Certification audit

A certification audit is a formal, independent assessment performed by an external body to determine whether an organization’s management system conforms to the requirements of a specific published standard. In industrial and regulated manufacturing environments, this often relates to standards such as ISO 9001, AS9100, ISO 13485, ISO 14001, or information security and cybersecurity standards.

The outcome of a certification audit is typically a recommendation to grant, maintain, suspend, or withdraw a certificate that states the management system is in conformity with the audited standard. The audit focuses on documented processes, implementation on the shop floor and in supporting functions, and objective evidence that requirements are consistently met.

Key characteristics

• External and independent: Conducted by a third-party certification body, not by the organization itself.
• Standard-specific: Evaluates conformity against a defined standard (for example, ISO 9001 for quality management or AS9100 for aerospace quality).
• Evidence-based: Uses interviews, document reviews, records, and on-site observations to verify practices match documented procedures and standard requirements.
• Certificate-focused: The primary purpose is to support a decision on issuing or continuing an official certificate, often required by customers or contracts.
• Recurring cycle: Usually follows a multi-year certification cycle with an initial audit followed by periodic surveillance and recertification audits.

How it appears in manufacturing operations

In industrial and regulated manufacturing, a certification audit typically includes:

• Review of quality management system documentation, process maps, procedures, and work instructions.
• Sampling of production, inspection, maintenance, calibration, and traceability records from MES, ERP, QMS, LIMS, and document control systems.
• Interviews with operators, supervisors, engineers, and quality personnel to confirm understanding and consistent application of procedures.
• Walkthroughs of production lines, test labs, and material handling areas to verify that actual practices align with documented processes and standard requirements.
• Verification that nonconformances, CAPA, MRB decisions, and audit findings are recorded, analyzed, and closed according to defined processes.

Certification audits often require organized evidence from systems such as MES, ERP, and electronic document control, including revision histories, training records, change control documentation, and audit trails.

Types of certification audits

• Initial certification audit: A comprehensive, often two-stage audit conducted when an organization first seeks certification to a standard.
• Surveillance audit: Periodic, usually annual or semi-annual, audits that sample parts of the management system to confirm continued conformity.
• Recertification audit: A more extensive audit performed at the end of a certification cycle (often every three years) to determine whether to renew certification.
• Scope extension audit: Conducted when an organization wants to extend the scope of its existing certificate to new sites, processes, or products.

Common confusion

• Certification audit vs. internal audit: An internal audit is performed by or on behalf of the organization itself to assess its own processes and readiness. A certification audit is carried out by an external certification body and is directly linked to issuing or maintaining a certificate.
• Certification audit vs. customer (second-party) audit: Customer audits are performed by a customer or their representative to evaluate a supplier’s capability or compliance with contract requirements. Certification audits focus on conformity to a published standard, not to a specific customer contract.

Relation to audit readiness and evidence management

For organizations operating in regulated manufacturing, certification audits drive requirements for structured documentation, record retention, and traceability across systems. Digital tools such as MES, electronic DHR or DMR, QMS, and document control platforms are frequently used to organize evidence, demonstrate version control, and provide audit trails that support certification decisions.