ISO 9001 Audit Prep: A 90-Day Checklist for Operations Leaders
You just got the audit notice. The surveillance audit is in 90 days. Or maybe it is recertification and the calendar pressure is even higher. Either way, the next 13 weeks decide whether your auditor signs the report cleanly or whether you spend the next six months responding to non-conformities.
This is the week-by-week countdown we use with operations leaders who own ISO 9001 (and the same structure works for 14001, 27001, and 45001). It assumes you already have a QMS in place — what you need now is to make sure it can withstand scrutiny.
~35%
of certified orgs have at least one major NC during surveillance
5 mins
is how fast an auditor expects evidence to be retrievable
13 weeks
is the realistic prep window — start later and you are guessing
Weeks 13–10 (Day 90–60): Scope, gap, evidence inventory
The first three weeks are about getting the truth of where you stand — not where you would like to think you stand.
Weeks 13–10 deliverables
- ✓
Confirm audit scope with your certification body — sites, processes, exclusions
- ✓
Run a clause-by-clause gap analysis against ISO 9001:2015 (4–10)
- ✓
Inventory every required record: management review minutes, internal audit reports, training, calibration, CAPA
- ✓
Identify the 10 most-cited findings in your industry and self-test against them
- ✓
Pull the previous audit's NCs and confirm every corrective action is closed and evidenced
- ✓
Build a single retrieval index: clause → evidence → location → owner
💡 Pro Tip
The single best predictor of a clean audit is not the QMS itself — it is whether you can retrieve any piece of evidence in under five minutes. Auditors test retrieval speed deliberately; slow retrieval signals a paperwork QMS, not a lived one.
Weeks 9–6 (Day 60–30): Internal audit and management review
You should have at least one full internal audit cycle and one management review on the books before the external auditor arrives. If you do not, this is the window.
Weeks 9–6 deliverables
- ✓
Complete the internal audit programme — minimum one full cycle across all scoped processes
- ✓
Hold management review with documented inputs (clauses 9.3.2 a–f) and outputs (clauses 9.3.3 a–c)
- ✓
Raise corrective actions for any internal-audit findings; close them or have a credible plan
- ✓
Train staff on what they will be asked: their role, their training, where they find the procedure
- ✓
Refresh competence records — every employee in scope, every required training
- ✓
Calibrate measurement equipment if any has drifted past tolerance or expired
ℹ️Auditors will go to the shop floor and ask an operator: "Show me the procedure for X." If the operator says "I don't know" or pulls up the wrong version, that is a finding — regardless of what is in your QMS document library.
Weeks 5–2 (Day 30–14): Mock audit and interview prep
The last month is about pressure-testing under audit conditions, not generating new evidence.
Weeks 5–2 deliverables
- ✓
Run a full mock audit — ideally with an external consultant or someone from another site
- ✓
Walk every scoped process from input → output → improvement loop
- ✓
Stage interview prep for managers — the questions auditors will ask
- ✓
Drill retrieval: pick five random clauses and time how fast evidence appears
- ✓
Update the QMS document index — anything edited in the last 60 days needs change control
- ✓
Confirm document control: every controlled document at correct revision, obsolete copies removed
Week 1 (Day 14–0): Logistics, calm, and confidence
The last week is execution, not generation. Anything you have not built by now is a risk you accept.
Week 1 deliverables
- ✓
Confirm logistics — meeting room, IT access, escorts, lunch arrangements
- ✓
Confirm who is the audit lead, the recorder, and the runner
- ✓
Brief every interviewee on tone: answer the question asked, don't volunteer scope creep
- ✓
Have a fresh printout of the QMS scope statement available
- ✓
Have evidence retrieval pre-loaded on a screen for the most-likely-asked items
- ✓
Have a single QMS contact who triages every auditor request
💡 Pro Tip
Auditors do not appreciate clever; they appreciate clear. The fastest path to a clean report is concise, evidenced answers — not stories.
The three findings that catch most audited organisations
1. Document control
Multiple versions of the same procedure in different places. Obsolete documents still in use. Uncontrolled forms attached to controlled processes. The fix is a single document index with version, owner, last-review-date, and access control — and removing or marking everything else.
2. Management review
Management review held, but the inputs and outputs do not match clause 9.3 word-for-word. Document the minutes against the clause structure — auditors literally cross-check the agenda items against the standard.
3. Competence and training
Training matrix says complete, but a sampled operator does not remember the training, or the training certificate has expired, or the record cannot be found. Every required competence should be tracked with timestamped completion, refresh interval, and retrieval link.
⚠️A finding on management review or document control is rarely a single major NC — but it is almost always at least one minor NC. Two of either category and your audit is no longer routine.
Continuous prep, not crisis prep
The teams that consistently come through clean run the audit prep as a continuous process, not a 90-day sprint. Internal audits on rolling cadence, management review on a quarterly schedule, CAPA closed before the next cycle starts. That is what a healthy QMS looks like — and what an auditor recognises within the first hour.
Where ExpiryEdge fits
Every recurring obligation in this checklist — internal audits, management reviews, calibrations, training refresh, document review cycles — has a date, an owner, an interval, and an evidence requirement. That is exactly what ExpiryEdge tracks. Pair it with your QMS document library and the operational discipline becomes default behaviour, not heroics in the last 90 days.
