How to Prepare for an ISO Audit in 2026

Preparing for an ISO audit means proving that your management system is planned, implemented, monitored and improved. Start early by reviewing objectives, risks, requirements, evidence and open actions. Then organise records, involve process owners and run a realistic internal check. This turns audit preparation from a last-minute scramble into a controlled process.

What does it mean to be ready for an ISO audit?

Audit readiness is not about creating a perfect set of documents shortly before the auditor arrives. It means your business can consistently demonstrate that its processes work, people understand their responsibilities and decisions are supported by reliable evidence.

For most SMEs, the biggest sources of stress are:

• Evidence stored across emails, spreadsheets and shared drives
• Actions with unclear ownership or missed deadlines
• Policies that are out of date or not understood by staff
• Risks and objectives that are reviewed separately from daily operations
• Uncertainty about what an auditor may ask to see

A practical audit preparation plan brings these areas together and gives you time to resolve gaps before the audit begins.

How early should you prepare for an ISO audit?

Begin a structured review at least eight to twelve weeks before a planned audit. The exact timeframe depends on the size of your organisation, the scope of certification and the number of open actions. Earlier preparation gives you time to investigate root causes rather than applying rushed fixes.

Use a simple timetable:

• Eight to twelve weeks before: confirm scope, requirements, objectives, risks and audit dates.
• Six to eight weeks before: review evidence, speak with process owners and identify gaps.
• Four to six weeks before: complete corrective actions and test whether changes are working.
• Two to four weeks before: run an internal audit or readiness review.
• One week before: confirm logistics, records and availability of key people.

The aim is not to predict every question. It is to build confidence that your system is operating as intended.

1. Confirm the audit scope and applicable requirements

Start with the basics. Confirm which locations, teams, processes and activities are included in the audit. Check the relevant standard, customer requirements, legal obligations and any exclusions that apply to your management system.

Create a short scope checklist covering:

• The standard and certification scope
• Sites, departments and activities included
• Key internal and external requirements
• Previous audit findings and commitments
• People the auditor may need to interview

This prevents teams from preparing evidence for processes that are outside the audit while overlooking important in-scope activities.

2. Review management objectives and performance

What were your management objectives, and can you show progress against them? Auditors commonly look for a clear connection between business priorities, measurable objectives, assigned responsibility and management review.

For each objective, record:

• The intended outcome
• A measurable target or indicator
• The responsible owner
• Progress and supporting evidence
• Issues, decisions and next steps

If an objective has not been achieved, do not hide it. Explain what happened, assess the impact and show the action taken. Honest evaluation is more credible than unsupported claims of success.

How should you review risks before an ISO audit?

Review your risk register as a working management tool, not a document completed once a year. Check whether it reflects current services, suppliers, people, technology, legal requirements and operational changes.

For every significant risk, confirm:

• The risk description is clear and relevant
• The score or rating uses your defined method
• Controls and mitigating actions are recorded
• An owner is accountable for monitoring it
• The review date is current
• Residual risk is understood and accepted where appropriate

Also look for connections between risks, objectives, incidents, non-conformances and audit findings. These links help demonstrate that your organisation learns from experience and prioritises improvement.

3. Organise objective evidence

Evidence should be easy to locate, current and linked to the process it supports. Avoid creating records purely for the audit. Instead, gather normal business evidence that shows the system is being used.

Useful evidence may include:

• Approved policies and controlled documents
• Risk assessments and review records
• Training, competence and acknowledgement records
• Supplier evaluations and monitoring
• Meeting minutes and management reviews
• Operational checks, inspections and maintenance records
• Customer feedback, complaints and incident logs
• Internal audit reports and corrective action records

Use consistent file names, owners and review dates. A central compliance system can make this easier by keeping solutions for compliance management in one place instead of relying on disconnected folders.

4. Check document control and staff awareness

Review whether your policies and procedures are approved, available to the right people and protected from unintended changes. Confirm that obsolete versions are removed or clearly marked, particularly where printed copies are still used.

Then ask whether employees understand the documents relevant to their work. Evidence might include training records, policy acknowledgements, induction materials or brief interviews with staff.

A policy is stronger when people can explain how it affects their daily responsibilities. Keep language practical and make it easy for employees to find the current version.

5. Close non-conformances and corrective actions

Open actions are not automatically a problem. Poorly controlled actions are. Review every finding, incident or non-conformance and confirm that its response addresses the underlying cause.

A complete corrective action record should show:

• What happened and what requirement was not met
• Immediate correction or containment
• Root-cause analysis
• Planned corrective action
• Named owner and target date
• Evidence that the action was completed
• A follow-up check confirming effectiveness

Do not close an action simply because a task was completed. Ask whether the original issue is unlikely to recur. If not, revise the action or investigate further.

What should an internal audit test?

An internal audit should test both documented arrangements and actual practice. Select a representative sample and follow a process from beginning to end—for example, from identifying a risk through to implementing and reviewing its controls.

Ask process owners:

• What is the expected process?
• How do you know it is being followed?
• What records demonstrate this?
• What happens when something goes wrong?
• When was the process last reviewed or improved?

Record findings clearly and prioritise them by risk. A short, focused readiness review is more useful than a large checklist completed without meaningful investigation.

A simple final-week checklist

In the final week, avoid making major changes unless a genuine issue requires them. Concentrate on clarity and access.

• Confirm the audit schedule, locations and contacts.
• Make sure key people know their responsibilities.
• Test access to important records and systems.
• Check that action owners can explain their progress.
• Prepare a quiet workspace and practical route through evidence.

Remind staff to answer honestly and directly. They do not need to memorise procedures or guess an answer. If they do not know, they should explain how they would find the correct information.

How can compliance software reduce audit stress?

Compliance software can provide a central view of risks, audits, findings, actions, policies and evidence. Instead of chasing updates manually, managers can see ownership, deadlines and review status in one place.

The value is not simply storing documents. A well-structured platform helps connect requirements to activity, creates accountability and provides a clearer history of decisions and improvement. It can also make recurring reviews more consistent as your organisation grows.

If you are assessing your current approach, contact Acomplys to discuss how a simpler compliance process could support your next audit.

Key takeaways

Preparing for an ISO audit is an ongoing management activity, not a last-minute document exercise. Start by confirming your scope, then review objectives, risks, evidence, document control and corrective actions. Use an internal audit to test whether processes work in practice, not merely whether procedures exist.

The next step is to identify your three biggest readiness gaps, assign owners and set realistic deadlines. Centralising records and tracking actions consistently can reduce administration while improving visibility. With steady preparation, your team can approach the audit calmly, explain how work is controlled and demonstrate continual improvement with confidence.