IN BRIEF

Stage 1 of ISO 9001 certification is a documentation and readiness review under ISO/IEC 17021-1, held before the Stage 2 audit, in which the certification body checks scope, policy, processes, controlled documents, internal audit, management review, competence records and context to decide whether the quality system is ready to be tested live.

Your Stage 1 date is fixed. The auditor has confirmed. Now your team asks one question in three ways: are we ready? I have sat on your side of that table. Stage 1 scares people for the wrong reason. Nobody expects perfection yet. The auditor is not hunting for defects on your floor. That comes later, at Stage 2. Stage 1 asks a simpler question, with documents: have you built a real quality system on paper that matches the business you run, and can you prove you have tested it yourselves?

That two-stage shape is not the auditor's choice. Accredited certification bodies work under ISO/IEC 17021-1, which requires the initial audit to run in two stages. Stage 1 reviews documented information, scope and readiness, and ends with areas of concern to fix. Stage 2 then tests the system live. Walk in unprepared and you pay for a delay. Walk in ready and it becomes a useful rehearsal. Our ISO 9001 documents checklist lists the papers themselves. This post covers the eight things behind those papers.

The short answer: before Stage 1, have your scope defined, policy and objectives set, processes mapped, documents under control, one full internal audit done, one management review held, competence records ready, and context and interested parties written down. Miss one and the auditor will note it. Miss the audit or the review and Stage 2 may slip.

1. A defined scope

Your scope statement is the first thing the auditor tests, under clause 4.3. It names the products, services and sites your system covers, and any requirement you say does not apply, with your reason in writing. Keep it honest. A scope that claims head office and factory, when the system runs in the factory alone, will crack under two questions. A scope that hides design, when your team does design work, cracks faster. Write one short paragraph. Sign it off at the top. Make sure the words match what a visitor sees. The certificate will carry this wording. Choose words you can defend.

2. Quality policy and quality objectives

Clause 5.2 asks for a quality policy set by top management, with a pledge to meet requirements and to keep improving. Clause 6.2 asks for objectives that can be measured, with who will do what, by when, and how you will judge the result. Vague aims fail here. Serve customers better is a wish. Cut rework on the packing line this quarter, owned by a named person, is an objective. Keep the policy short. Put it where your people see it. Show how staff heard it, not just where it hangs. An auditor can tell in minutes whether the policy lives in the business or only on the wall.

3. A process map that shows interactions

Clause 4.4 asks you to set out the processes your system needs, what goes into each one, what comes out, and how they affect each other. One page can do this well. Draw your core chain, from enquiry to delivery, and place support work like purchasing around it. Name an owner for each process. Name how you judge whether it works. Keep it true. Think of this map as a railway chart: a stranger should trace a job from the station where it enters to the station where it leaves, and see every junction where it can go wrong. If your map hides a junction, the auditor will find it.

4. Documented information under control

Clause 7.5 covers documented information: how you create it, approve it, update it, store it and stop old copies being used by mistake. Stage 1 is a review of this material, so control shows at once. Check every core document for a title, a date or version, and an approver. Pull old prints off the floor. Make sure the copy your team opens is the current one. Gaps here worry auditors out of proportion to their size, and for good reason. If you cannot control your own papers, they doubt you can control your process. Spend an evening on versions. It pays.

5. One full internal audit, completed

Clause 9.2 requires internal audits at planned intervals, to check that your system matches your own rules and the standard, and that it works. Before Stage 1, complete at least one full cycle covering the whole system. Keep the plan, the notes, the report, and the record of what you fixed. Do not hide findings. Findings are good news here. They prove the audit was real. A report with no findings at all, in a new system, raises more doubt than one with honest findings and clear action taken. Keep the auditor independent of the work checked, as far as a small team allows. Note who audited what.

6. A management review, actually held

Clause 9.3 requires top management to review the system at planned intervals, to judge whether it still suits the business and works as planned. Hold one review before Stage 1, and keep proper minutes. Cover the inputs the clause lists: past actions, changes, customer feedback, process results, audit results, supplier performance, resource needs, risks and chances to improve. Record decisions, owners and dates as outputs. Top management must be there in person. A review run by a junior executive alone will not survive questioning. Keep it short if you must. One honest hour, with decisions written down, beats a thick file nobody remembers signing.

7. Records of competence

Clause 7.2 asks you to decide what competence each role needs, make sure people have it through education, training or experience, act where a gap shows, and keep evidence. Gather that evidence before Stage 1. For each key role, hold a short note of the skill needed, the person's training, and any work record that backs it. Training attendance alone is thin. Show that training worked: a supervisor's sign-off, or work checked after training. Watch gaps such as a new machine, a new inspector, or a deputy for a single expert. Auditors love that last one. A system that depends on one person is a risk to name first.

8. Context and interested parties, written down

Clauses 4.1 and 4.2 ask you to name the internal and external issues that affect your results, and the interested parties whose needs matter. Write both down in plain words. Issues might be a key supplier, skilled staff leaving, a buyer's new quality clause, or power cuts in summer. Parties will include customers, regulators, suppliers and your own people, with what each one needs from you. Link this work to your risks and objectives, so it reads as one story, not three forms. Update it if facts changed this year. A page that still names a client you lost tells the auditor the page is decoration. Keep it current.

Do a dry run in the last week. Sit with the eight items on one sheet. Ask a colleague who did not write the documents to find each one in five minutes. Where they fail, your auditor will struggle too. Fix the filing, fix the version, fix the missing sign-off. Small fixes. Real gains. Keep Stage 2 in view: Stage 1 clears you to be tested live, it does not certify you. Our account of what happens when a Stage 2 audit fails shows why Stage 1 habits matter more when the auditor watches the work itself.

Ready means calm. If your eight items sit in one place, current and signed, you can welcome the auditor, answer plainly, and take the areas of concern as free advice for Stage 2.

Want help getting Stage 1 ready? See our ISO 9001 certification service: we run a gap check, build a lean document set with your team, complete your internal audit and review, and stand with you through both stages.