ISO readiness check

Is the scope of your management system written down, and does it match what the site actually does?

An auditor reads the scope statement, then walks the floor. A scope or an exclusion the operation cannot support is one of the five standard reasons a Stage 2 fails.

Are opportunities managed separately from risks, each with an owner and an outcome?

The 2026 edition splits the single risks and opportunities clause in two. An opportunities column appended to the risk register, with no owner and no outcome, is the usual state and it no longer reads as compliance.

Does your quality policy connect explicitly to your context and strategic direction?

New in the 2026 edition. Most policies were written to be framed on a wall and say nothing about where the business is going, which is exactly what the clause now asks for.

Are your objectives measurable, with a plan naming what will be done, by whom and by when?

Clause 6.2.2 asks for the plan, not just the objective. An objective with no named owner and no date is a statement of intent, and the auditor will say so.

Is process performance measured, with data that somebody actually looks at?

If nothing is measured, clause 9.1 has nothing to examine and neither does management review. This is the second of the five standard Stage 2 failures.

Have internal audits been completed to your documented, risk-based programme and, before a first certification, has one full cycle covering the whole scope been completed?

An auditor cannot verify a system that has never checked itself. After the first cycle, coverage follows the programme's risk basis across the certification cycle rather than a full sweep every year. Stage 1 checks that the first cycle and a management review are done, so a missing cycle stops the process before Stage 2.

Did every internal audit avoid the auditor auditing their own work?

In a small team the quality manager usually owns document control and also audits it. That is an impartiality finding against the whole programme, which is worse than a finding against document control.

Has a management review been held with the required inputs, and are its outputs recorded as decisions?

Minutes that record attendance and a general discussion do not evidence the inputs listed in 9.3.2 or the outputs required by 9.3.3. The agenda should mirror the clause.

Do your corrective actions record a root cause and an effectiveness check, not just the fix?

Clause 10.2 asks for the cause, the action and evidence the action worked. Most logs in this market carry the fix alone, and it is the third of the five standard failures.

Is the revision in use at the point of use the current one, everywhere?

The most common document control finding is an obsolete revision in active use, usually a laminated form on a wall that outlived the master it was printed from.

Can you retrieve competence records and the calibration register in minutes, with certificates attached?

Both are on the list an auditor asks for before the site walk. Records that exist but cannot be found in reasonable time are a finding in their own right.

Are outsourced processes inside your scope controlled and evidenced, with criteria and re-evaluation?

Outsourced work inside the scope but uncontrolled is the fourth standard Stage 2 failure. Maintenance, calibration, laboratory testing and transport are the usual gaps.