What ISO 9001 Auditors Actually Sample (and What They Skip)

Most manufacturers spend two weeks before a surveillance audit tidying folders they haven’t opened since the last visit. The auditor arrives, signs in, and within twenty minutes is sitting at a table asking for the corrective action log. The folder nobody tidied.

That tells you something about where the real attention goes.

What a surveillance audit is not

A surveillance audit is not a repeat of your certification audit. You earned the certificate. The surveillance visit, typically one or two days, once or twice a year, exists to confirm you have not drifted. The auditor is not starting from scratch.

They are working to a sampling plan. In a three-year certification cycle, different clauses get covered at different visits. Clause 4, context and interested parties, is examined thoroughly at initial certification and then largely left alone unless something flags it. Design and development clauses are often skipped entirely for companies that do not hold design responsibility. The auditor knows which areas were clean last time and rotates attention accordingly.

What they almost always look at

Regardless of which clauses are scheduled for a given visit, a few things come up every time.

Corrective actions. Anything raised at the previous audit, internal or external, needs a documented response and evidence of closure. Auditors check whether actions were real or cosmetic. A corrective action that says “reminded staff of procedure” without evidence of what changed is a red flag.

Internal audit programme. Has it actually run through the year? Many small manufacturers complete their internal audit schedule in a frantic fortnight before the surveillance visit. Auditors can see the dates. A full year of audits signed off in November is not credible if the visit is in December.

Management review. There needs to be a record of one happening, with inputs and outputs as required by clause 9.3. Minutes that are clearly a copy of last year’s, with updated dates, tend to attract questions.

Customer complaints. The auditor will ask to see the complaints log and pick a few to follow through. They want to see that complaints were recorded, investigated, and resolved with some evidence of root cause. If there are none recorded, that raises questions too.

Calibration. Any measuring equipment used to make conformance decisions needs to be in date and traceable. A single out-of-date gauge found on the shop floor can pull the thread on a wider nonconformance.

What they tend to skip

The full list of ISO 9001 requirements runs to 36 pages. A one-day surveillance audit covers perhaps a third of them. The auditor is not trying to catch you out on everything. They are sampling.

Clauses that were clean at the previous visit, with no complaints or failures linked to them, are often passed over in favour of areas with open actions or known risks. Context of the organisation, strategic direction, interested parties, these tend to be stable and are rarely revisited in depth unless there has been a significant change: a new customer segment, a site move, a change in ownership.

Process performance data is sampled rather than reviewed in full. The auditor will pick a metric or two and ask what you do with the results. They are not reading every control chart.

The pattern underneath

What the auditor is really doing is checking for systemic failure rather than individual defects. Are the processes that are supposed to catch problems actually running? Is anyone reviewing results and acting on them? Are nonconformances being used to drive improvement or just filed?

If your management review is real, your internal audits are spread through the year, and your corrective actions are honest about root cause, the sampling will go smoothly. The auditor will find the gaps that exist because no organisation is perfect, and you close them. That is how the system is supposed to work.

The manufacturers who struggle are usually the ones who have built a paper system that runs separately from the factory. The documentation says one thing, the floor does another, and eventually an auditor follows a product through the process and the gap becomes obvious.

Getting the foundations in order

If you are not sure where your gaps are before the auditor finds them, a structured look at your own losses is a useful starting point. The diagnostic at losses.cadencestandard.com is built around operational efficiency, but wasteful, inconsistent processes tend to produce exactly the kind of variation that a quality system is designed to control. The two are rarely as separate as they appear on an org chart.

For manufacturers who want to work through the disciplines that underpin a credible management system, the /six/ programme covers the core habits, and the /diagnostics/ tools can help you identify where your processes are actually failing, rather than where your paperwork suggests they should be fine.