Section 4.2: Document Review (Stage 1 Readiness Audit)

Document Review and Stage 1 Readiness Audit

The Stage 1 audit is a critical phase in the certification process under ISO/IEC 17021-1 guidelines. Often referred to as the "Readiness Audit" or "Document Review," the Stage 1 audit serves as the gateway to the Stage 2 certification audit. It is a formal evaluation designed to determine whether an organization's Quality Management System (QMS) is sufficiently developed, documented, and implemented to warrant a full onsite compliance audit. Attempting a Stage 2 audit without a rigorous Stage 1 review frequently leads to audit failure, excessive nonconformities, and wasted resources.

Purpose of the Stage 1 Audit (ISO/IEC 17021-1 Clause 9.3.1.2.2)

The Stage 1 audit is not merely a desk review of documents. According to ISO/IEC 17021-1, the objectives of a Stage 1 audit are multi-faceted:

• Review documented information: Assess the client's QMS documentation to ensure it aligns with all applicable clauses of ISO 9001:2015.
• Evaluate site-specific conditions: Understand the client's physical locations, site-specific conditions, and operational complexity to plan Stage 2 resources effectively.
• Assess QMS implementation level: Confirm that the QMS is not just a "paper system." The auditor must verify that a full cycle of internal audits and management reviews has been planned and executed, and that the QMS has been operational for a sufficient duration (typically at least three months of records).
• Verify scope and boundaries: Ensure the requested scope of certification matches the actual operational activities, and verify that any exclusions (such as Clause 8.3 Design and Development) are fully justified.
• Confirm resource allocation: Collect data to refine the Stage 2 audit plan, including the allocation of auditor-days, selection of team members, and identifying areas of high risk or significance.

Key Documented Information Reviewed

During the Stage 1 audit, the auditor systematically evaluates the organization’s documented information. While ISO 9001:2015 does not mandate a formal "Quality Manual," organizations must still document their system's structure. The key documents reviewed include:

1. Context of the Organization (Clause 4): The definition of the QMS scope (Clause 4.3), including justifications for any exclusions. The documentation must detail internal and external issues (Clause 4.1) and the requirements of interested parties (Clause 4.2).
2. Quality Policy and Objectives (Clauses 5.2 and 6.2): The formal commitment of leadership, which must be appropriate to the purpose and context of the organization. The quality objectives must be measurable, aligned with the policy, and have defined action plans.
3. Process Maps and Interactions (Clause 4.4): Documented evidence showing the sequence and interaction of QMS processes, including inputs, outputs, performance indicators, and allocated responsibilities.
4. Internal Audit and Management Review Records (Clauses 9.2 and 9.3): Evidence that the organization has audited its own system against its procedures and the ISO 9001 standard, and that top management has reviewed QMS performance, including customer feedback, nonconformities, and resource needs.

The Stage 1 Decision and Recommendations

At the conclusion of the Stage 1 audit, the lead auditor must document their findings in a Stage 1 Audit Report. This report must clearly outline:

• The degree of conformity of the QMS documentation to ISO 9001:2015 requirements.
• The status of key system elements (internal audits, management reviews, and corrective action systems).
• Specific areas of concern or potential nonconformities that the organization must address before the Stage 2 audit.
• A formal recommendation regarding readiness to proceed.

The lead auditor makes one of three recommendations:

1. Proceed to Stage 2: The QMS documentation is complete, and the system shows sufficient implementation. No significant concerns exist.
2. Proceed to Stage 2 after addressing areas of concern: The client is ready, but minor gaps exist in documentation or implementation. The client must submit evidence of resolving these concerns, or the Stage 2 team will verify them at the start of the Stage 2 audit.
3. Postpone Stage 2 and repeat Stage 1: Critical gaps exist. For example, the internal audit was not completed, or a major process is completely undocumented. The Stage 2 audit is postponed to allow the client to implement the system, and a new Stage 1 audit is scheduled.

Critical Exam Note: Under ISO/IEC 17021-1 rules, the interval between Stage 1 and Stage 2 must be carefully managed. The organization must be given sufficient time to resolve Stage 1 concerns. However, if the interval between Stage 1 and Stage 2 exceeds six months, the Stage 1 audit must be repeated to ensure that the readiness assessment remains valid.

Worked Scenario: Document Review for a Construction Firm

A lead auditor conducts a Stage 1 document review for a commercial construction contractor. The contractor's scope of certification is "design, project management, and construction of commercial buildings." During the review of documented information, the lead auditor notices that the client has claimed an exclusion for Clause 8.3 (Design and Development), stating that all designs are provided by external architects.

However, in reviewing the project management procedures and sample contracts, the auditor finds that the contractor regularly hires freelance architects directly and manages the design process, including reviews, verifications, and approvals, before construction begins.

The lead auditor identifies this as a critical gap and a "Red Flag." The exclusion of Clause 8.3 is not justified under Clause 4.3 of ISO 9001:2015. The contractor is active in managing the design process and is legally responsible for it. The lead auditor documents this in the Stage 1 report as an area of concern, stating that the QMS scope must be updated to include design, and that the organization must document and implement design control processes prior to the Stage 2 audit. The lead auditor recommends postponing Stage 2 by three months to allow the organization to design and document these processes, run an internal audit on them, and review the results in a management review meeting.