What does a registrar actually look at during a Stage 2 audit?

What to do now

Prepare for the method, not for the clause list. Auditors do not walk through the standard in order. They pick a thread and pull it.

Trace one job yourself, end to end, this week. Take a shipped order from the last quarter. Find the customer requirement, the order review, the work order, the material release, every inspection record, the nonconformance if there was one, the final release, and the shipper. That is the exercise the auditor will run, and every place your own trace breaks is a finding waiting.

Check the mandatory items. Internal audits completed against plan. Management review held with the inputs clause 9.3 lists. Corrective actions from previous findings verified as effective. These get looked at every visit.

Walk the floor and read what is taped to the benches. Obsolete revisions in use is the most common documented information finding, and it takes an afternoon to catch.

Ask three operators the same process question. If you get three answers and the procedure gives a fourth, fix that before the auditor finds it.

Brief your people honestly. Answer what is asked, show what is asked for, do not speculate, and say you will find out rather than guessing. Coaching people to recite answers is visible and counterproductive.

What it costs

Stage 2 is the larger part of the initial audit, and the initial audit is set by headcount: seven auditor days across Stage 1 and Stage 2 at 86 to 125 effective personnel, rising to eight at 126 to 175. At recent day rates in the trade of roughly $1,350 to $1,600 plus travel, the initial audit at a single site of about 100 people lands near $9,500 to $11,200.

The cost that varies is what the findings cost you afterward. Around four to six minor nonconformities is a normal outcome and closes through a corrective action plan, usually reviewed remotely. A major triggers a follow-up audit billed at the same day rate, and it has to close within the registrar's window, typically 60 to 90 days, with a full new Stage 2 possible if more than six months pass.

Internal preparation time is the other real cost, and it is mostly the trace exercise above plus closing what it finds.

What good looks like

An audit where the auditor's questions are answered from the system rather than from memory.

The pattern of a good Stage 2: the auditor asks for a record, someone retrieves it in under a minute, and it says what the process says it should. Repeat forty times. Findings still happen, and four to six minors is normal, but they are specific and isolated rather than systemic.

The areas where findings cluster are worth knowing in advance. Clause 8 operations and clause 9 performance evaluation produce most of them, and within those the recurring ones are calibration records, competence records, and incomplete management review. Those three are worth an afternoon each before the audit.

What good also looks like: your internal audit findings and the registrar's findings overlap. That means your program works.

When to bring in outside help

If this is your first Stage 2. The method is unfamiliar, and the difference between a company that has rehearsed the trace exercise and one that has not is visible within the first hour.

If Stage 1 produced a long list of concerns. Those concerns are the preview. A long list means the gap between your documentation and your practice is wide, and closing it in the interval is a scoping problem.

If nobody in the building has sat on the auditee side before. Hosting an audit is a skill. Knowing when to stop talking is most of it.

You do not need help for a routine surveillance visit on a system that has been running and passing. That is your quality manager's job and they should own it.

How ARG does it

We run a mock audit under the conditions the registrar will use: on site, evidence first, following real work through your processes rather than reviewing documents in a conference room. Same method, lower stakes, and several weeks of runway to fix what it finds.

The output is findings graded the way a registrar would grade them, with clause references and the evidence behind each, plus the specific items we expect your auditor to sample given your scope and your last cycle's results. Where a finding would be a major, we say so plainly.

On audit day, if you want it, someone who hosts registrar and customer audits for a living sits with your team. Noah Brown leads that work as a certified ISO 9001 lead auditor. We prepare you for the audit and your registrar decides the outcome. That independence is what makes their decision worth something to your customer.

FAQ

How much of the audit is on the floor versus in the office?

More on the floor than most people expect. Records are checked against what the auditor saw in the plant, and the interviews that matter happen at the workstation.

Can we say no to a question?

You can decline to speculate, and you should. You cannot withhold records inside the audit scope. If a question strays outside the scope on the certificate, saying so is legitimate.

What if we disagree with a finding?

Ask for the requirement, the evidence, and the gap in writing. Most disagreements resolve there. Formal appeals exist and work best on factual grounds rather than on severity.

Do they audit every clause?

At Stage 2, effectively the whole scope. Surveillance audits sample and rotate across the three-year cycle, with the mandatory items checked every time.

Who should be in the closing meeting?

Whoever can commit to corrective action. The general manager attending signals the leadership involvement clause 5 expects, and it makes the follow-up faster.

Sources

• ISO 9001:2015 clauses 8 and 9; IAF MD5:2023 audit-time tables.
• ARG market research 2026, section 4.5 for the four-to-six minor average and the clause 8 and 9 clustering, section 7.2 for registrar arithmetic, section 7.6 for major closure windows.