The gap between Stage 1 and Stage 2: why it exists and how long it runs

Initial certification is a two-stage audit, and the interval between the stages is not dead time. It is where stage 1 does its work. This article is about what happens in that gap, what the standard says about its length, and why nobody can quote you a fixed number of days.

What stage 1 is for

ISO/IEC 17021-1 clause 9.3.1.2.2 lists the objectives of stage 1. In plain terms: review the client's management system documented information; evaluate the site-specific conditions and talk to the client's personnel to determine preparedness for stage 2; review the client's status and understanding of the standard's requirements — key performance or significant aspects, processes, objectives, operation; obtain the information needed about the scope, including sites, processes and equipment, levels of control (particularly for multi-site clients) and applicable statutory and regulatory requirements; review the allocation of resources for stage 2 and agree its details; and provide a focus for planning stage 2 by gaining sufficient understanding of the system and site operations.

Stage 1 is, in other words, a readiness assessment with a defined checklist. It is not the certification audit, and it does not end with a certificate.

What stage 1 produces

Clause 9.3.1.2.3 requires documented conclusions on fulfilment of the stage 1 objectives and on readiness for stage 2 to be communicated to the client — including identification of any areas of concern that could be classified as a nonconformity during stage 2.

That last phrase is the gap's whole purpose. Stage 1 tells the client, in writing, where stage 2 is likely to find a nonconformity. The interval is the time the client has to do something about it.

What the standard says about the length

Clause 9.3.1.2.4, in full effect: in determining the interval between stage 1 and stage 2, consideration shall be given to the needs of the client to resolve areas of concern identified during stage 1. The certification body may also need to revise its arrangements for stage 2. If any significant changes which would impact the management system occur, the certification body shall consider the need to repeat all or part of stage 1. And the client shall be informed that the results of stage 1 may lead to postponement or cancellation of stage 2.

Notice what the clause does not contain: a number. There is no minimum interval and no maximum in ISO/IEC 17021-1. The length is determined by one thing — how much the client needs to resolve — plus the certification body's own planning.

Why there is no fixed number

Two clients with the same standard and the same size can leave stage 1 in very different positions. One has a mature system and two minor areas of concern; a few weeks is enough. The other has an internal audit programme that has not yet run a full cycle and a management review that has not happened; stage 2 cannot usefully begin until both have, and that may be months.

A fixed interval would be wrong for both. The standard instead ties the interval to the areas of concern, which is the only variable that actually matters.

What can change in the gap

The client resolves the areas of concern. This is the intended outcome and the ordinary one.

The certification body revises its stage 2 arrangements. Stage 1 may show that the scope is larger than applied for, that a site was omitted, that the audit team needs a different sector competence. The plan changes accordingly.

Stage 1 is repeated, in whole or in part. If a significant change occurs that would impact the management system — a merger, a new site, a redesign of core processes — the body shall consider whether the stage 1 conclusions still hold.

And the fourth outcome the client is told about in advance: stage 2 can be postponed or cancelled on the basis of stage 1. That is not a threat; it is the clause requiring the client to be informed of a real possibility.

How CAS handles the interval

The stage 1 conclusions go to the client in writing, with the areas of concern listed. The client tells us when those are resolved. We confirm the stage 2 date, the team and the plan against what stage 1 found. We do not set a countdown, and we do not certify readiness — the client's own internal audit and management review are the evidence that the concerns are closed, and stage 2 is where that evidence is examined.

What this means for you

If you are preparing for certification: run your internal audit cycle and your management review before stage 1, not after. They are the two items most often found incomplete, and they set the length of the gap more than anything else.

If you are between the stages now: work the list you were given, in writing, and tell the certification body when it is done. The interval is yours to shorten.

If you are comparing certification bodies: a body that promises a fixed interval, or a certificate by a fixed date, is promising something the standard does not let it know in advance.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.

Verify any certificate: cas.com.eg/certsearch