The two items most often found incomplete at stage 1

Stage 1 has a checklist, and two items on it come back as areas of concern more than all the others combined. Both are things a client controls entirely, and both set the length of the interval before stage 2.

The internal audit programme

Every management system standard in our accredited scope requires internal audits at planned intervals, and stage 2 examines the results. A client who arrives at stage 1 with a programme written but not yet run has nothing for stage 2 to examine. The area of concern is not that the programme is wrong; it is that it has not happened.

What resolves it: at least one full internal audit cycle covering the scope, with findings raised, actions taken and records kept. That takes as long as it takes, and it is the single largest determinant of the interval.

The management review

The same logic. The standards require top management to review the system at planned intervals, with defined inputs and outputs. A review that is scheduled for after certification cannot be examined at stage 2. The area of concern, again, is absence rather than error.

What resolves it: a review held, with the inputs the standard lists actually considered and the outputs recorded.

Because they are the two mechanisms by which a system looks at itself. An auditor at stage 2 is examining whether the system works; the internal audit and the management review are the client's own evidence of the same question. Without them, stage 2 has to build that picture from scratch, and usually cannot.

The others, briefly

Scope wording that does not match what the site does. Statutory and regulatory requirements not identified. Objectives set but not measured. Documented information the standard requires that has not been established. Each of these is named at stage 1 with the clause it relates to, and each has a resolution the client can plan.

What stage 1 is not

It is not consultancy, and the areas of concern are not advice on how to design the system. ISO/IEC 17021-1 clause 5.2.5 keeps that line. Stage 1 says what the requirement is and where readiness falls short of it. How the client closes the gap is the client's decision.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.