Insights · 4 min read

Two of Stage 1's seven objectives are not about you

In week two we wrote that Stage 1 is an audit with defined outputs rather than an introductory visit, and listed what it examines. That list was…

Published by CAS — Conformity Assessment Services · 4 September 2026

In week two we wrote that Stage 1 is an audit with defined outputs rather than an introductory visit, and listed what it examines. That list was accurate and it was incomplete.

ISO/IEC 17021-1 §9.3.1.2.2 gives Stage 1 seven objectives, lettered a) to g). Five of them are an assessment of the client. Two of them are not an assessment of anything — they are the audit team preparing itself.

That is the part nobody describes, and it changes what the day is.

The two that were missing

e) review the allocation of resources for stage 2 and agree the details of stage 2 with the client.

f) provide a focus for planning stage 2 by gaining a sufficient understanding of the client's management system and site operations in the context of the management system standard.

Read them as instructions to the auditor, because that is what they are. One is about how many auditor-days Stage 2 needs and who will be there. The other is about the audit team knowing enough to write a plan that goes to the right places.

Neither produces a judgement about the organisation. Both produce a Stage 2 that is possible.

Two people in the room, two different questions

The organisation experiences Stage 1 as being looked at. Reasonably: five of the seven objectives are exactly that.

The auditor is doing that and something else at the same time — working out whether Stage 2 can usefully happen, what it would take, and where it would need to go. The same conversation serves both purposes and only one of them is visible from the client's chair.

Which explains a common piece of confusion. People report that Stage 1 felt like a discussion rather than an audit, and conclude it was informal. It was a discussion because objectives e) and f) are met by discussing: §9.3.1.2.2 b) says in terms that the auditor is to "undertake discussions with the client's personnel". The informality is the method, not the seriousness.

The standard removes the one thing that would make it look like an audit

§9.3.1.2.1 carries a note that is easy to read past:

Stage 1 does not require a formal audit plan.

Every other audit in the cycle has one. Stage 1 is exempt, and the exemption is not an oversight or a courtesy.

It follows from objective f). A formal audit plan for Stage 2 is one of the things Stage 1 exists to make possible — you cannot require, as an input, the document the activity is there to produce. So the standard requires only that planning ensure the objectives can be met, and that the client is told about any on-site activities.

The visit that feels least like an audit is shaped that way by the clause, for a reason that has nothing to do with how serious it is.

What Stage 1 must hand over

§9.3.1.2.3 is a "shall". Documented conclusions on whether the Stage 1 objectives were met and on readiness for Stage 2 are communicated to the client — including identification of any areas of concern that could be classified as a nonconformity during Stage 2.

Two things follow that are worth separating.

The output is forward-looking. It is not a verdict on the current system; it names what would be written up later if it stayed as it is.

And the output is owed, not offered. Its note says it "does not need to meet the full requirements of a report", which is about format, not about whether it exists. A Stage 1 that produced no documented conclusions did not meet §9.3.1.2.3.

The sentence at the end of the clause

§9.3.1.2.4 sets out how the interval between the stages is determined, and finishes:

The client shall be informed that the results of stage 1 may lead to postponement or cancellation of stage 2.

Not may in unusual cases. It is a standing obligation on the certification body to say so in advance, which is why you are reading it here rather than discovering it later.

The same clause adds something that gets left out when the interval is described: the certification body may also need to revise its arrangements for Stage 2. The gap is not only there for the client to act in. Sometimes what Stage 1 established is that the audit team got the resourcing wrong, and the interval is when that is corrected.

What this means for reading the day

Stage 1 is one activity serving two purposes, and the second one is invisible unless you know it is there.

So the questions that get the most out of it are about the audit rather than about your own readiness: which objectives were met, what areas of concern were identified, what Stage 2 will now be resourced and planned to cover, and whether anything found means Stage 2 moves.

Every one of those has a clause behind it, and none of them is a favour.

This is generic information about the requirement, not advice on any particular management system.