The four things every auditor samples
- Internal audit (clause 9.2). Your program must cover the whole QMS scope over its cycle, be performed by objective auditors (not auditing their own work), and produce findings that got fixed. An internal audit that found nothing invites deeper external scrutiny, not less.
- Management review (clause 9.3). Bring records showing all required inputs were considered (audit results, customer feedback, process performance, risks, resources) and that outputs were decisions with owners, not a slideshow that ended in coffee.
- Corrective actions (clause 10.2). Every nonconformity, complaint, and audit finding should show: correction, root cause analysis, action on the cause, and an effectiveness check. Root causes that read "operator error, operator retrained" signal a weak system to any experienced auditor.
- Objectives and measures (clause 6.2, 9.1). Current data against each objective, and an honest story for the ones behind plan. Behind plan with analysis beats on plan with no data.
Preparing your people (the part most companies skip)
Auditors spend most of their time with process operators, not the quality manager. Staff do not need to recite clause numbers; they need to answer three questions about their own work: what do you do and how do you know how to do it, how do you know your output is good, and what do you do when something is wrong. Walk the floor asking exactly those questions two weeks before the audit. Where answers wobble, that is your preparation list.
Logistics that make audit day smooth
Confirm the audit plan and scope with the certification body in advance, book the people the plan names, prepare a workspace, and appoint one guide per auditor who knows where records live. Pull the previous audit's findings and have their closure evidence ready unprompted; opening with credibility changes the tone of the entire visit.
The mindset correction
Do not stage the company. Auditors are trained to detect freshly minted records and rehearsed answers, and discovery of staging converts a routine audit into a forensic one. Run the system for real all year and preparation reduces to tidying evidence, which is exactly how it should feel.