is looking for the person who finds the cracked joint, replaces it, and checks the other joints on the same line. Send the body a mop and you will meet the same finding again at the follow-up visit, graded no kinder the second time.

How long do you get to send this plan? The standard deliberately leaves the exact window to each certification body — it says "a defined time", not a number of days. Published procedures from certification bodies show how much this varies in practice. Schellman, a certification body, publishes 14 days from the close of the review for the corrective action plan covering both majors and minors, evidence of correction within 30 days, and evidence of remediation for majors within 60 days. The Kenya Bureau of Standards certification policy asks for an acceptable plan within two weeks and a close-out audit for majors within 60 days. Other bodies publish different splits again. None of these numbers is a law that applies to you. The number that applies to you is the one in your own body's nonconformity report and procedure document. Read that first, diary it, and work backwards from it.

The one deadline that is not negotiable: six months

There is, however, one hard line written into ISO/IEC 17021-1 itself. If the certification body cannot verify the implementation of corrections and corrective actions for a major nonconformity within six months after the last day of Stage 2, it must conduct another Stage 2 audit before it can recommend certification.

Six months sounds generous. It is not, once you allow for the body's audit scheduling, your own implementation time and the evidence period the follow-up auditor will want to see. Treat the six months as an outer wall, not a target. A company that starts corrective action in week one is choosing its follow-up date. A company that starts in month four is accepting whatever date it is given — if one is available in time.

What the re-audit actually involves

The return visit goes by several names — follow-up audit, supplementary audit, limited re-audit. Published certification procedures describe the same fork in the road. ControlCase's published certification procedure, for example, lists the possible outcomes of an audit as a recommendation subject to closure of the nonconformities, a limited re-audit or follow-up visit at a later date based on the findings, or no recommendation, which usually means a complete re-audit is necessary.

A follow-up audit is not Stage 2 done again from zero. Its job is narrow and specific:

• Re-test the areas where the major nonconformities were raised, against the same requirements.
• Verify that the correction removed the specific instance the auditor found.
• Judge whether the corrective action has actually been implemented and is effective — not merely written down.
• Check anything closely connected to the failed area, where the same weakness could reasonably be hiding.

The rest of your system is not re-audited in full. That is the good news. The harder news is that the failed areas get examined more closely the second time, by an auditor who has read the first report and knows exactly where to look. If verification cannot be completed inside the six-month window, the position resets: a fresh Stage 2, as the standard requires.

On cost, be plain with yourself. A follow-up visit is auditor time, and certification bodies charge for it. ControlCase's published procedure states it directly: for a limited re-audit or a complete re-audit, additional fee and expenses will be charged. Other bodies handle it the same way under their own fee schedules. What no honest source can give you is a figure — the charge depends on your body's rates and how much auditor time your findings need. Ask for it in writing when the follow-up is proposed, so it lands in your budget as a known cost rather than a surprise.

Minors travel a different road. Your plan for them is reviewed and accepted before the certification decision, but proof that the action worked is normally examined at the next surveillance audit. Do not file the plan and forget it. An accepted plan that was never implemented is exactly the kind of finding that comes back upgraded.

How to actually pass the follow-up

I have one piece of advice that matters more than the rest of this page put together. Fix the system, not the paperwork.

The classic failed recovery looks like this. A procedure is written in the week before the follow-up. It is dated, signed and beautifully formatted. Nobody on the floor has read it, because until last Tuesday it did not exist. The auditor asks an operator what he does when a job fails inspection, and he describes the old practice, honestly, because that is still the practice. The finding reopens. Paper written for an auditor fools no auditor for long.

The recovery that passes looks duller, and it works:

• Change the real practice first. If the finding was about supplier evaluation, evaluate your suppliers — all of them, properly — and let the records be the by-product of doing it.
• Let evidence build over time. Records spread across several weeks tell a story of a system in use. A complete folder created in two days tells the opposite story, and auditors read dates the way accountants read ledgers. Start early so the evidence can be genuine.
• Run your own audit before theirs. Complete a proper internal audit of the affected areas — and honestly, of the whole system if the majors pointed that way — and close what you find. Our guide to running an ISO 9001 internal audit walks through how to do this without it becoming a tick-box exercise.
• Hold the management review again, properly. Top management should review the audit failure itself: what it revealed, what has changed, what resources the fix needed. Minutes that show real decisions carry weight. Minutes that show attendance do not.
• Check the fix held. Before the follow-up date, sample your own records for the same failure. If you find it again, say so in your corrective action update and show what you changed next. A second, honest attempt beats a confident claim that collapses on the day.

The honest limits, stated plainly

Recovery is the normal outcome. It is not a guaranteed one.

If major nonconformities are not addressed within the agreed timeframe, the audit team can recommend refusal, and the certification agreement you signed sets out what happens to the application and the fees already paid. Repeated failure — the same breakdown found again, or corrective action that exists only as a plan — can bring the engagement to an end. At that point a new application, and in substance a fresh start, is what remains.

Two wider truths are worth holding on to while you do this work. A certificate, when it comes, is not a government licence, and it guarantees no order, no tender and no customer. And if you are still deciding which standard your business should hold at all, start there rather than in the middle of someone else's requirement — our guide to which ISO certification your business needs maps the main standards by industry. The value of the certificate you are fighting to recover is that an independent body verified a working system. That is also, not coincidentally, exactly what you have to build to get it.

Your next two weeks

Stripped down, the work is this. Read the report and grade every finding honestly. Diary your body's plan deadline and the six-month outer date. Write corrections, causes and corrective actions you can genuinely carry out. Implement them in the real process, early enough for real records to exist. Audit yourself, review it at the top, and invite the follow-up when you can show the system running — not before.

If your Stage 2 report is sitting on your desk right now and you want a second pair of eyes on it before you reply to the certification body, look at how we support companies through the full ISO 9001 certification process, including closing nonconformities — and bring the report to the first conversation. We will read the findings with you, grade by grade, and tell you honestly what closing them will take.