What are Stage 1 and Stage 2 audits?

What it is

Initial certification happens in two visits.

Stage 1 is a readiness review. The auditor checks that your documented system covers the requirements, that your scope makes sense, that internal audits and a management review have actually happened, and that you are ready for a full audit. It is often shorter and sometimes partly remote. The output is a readiness report listing areas of concern, which is not the same as a nonconformity but tells you exactly where Stage 2 will press.

Stage 2 is the real audit. The auditor samples your processes on site, follows work through the system, interviews people, and tests whether what you documented is what you do. Findings from Stage 2 are formal nonconformities. The certification decision follows from it.

The gap between them is usually a few weeks to a few months, long enough to address Stage 1 concerns and short enough that the picture has not changed.

When you will hear it

In your registrar's quote and audit plan, which will show both stages with their day counts.

In a consultant's project plan, where Stage 1 is often the milestone that reveals whether the schedule was realistic.

After a long gap. If too much time passes between the two stages, a registrar can require Stage 1 to be repeated.

What the auditor expects to see

At Stage 1: a documented system, and evidence that the required cycle has run at least once. That means a completed internal audit program covering the scope, a management review with the inputs the standard lists, and enough operating records to sample. This is where the roughly three months of implementation evidence expectation comes from. A system switched on last week has nothing to audit.

At Stage 2: the same threads pulled harder. Expect them to start from a customer order or a shipped job and follow it end to end, then go back into the supporting processes: competence, calibration, supplier control, nonconforming product, corrective action.

Common mistakes

Treating Stage 1 as a formality. The concerns it raises are a preview of Stage 2's findings. Companies that work that list arrive with far fewer nonconformities.

Booking Stage 2 before the evidence exists. You cannot compress the record history. An auditor sampling three months of internal audits needs three months of internal audits.

Assuming a major finding at Stage 2 means starting over. It does not, but it does trigger a follow-up audit and a clock.

Letting the scope drift between stages. If you add a product line or a building after Stage 1, say so. Discovering it at Stage 2 changes the audit-day calculation mid-visit.

FAQ

Can Stage 1 be done remotely?

Often, in whole or in part, because it is largely a document and readiness review. Stage 2 is on site.

How long is the gap between stages?

Typically a few weeks to a few months. Registrars set an outer limit, after which Stage 1 is repeated, because the system they reviewed is no longer the system in front of them.

What happens if we fail Stage 2?

Failure is rare in the sense of being sent away. What normally happens is nonconformities: minors close through a corrective action plan reviewed remotely, and a major requires a follow-up audit before the certificate is issued.

How many audit days are Stage 1 and Stage 2?

Together they are set by the IAF MD5 tables from your effective headcount. At roughly 86 to 125 people that is seven days across both stages, with Stage 2 taking the larger share.