The most common reasons businesses fail ISO audits, and how to fix them first
We've sat in on enough Stage 2 audits, and enough post audit debriefs, to notice the same handful of problems coming up again and again, across ISO 9001, ISO 27001 and ISO 45001 alike. Almost none of them are dramatic. Businesses rarely fail an audit because they're doing something badly. They fail because the management system that looked complete on paper hadn't actually been lived in for the months leading up to the audit.
Internal audits that were skipped, or done as a formality
Every management system standard requires you to audit yourself before the certification body audits you. The most common finding we see is an internal audit programme that exists on paper, with a schedule and a template, but wasn't actually carried out with any rigour, or wasn't carried out at all in the months before the external audit. A real internal audit should surface genuine problems. If yours never finds anything wrong, that's usually a sign it isn't looking hard enough, not a sign your system is flawless.
Corrective actions from the last audit that never actually closed
A minor nonconformity from your previous surveillance audit is meant to be fixed and verified, with evidence, not just acknowledged and quietly forgotten. Auditors check this first, because an unresolved finding from last time is the clearest possible signal that your system isn't being actively managed. If you can't put your hands on documented evidence that last year's corrective action actually happened, treat that as your first job before this year's audit, not something to explain away on the day.
Document control that's drifted out of sync with reality
Outdated procedures. The documented process says one thing, but staff on the ground do something slightly different because the process changed informally and nobody updated the document. Auditors interview staff specifically to catch this gap.
Version control gaps. Multiple versions of the same policy floating around, with no clear record of which is current, is one of the fastest ways to pick up a finding, even when the content itself is fine.
Records that don't match the paperwork. Training records, maintenance logs or risk assessments that exist but haven't been updated in a year, while the policy claims they're reviewed quarterly, is a mismatch auditors are specifically trained to spot.
Risk assessments and objectives that were written once and never revisited
A risk assessment or set of quality and safety objectives copied forward year after year, with no evidence anyone actually reconsidered whether the risks or targets had changed, reads to an auditor as a system running on autopilot. Objectives that aren't measurable, "improve customer satisfaction" with no number or method attached, draw the same kind of finding. The fix is straightforward but has to happen before the audit, not during it: review and genuinely update your risk register and objectives on the schedule your own documented system says you will.
Management review that happened, but wasn't documented properly
Top management is required to formally review the management system at planned intervals, covering specific inputs like audit results, customer feedback, nonconformities and resource needs. We regularly see a meeting that technically happened, informally, during a normal management catch up, with no agenda matched to the standard's requirements and no minutes. If it isn't documented against what the standard actually asks for, an auditor has no way to confirm it happened at all.
Staff who can't explain the system they're certified under
Auditors interview staff on the floor, not just managers in the boardroom. A production worker who can't explain why a particular safety procedure exists, or an office employee who has no idea where the information security policy lives, is a finding waiting to happen, however good your documentation looks. Awareness training needs to leave people able to explain the policy in their own words, not just sign a form saying they attended a session.
A pre-audit checklist worth running two to three weeks out
Go through this honestly before your auditor arrives, not during the audit itself:
1. Have we closed and evidenced every corrective action from the last audit?
2. Did our internal audit programme actually run this year, with findings we can show?
3. Do our current procedures match what staff actually do day to day, not what was written eighteen months ago?
4. Has our risk register and set of objectives been reviewed in the last cycle, with evidence of that review?
5. Did management review happen on schedule, with minutes that map to the standard's required inputs?
6. Can a random sample of staff explain, in their own words, the part of the system that applies to their role?
Competence and training records that don't hold up
A finding we see almost as often as the others: a training matrix that lists who needs which competency, but no evidence that the training actually happened, or evidence that's years out of date for a role that's since changed hands. This matters more than it looks on paper. If a job changes, say a machine operator takes on a new piece of equipment, or a staff member moves into handling customer data for the first time, the competency and training record needs to move with them. Auditors will pick an employee at random and ask to see their training history against their current role, and a gap there is treated as evidence the whole competence process isn't being actively managed, not as an isolated administrative slip.
The underlying pattern
Almost every failure we've described comes from the same root cause: a management system treated as a project to finish rather than a routine to maintain. The businesses that sail through their surveillance audits aren't the ones with the most polished documentation. They're the ones where the internal audit, management review and corrective action cycle actually happens on schedule, year round, so the external audit is just a check on something that's already working. Fixing a finding after the fact is always more expensive, in consultant hours and in stress, than preventing it by running the cycle properly the first time.
If you want a second set of eyes on where your system might be exposed before your auditor finds it for you, we're happy to run through it with you.