# QMS certification cycle audit planner

Use this to plan the audits across one ISO 9001 certification cycle, whether you are the organization's
internal auditor or the certification body's lead auditor. The stages follow the audit practice taught for
PECB's ISO 9001 Lead Auditor exam. ISO 9001 is sold rather than published; check requirement wording
against your own copy of the edition you are auditing (ISO 9001:2026 is current).

## Before certification

- [ ] Internal audits completed across the scope (an organization cannot pass stage 2 without them)
- [ ] A management review held and recorded
- [ ] The edition being certified named in full: ISO 9001:2026, or a transition agreed with the certification body

## Stage 1

- [ ] Documented information reviewed, including the organization's context and scope
- [ ] Site visited: conditions evaluated, staff spoken to
- [ ] Internal audits and management reviews planned or done
- [ ] Resources for stage 2 reviewed
- [ ] Gaps reported as areas of concern to resolve before stage 2 (not graded as nonconformities)
- [ ] Stage 2 audit plan confirmed and adjusted

## Stage 2

- [ ] Processes audited where the work happens, not only from documents in a meeting room
- [ ] Effectiveness checked against results (for example complaint trends), not only conformity on paper
- [ ] Each nonconformity states the requirement not fulfilled and the evidence
- [ ] Notes clear enough that another auditor would reach the same conclusions

## Surveillance (years one and two)

- [ ] First surveillance audit within a year of the certification decision (counting from the decision itself)
- [ ] Scope sampled, not the whole system: sites and processes chosen for this visit: ____________
- [ ] If the auditee refuses a surveillance audit: document the refusal and recommend suspension

## Recertification (year three)

- [ ] A full system audit covering the whole scope
- [ ] Objectives set in advance (for example, the highest-risk processes confirmed effective)