How to prepare for an ISO 9001 or IATF surveillance audit

Before you start

Read the report from your last external audit first. Any finding from that visit, and the action you took on it, is a natural starting point, because an auditor may ask what changed. Then check the audit plan your certification body sent, so you know which processes and sites are in scope this time.

Evidence to show, by topic

Internal audit: Your audit plan for the year, the reports of the audits done since the last external audit, and the actions raised from them with their status.
Management review: The minutes of the last review, with the inputs you looked at, the decisions taken, and who owns each follow-up.
Corrective action and 8D: Your CAPA or 8D log, with a root cause, an owner, a due date and an effectiveness check for each closed item. Pick two or three closed cases you can walk through from complaint to proof.
Nonconforming product: Records of parts that were held, sorted, reworked or scrapped, with who decided and how the parts were marked and kept apart.
Supplier control: Your supplier list, how you rate each supplier, and what happened with any supplier problem since the last audit.
Calibration and measurement: The list of measuring equipment with due dates, the last calibration records, and what you did when a gauge was found out of tolerance.
Documents and records: That the procedures and work instructions at the workplace are the current revision, and that records can be found without a search.
Training and competence: A training matrix or similar list showing who is qualified for which job, and records for people who started or changed jobs since the last audit.
Process monitoring and KPIs: The figures you track for your main processes, how they moved since the last audit, and what you did where a target was missed.
Change management: Changes to products, processes, people or suppliers since the last audit, with how each was planned, checked and released.
Customer complaints and feedback: The complaint list with the response for each case, and how you collect and look at customer feedback.

This is a starting set of topics in our own words, not your whole system or audit scope, and not a copy of any standard. Your certification body decides what it samples.

If you hold an IATF 16949 certificate

An IATF auditor may also look at customer-specific requirements, control plans and their reaction plans, layered or process audits, and how you handle customer complaints with 8D reports. The control plan template and the LPA checklist show the records behind two of these. Customer-specific requirements are not covered by this guide.

Go through the topics as questions

The free audit evidence self-check asks up to 25 short questions on records for an ISO 9001 surveillance or recertification audit, with 3 extra questions for automotive (IATF 16949) sites. Your result and gap list show on screen without an email; the printable PDF needs one. It is a self-assessment from your own answers, not an audit and not a prediction of your certification body's result.

Two weeks before the audit

Close or update the open actions from the last audit, and note the reason for any that are still open.
Check that each closed corrective action has proof that it worked, not only a closing date. See the CAPA log review checklist.
Walk the shop floor with a fresh eye: revisions at the workplace, labelled held parts, gauges with a valid date.
Agree who guides the auditor in each area and where the records are kept.

If an auditor raises a finding

Treat it like any other problem: contain it, find the root cause, act on it, and show that the action worked. The guide on responding to an audit finding with an 8D walks through the steps.

Advisory guide, in our own words. Not affiliated with ISO, IATF or any certification body. Not an audit result or a certification body opinion.