ISO 9001 Stage 1 Audit: The Complete 2026 Readiness Guide

The ISO 9001 stage 1 audit is the visit that decides whether your stage 2 certification audit goes ahead, and it is the one most organizations treat as a formality. It is not. Stage 1 is where the auditor establishes whether there is a real quality management system to audit, and from 2026 it is also where the auditor confirms which edition of ISO 9001 you are claiming — the 2015 text, or the sixth edition published on 16 September 2026.

This guide sets out what the auditor looks for in an ISO 9001 stage 1 audit, what you need in front of them, how long it takes, what happens to the findings, and how the new edition changes the conversation.

What the ISO 9001 stage 1 audit actually checks

Certification bodies do not get to design the initial audit themselves. They are accredited against ISO/IEC 17021-1, the conformity assessment standard for bodies certifying management systems, and clause 9.3.1 requires the initial certification audit to be conducted in two stages. Stage 1 has a defined job: to decide whether you are ready for stage 2.

In practice an ISO 9001 stage 1 audit works through six questions:

• Is the documented information there, and does it address the standard? Policy, scope, objectives, the process descriptions, the risk and opportunity work, internal audit and management review records.
• Is the scope statement defensible? Which sites, which products and services, which processes are outsourced, and any requirement you have determined is not applicable — with the justification.
• Do site-specific conditions match the paperwork? The auditor walks the operation. A QMS written for a different scale gets caught here.
• Does your team understand the standard? Not recite it — explain how their own processes meet it.
• Have internal audit and management review actually run? Planned, performed, recorded. This is the single most common reason a stage 1 ends with a delay.
• Can stage 2 be planned? Enough information to set the audit program, sampling, days and team.

Note what is not on that list. Stage 1 is not a re-run of your ISO 9001 gap analysis, and it is not a consulting visit. The auditor will tell you what is missing; they will not tell you how to write it.

Stage 1 and stage 2 compared

	Stage 1	Stage 2
Purpose	Readiness for stage 2	Conformity and effectiveness of the QMS
Main method	Documented information review plus a site visit	Sampling of processes, records, people and outputs
Output	Report on readiness, with areas of concern	Audit findings, and the certification recommendation
Can it raise nonconformities?	Normally no — findings are recorded as concerns	Yes, major and minor
Can you fail it?	You cannot fail, but stage 2 can be postponed	Yes — major nonconformities block certification
Typical share of initial audit time	Roughly a quarter to a third	The remainder
Location	At least partly on site	On site

The pattern is the same across management system standards, which is why our ISO 27001 stage 1 vs stage 2 guide reads so similarly: the two-stage structure comes from ISO/IEC 17021-1, not from ISO 9001.

How long an ISO 9001 stage 1 audit takes

The length of an ISO 9001 stage 1 audit is not negotiable on the day. It is calculated by the certification body under IAF MD 5:2023, the mandatory document on the duration of QMS and EMS audits, which sets a table of initial audit days by effective number of personnel and then allows adjustment. Three rules are worth knowing before you read a quote:

• An audit day is normally 8 hours.
• Time on site should normally be at least 80% of the calculated audit time.
• Reductions to the table figure are capped — commonly cited as no more than 30% for a single site — and any adjustment needs documented justification.

For a single-site organization of 20 to 50 people, an initial audit of roughly 3 to 5 audit days in total is typical, of which the ISO 9001 stage 1 audit is usually between half a day and one and a half days. Treat those as indicative ranges only: the calculation depends on your effective headcount, shift patterns, number of sites, process complexity and the design activity in scope. Ask your certification body for the calculated figure in writing, split between stage 1 and stage 2, before you sign.

One scheduling point catches people out: ISO/IEC 17021-1 expects the gap to stage 2 to be long enough to resolve what the ISO 9001 stage 1 audit found, but not so long that stage 1 has gone stale. Certification bodies work to a few weeks up to around six months. If the gap stretches, parts of stage 1 may have to be repeated.

The documents to have ready for the ISO 9001 stage 1 audit

Stage 1 goes badly when the auditor has to ask for things. Have these available, controlled and signed by whoever owns them:

• The scope statement, with sites, products and services, outsourced processes, and any non-applicable requirement with its justification.
• The quality policy and the quality objectives, with the plans to achieve them.
• The context analysis — external and internal issues, interested parties and their relevant requirements, and the recorded determination of whether climate change is a relevant issue.
• The risk and opportunity register, with the actions taken and how their effectiveness is evaluated.
• Process information — how processes interact, their inputs, outputs, criteria and measures.
• The internal audit program and reports, covering the whole QMS at least once, with the nonconformities and their corrective actions closed or in progress.
• Management review minutes covering every required input and producing the required outputs.
• Competence and training records, calibration records, supplier evaluation records, and nonconformity and corrective action records.

Our guide to the ISO 9001 mandatory documents and records lists these clause by clause. The short version: one full internal audit cycle and one management review cannot be produced the week before an ISO 9001 stage 1 audit, because both need evidence that time has passed.

What the ISO 9001 stage 1 audit produces, and what happens next

You get a report. Under ISO/IEC 17021-1 it must document the findings and identify any areas of concern that could be classified as nonconformity at stage 2 — the formal way of saying: here is what will be written up as findings if you leave it.

Three outcomes are normal:

1. Proceed as planned. Minor concerns, nothing structural, stage 2 goes ahead on the booked dates.
2. Proceed with specific work first. The common case. Usually a missing internal audit of part of the scope, a management review with gaps in its inputs, or a risk register with no evaluation of effectiveness.
3. Postpone stage 2. The system exists on paper but has not been operated — no completed internal audit cycle, no management review, objectives with no measurement.

A postponement is not a failure and appears on no certificate. It costs you the stage 2 slot, and slots are not quick to re-book. That asymmetry is the whole argument for over-preparing the ISO 9001 stage 1 audit.

What the 2026 edition changes about stage 1

ISO 9001:2026 is the sixth edition. It cancels and replaces ISO 9001:2015 and absorbs the 2024 climate change amendment. Counted one requirement per numbered sub-clause, clauses 4 to 10 contain 65 requirements: 46 unchanged in substance, 16 revised or expanded, two new as separate requirements and one renumbered. It is evolutionary, not a rebuild — our ISO 9001:2026 transition guide has the clause-by-clause map.

Four changes land directly on what an ISO 9001 stage 1 audit asks for:

• Risks and opportunities are now separate. Clause 6.1 splits into 6.1.1 determining them, 6.1.2 actions on risks and 6.1.3 actions on opportunities, each with its own evaluation. A combined register with one actions column no longer maps to the requirement.
• Quality culture and ethical behaviour are inside the requirements. Top management must promote them (5.1.1), they influence the environment for process operation (7.1.4), and people must be aware of them (7.3). A 2015 system usually has no document for this at all.
• Change planning has seven considerations in clause 6.3, up from four. The additions are communicating the change, how effectiveness will be monitored, and how results will be reviewed.
• The climate change determination is in the main text at clause 4.1. “Not relevant, because…” is a valid answer if it is true. No recorded answer is a finding.

Certifying for the first time in 2027 or later? Go straight to the 2026 edition.

The transition dates that set your deadline

Global ACI — the body that replaced IAF and ILAC on 1 January 2026 — published its transition requirements the same day the standard came out, in Global ACI-TECH-3-TR 2029-09-30 (M). The dates bind its signatory accreditation bodies and the certification bodies they accredit:

Date	Milestone
16 September 2026	ISO 9001:2026 published
31 March 2027	Accreditation bodies ready to assess against the 2026 edition
30 June 2027	Certification bodies submit their transition declarations
30 September 2027	Accreditation body transition decisions completed
31 March 2028	New and initial accredited certifications may only be issued to ISO 9001:2026
30 September 2029	Transition period ends; ISO 9001:2015 certificates cease to be valid

The 31 March 2028 line is the one to plan around. After it, a first-time certification cannot be issued to the 2015 edition — so any ISO 9001 stage 1 audit scheduled from late 2027 onwards should be run against the 2026 text whatever your original plan was. Full details are on the Global ACI transition requirements announcement.

Six things to do before the ISO 9001 stage 1 audit

1. Close the internal audit cycle. Every clause and process, once, with reports and corrective actions. Partial coverage is the top cause of postponement.
2. Hold a real management review. Every required input, minuted, with decisions and actions — and under the 2026 edition, risks and opportunities taken separately.
3. Re-read your scope statement out loud. If it does not say which sites and which processes, rewrite it. If something is excluded, write down why.
4. Record the climate change determination. One dated, owned paragraph in the context analysis.
5. Brief the people the auditor will meet. Process owners should explain their own process and where its records live. Nobody needs to quote clause numbers.
6. Ask for the day split in writing. Stage 1 days, stage 2 days, the team, and the gap between the stages.

Our step-by-step guide to getting ISO 9001 certified covers the stages either side of this one, and the complete ISO 9001 guide covers the standard itself.

Frequently asked questions

Can you fail an ISO 9001 stage 1 audit?

No. Stage 1 has no pass or fail result and no nonconformities are raised. What can happen is that the auditor concludes you are not ready, and stage 2 is postponed until the gaps are closed. Nothing about it appears on your certificate.

Does the ISO 9001 stage 1 audit have to be on site?

At least part of it does. Stage 1 includes evaluating site-specific conditions and talking to your people, which is why ISO/IEC 17021-1 does not treat it as a pure document review. Some certification bodies run the documentation review remotely and the site element separately.

How long is the gap between stage 1 and stage 2?

Long enough to act on what the ISO 9001 stage 1 audit found, short enough that stage 1 is still valid. A few weeks up to around six months is normal. If it drags on, the certification body may need to repeat parts of stage 1.

Do we need a completed internal audit before stage 1?

Yes, in practice. Checking whether internal audits and management reviews have been planned and performed is an explicit stage 1 objective, and a QMS with neither has no evidence it has been operated. This is the most common reason stage 2 slips.

Should we certify to ISO 9001:2015 or ISO 9001:2026?

If your stage 1 is in 2027 or later, go to the 2026 edition. New and initial accredited certifications may only be issued to ISO 9001:2026 from 31 March 2028, and every 2015 certificate expires on 30 September 2029 — so certifying to 2015 now buys a system you will have to transition almost immediately.

Getting the documents right first time

Most of what the auditor asks for is documentation, and most first-time applicants are writing it from a blank page. Our ISO 9001 Toolkit is 84 templates written from the published 2026 text — 60 Word documents and 24 Excel workbooks, with separate risk and opportunity registers, a quality culture and ethical behaviour policy, an internal audit program and a management review pack, so every one of the 65 requirements has a named document that owns it. A one-off $89, and the fastest way to walk into an ISO 9001 stage 1 audit with nothing missing.

Whatever you use to build it, the rule for the ISO 9001 stage 1 audit is the same: the auditor is not checking whether you own documents, but whether the system described in them has actually been run. Close the internal audit cycle, hold the management review, and stage 1 becomes the short visit it is supposed to be.