Key takeaways
- 1Look at what Stage 1 is required to produce.
- 2Three features of Stage 1 read as casual and are all consequences of the clause.
- 3§9.3.1.2.3 requires the documented conclusions to identify any areas of concern that could be classified as a nonconformity during stage 2.
ISO/IEC 17021-1 requires an audit plan for the audits in a certification cycle. Stage 1 is the exception, and the exemption is one line:
§9.3.1.2.1 NOTE — Stage 1 does not require a formal audit plan.
It is the kind of sentence that looks like an administrative easement and is actually the clearest statement in the standard of what Stage 1 is for.
Why the exemption has to exist
Look at what Stage 1 is required to produce. §9.3.1.2.2 f) makes one of its objectives to "provide a focus for planning stage 2 by gaining a sufficient understanding of the client's management system and site operations".
The Stage 2 audit plan is downstream of Stage 1. It is one of the outputs.
So requiring a formal audit plan as an input to Stage 1 would require the thing the activity exists to make possible. The exemption is not leniency; it is the only arrangement that is coherent.
What the clause does require instead is narrow and specific: planning shall ensure the Stage 1 objectives can be met, and the client shall be informed of any on-site activities. Purposeful, and told in advance where people will be. That is the whole procedural requirement.
What gets mistaken for informality
Three features of Stage 1 read as casual and are all consequences of the clause.
It is conversational. §9.3.1.2.2 b) directs the auditor to "undertake discussions with the client's personnel". Discussion is the prescribed method for that objective, not a softer substitute for one.
It has no fixed agenda you were sent. There is no formal plan because the plan is being built.
Its output does not look like an audit report. The note to §9.3.1.2.3 says the Stage 1 output "does not need to meet the full requirements of a report". Format relaxed — existence not optional. The same clause makes documented conclusions a "shall".
Add them together and the day feels unlike the audits around it. Every one of those differences is written into the standard, and none of them lowers what Stage 1 decides.
The part that is not relaxed at all
§9.3.1.2.3 requires the documented conclusions to identify any areas of concern that could be classified as a nonconformity during stage 2.
That is a forward-looking statement, made in writing, about what would be raised later if nothing changed. There is no equivalent obligation anywhere else in the cycle: Stage 2 and surveillance report what is, and Stage 1 reports what would be.
An activity that produces a written forecast of future nonconformities is not a light-touch preliminary. It is the only point in the process where that document exists.
Where Stage 1 happens, and why the standard does not say
The clause carries a note rather than a requirement:
If at least part of stage 1 is carried out at the client's premises, this can help to achieve the objectives stated above.
"Can help", not "shall". The standard leaves the location open and then tells you which way the help runs.
That reticence is consistent with everything above. Three of the seven objectives — evaluating site-specific conditions, obtaining scope information about sites, processes and equipment, and gaining sufficient understanding of site operations — are anchored to a place. How much of that a given Stage 1 can achieve remotely depends on the operation, which is precisely the kind of judgement a standard cannot make in advance for every organisation.
So the location is a decision with a stated direction of travel, and it is a reasonable thing to ask a certification body to explain.
Reading it back
Stage 1 has no formal plan because it is producing one. It is conversational because the clause prescribes discussion. Its output is informal in shape because the note says format is not the point, and mandatory in substance because the clause says "shall".
The exemption people notice and the seriousness people miss come from the same place.
This is generic information about the requirement, not advice on any particular management system.
CAS — An EGAC accredited MS certification body No. 012418 for ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301.
Common questions about the granting path: cas.com.eg/cas/faq
Read next