Stage 1 vs stage 2 audit: what each covers and how to schedule them

Stage 1 vs stage 2 audit: the short answer

The stage 1 vs stage 2 audit distinction comes from ISO/IEC 17021-1:2015, clause 9.3.1, which requires the initial certification audit of a management system to be conducted in two stages. Stage 1 asks whether the client is ready and gives the certification body what it needs to plan stage 2. Stage 2 asks whether the system is implemented and effective.

For planners, they are two bookings that depend on each other. Stage 1 can change the duration, team and focus of stage 2, and the gap between them decides when the client can be certified. The certification cycle itself starts from the certification decision after stage 2.

What does a stage 1 audit cover?

Clause 9.3.1.2.2 of ISO/IEC 17021-1:2015 sets the stage 1 objectives. In plain terms, the auditor must:

• Review the client's documented management system information.
• Evaluate site-specific conditions and discuss with the client to decide whether it is ready for stage 2.
• Review the client's status and understanding of the standard's requirements, in particular key performance, significant aspects, processes, objectives and operation.
• Obtain information on scope, processes, locations and related statutory and regulatory aspects.
• Review the allocation of resources for stage 2 and agree its details with the client.
• Give focus to planning stage 2 by understanding the management system and site operations.
• Evaluate whether internal audits and management reviews are planned and performed, and whether implementation shows readiness for stage 2.

Stage 1 conclusions must be documented and communicated to the client, including any areas of concern that could be classified as nonconformities during stage 2 (clause 9.3.1.2.3). The client is told in advance about any on-site activities planned for stage 1. Sector schemes, such as food safety schemes, add their own stage 1 rules, so check them for each standard.

What does a stage 2 audit cover?

The purpose of stage 2, in clause 9.3.1.3, is to evaluate the implementation, including effectiveness, of the client's management system. It takes place at the client's site or sites. It covers evidence of conformity with the standard, performance monitoring and review against objectives, the client's ability to meet statutory, regulatory and contractual requirements, operational control, internal auditing and management review, and management responsibility for the policies.

Stage 2 is where the competence requirements for the audit team bite hardest. The team as a whole must cover the technical areas in the client's scope, which is why stage 1 findings about processes and sites should feed straight into team selection.

How is audit time split between stage 1 and stage 2?

For QMS, EMS and OH&S, the IAF MD 5:2023 tables give initial audit time for stage 1 plus stage 2 together. MD 5 notes that normal practice is for stage 2 to take more time than stage 1. It does not fix a ratio, so the split belongs in your procedure and on the client file.

Plan the split around what stage 1 needs to achieve. A client with many sites, complex processes or significant legal requirements needs a stage 1 that can see enough to plan stage 2 properly. See IAF MD 5 audit time for how the total is set, and audit man-days for how days turn into bookings.

How long should the gap be between stage 1 and stage 2?

ISO/IEC 17021-1 sets no fixed interval. Clause 9.3.1.2.4 says that in deciding the interval, the certification body shall consider the client's need to resolve areas of concern identified at stage 1. The certification body may also need to revise its arrangements for stage 2, and where significant changes affecting the management system occur, it considers whether to repeat all or part of stage 1.

Certification bodies can set their own maximum in their procedures. One published procedure, for example, says stage 2 must start no more than 180 days after the last day of stage 1. Whatever you choose, write it down and check it when a client asks to move stage 2.

How should planners schedule stage 1 and stage 2?

1. Book both togetherPencil in stage 2 when you confirm stage 1, so the client sees the full path to certification and your team has capacity reserved.
2. Leave room for concernsPlace stage 2 far enough out for the client to act on stage 1 concerns, without breaching your maximum interval.
3. Feed stage 1 back into stage 2Update scope, sites, shifts, headcount and technical areas from stage 1, then recheck audit time and team competence.
4. Think about continuityUsing the stage 1 lead auditor for stage 2 saves learning time, if competence and impartiality checks allow it.
5. Anchor the cycleRecord the certification decision date. The first surveillance audit is due within 12 months of it.

Common stage 1 vs stage 2 audit mistakes

When one stage moves, the other often has to move too. Treat them as linked bookings in your plan, as described in our guide to audit rescheduling.

ScheduleAI is audit scheduling software built for testing, inspection and certification (TIC) organisations, with a planner approving every plan.