What is a Stage 1 Assessment?
The stage 1 audit requirement has been in place for around 8 years now, it came in as a mandatory requirement with ISO 17021 in 2011 although it was a requirement for ISO 14001 assessments before then.
The stage 1 assessment can be a useful process for organisations and it goes beyond what some people think, it’s more than just a review of your documents. Some organisations do not necessarily use the stage 1 assessment to its full potential and gain benefits from the assessment time.
The stage 1 assessment is a good time to run a few things past the auditor which may not be 100% there, it will give you a good indication of whether you are on the right track with something. Although you can technically fail a stage 1 assessment you won’t if you have the majority of the system in place and is not generic. Auditors tend not to write formal non-conformances either and will just highlight some of the possible shortcomings so feel free to get some of your system checked over without fear of repercussions.
When is the Stage 1 Assessment Performed?
The stage 1 and stage 2 assessment should occur within 6 months of each other, any longer and you risk receiving another stage 1 assessment which is more money but I would recommend you leaving as large a gap as possible between them. If you have your stage 1 assessment performed and you have a lot of things still to get in place then you have 6 months to get that arranged and this should be enough time for anything to be done. It is possible to have the stage 1 and stage 2 one day after the other although this is not recommended unless you have complete confidence in your management system.
How to Prepare for a Stage 1 Assessment
You will need to have in place any documentation that you may have produced, this is different depending on the standard you are implementing but will need to include things like your policies and any procedures. If you are implementing ISO 9001, for example, you would need to have in place your Quality Policy and any associated procedures deemed necessary for your management system. For health and safety (ISO 45001) you need to have in place your health and safety policy manual. If you don’t have your documentation in place then you should not even attempt to have the stage 1 visit.
The auditor will also be determining the status of your internal audit programme. You may not have your internal audits completed at this time, that’s OK, you should have in place an internal audit programme to show what you are going to audit and when. Ideally, the auditor would like to see one audit performed, so they can see what the quality of the audit is like but this is not essential. It’s just a risk to you for your stage 2 assessment as we may deem them not suitable due to lack of evidence or coverage. If you have performed internal audits then we would check to see if you have raised findings and what the status of those findings is.
The management review follows the same process, we would ideally see one completed but this is not essential, again, we need to see when this is planned for and what items you will be covering.
The auditor will ask a lot of questions about how you are controlling certain areas of the management system and will be testing the understanding and awareness of the management system requirements. This could be a short conversation with a few of the staff members but may also consist of a more in-depth conversation with the management team. The auditor is trying to gauge whether you have established a system without much thought or knowledge applied to the implementation.
The auditor may walk through a job informally to see what types of controls you have in place, they won’t necessarily be auditing the job, but they will be using this time to gather knowledge to help them with their audit planning for stage 2. They will also identify some possible shortcomings in your processes.
Do not think that if an auditor has performed a stage 1 assessment that they have looked at everything and you will sail through the stage 2 assessment, that doesn’t happen and the assessor is not auditing to that depth or with that focus. Any major concerns will be highlighted so this may prevent some major findings and follow up visits in stage 2 but the proof is in the implementation. You may have documented a wonderful system of procedures but aren’t implementing them which is what the stage 2 audit will identify.
There will be a discussion on the context of the organisation section of the management system. The auditor will be trying to understand your business, see where the risks are, and they may need to do some research into your business, market or operational processes before they return for the stage 2 assessment. You need to have your system in place for the context of the organisation and any risks identified.
KPIs will catch out a lot of organisations. You should have your processes defined and your KPIs in place to measure the effectiveness of those processes. Targets should be in place and hopefully a little data to show how you are performing against those KPIs.
One of the main goals of a stage 1 audit is for the assessor to determine how ready you are for the stage 2 audit and provide them with sufficient information to plan the stage 2 audit. You should not be receiving generic stage 2 audit plans, if you do you should ask the auditor for a more defined plan to suit your business and processes. The audit plan should reflect your business processes and show timings and dates for the areas to be assessed. You may not have determined the date before the auditor leaves site so the dates may follow, and not all auditors will leave an audit plan with you, they may create this later after they have done some more research.
You should use this time wisely to ask questions and have certain documents reviewed. Once the stage 2 audit has started it’s almost too late and any issues may result in findings being raised. Be open and honest with the status of various processes, if they are not quite there yet just say that. When the assessor knows the status of your management system they will be better placed to determine a suitable stage 2 date, you do not want to rush into a stage 2 and have findings raised as this slows down the process, any findings must be formally closed before you can be recommended for certification.
We have produced a short stage 1 assessment checklist which you can use to help prepare yourself for the audit. You can check off the items once you have deemed them complete and hopefully, this will make the process a lot smoother.
