Readiness for management system certification means being able to demonstrate how the system works within its agreed scope. A folder of policies alone cannot establish that. This article explains how to build an evidence trail from requirements to actual work, review the gaps and prepare for an independent audit without promising a certificate or a fixed completion time.
Confirm exactly what will be assessed
Start with the relevant standard, its applicable edition and the intended scope. Identify the legal entity, locations, activities and boundaries involved. A system covering one office should not be presented as covering every operation. Confirm scheme and transition arrangements with the proposed certification body before fixing the audit programme.
ISO develops standards; external certification bodies conduct certification. An implementation consultant can help prepare a system but cannot guarantee an independent certification decision. Also distinguish management system certification from product certification and from accreditation of the body doing the assessment, which provides independent recognition of its competence within the relevant framework.
Build a requirement–practice–evidence trail
A useful readiness record connects a requirement to a working process, its owner and evidence of operation. Write a short explanation of how the requirement is addressed. Link to controlled documents and actual records rather than copying the same statement into several folders.
| Question | Illustrative evidence |
|---|---|
| What is expected? | Approved process and acceptance criteria |
| Who performs the work? | Assigned responsibility and competence evidence |
| What actually happened? | A completed work record with a date and outcome |
| Was the result checked? | Review findings and resulting decisions |
This is an organising aid, not a substitute for the selected standard. Different standards and activities require different evidence. Avoid imposing documents simply because another organisation used them. A large file count proves neither an effective system nor clear responsibilities.
Follow a real transaction end to end
Choose a completed activity within scope. For a service order, trace the agreed customer requirement, planning, delivery, checking and handling of any exception. Ask the people who performed the work to explain it. Compare their explanation with the records and the approved process.
Use representative samples across relevant periods, roles and locations. A single perfect record does not prove consistent operation. Conversely, a discovered gap is useful information when the organisation records and addresses it honestly. Do not reconstruct an invented history or backdate evidence to create the appearance of maturity.
Worked example: an incomplete delivery check
In a fictional company, the procedure requires a delivery check before closing a job. A sample of 12 recent jobs shows 3 without a recorded check. The observed gap is 3 ÷ 12 × 100 = 25% of that sample. It does not mean the whole system is 75% ready, or that 25% of all jobs are defective. The sample size is not a universal ISO requirement. These figures illustrate a readiness exercise and are not a benchmark or an ATMACSS client result.
The team first establishes whether checking occurred but was not recorded, or did not occur at all. It considers the affected customers and any immediate correction. It then investigates why the gap happened: unclear responsibility, a missing field or an impractical handover may require different responses.
A correction addresses the detected problem: for example, arrange the missing check where it remains meaningful and record what was actually done and when. Corrective action addresses the cause to prevent recurrence. A late check must not be presented as evidence that the required check took place before the original job closure.
A corrective action might revise the handover responsibility and make the completion evidence easier to record. The owner tests the change on a later sample and reviews whether the same gap recurs. Announcing a new procedure or holding a training session is evidence of action, not automatically evidence that the cause has been controlled.
As a practical readiness test, define the follow-up period, sample selection and acceptance criterion before reviewing the next jobs. In this example, check that each selected job contains the required result, responsible person and completion time before closure. Include the roles or locations affected by the original problem. If a gap recurs, reassess the cause and response. If no suitable new jobs have occurred, keep effectiveness verification pending; do not invent a successful test. This is an illustrative checking method, not a prescribed audit sample.
Complete internal review before claiming readiness
Plan internal audits and management review in line with the applicable system requirements. Internal audit examines conformity and effective implementation. Management review considers the system at leadership level and records decisions about its continuing suitability and performance. Neither should be reduced to signing an empty template.
Provide reviewers with credible information about objectives, performance, findings, changes and resources. Record unresolved issues with owners and dates. An internal audit should be objective; the exact arrangements should reflect the standard, the organisation and available competence. Familiarity with a process is not a reason to disregard contrary evidence.
Prepare people and access for the external audit
- Agree scope, locations, timing, language needs and evidence access with the certification body.
- Make relevant process owners available and explain that they should describe actual work.
- Protect confidential records through appropriate access and handling arrangements.
- Keep a controlled list of findings, responses and responsibilities after the audit.
Many management system certification arrangements include an initial assessment in stages, followed by continuing oversight. Confirm the specific scheme with the certification body. Do not assume a universal number of days, a universal fee or an automatic pass after documents have been submitted. Plan the response to findings as well as the audit visit.
Make open gaps visible in the readiness handover
Give each gap a description, evidence, owner and clear status. Separate immediate correction, action on the cause and verification of effectiveness. If a later operating sample is not yet available, record verification as pending instead of calling the action effective. Explain honestly what is complete and what remains, and arrange access to the relevant records. This helps management decide readiness; it does not pre-empt an auditor’s classification or the certification body’s decision.
Where a requirement is not met, record the specific requirement, the observed evidence and a clear statement of the gap. For example, identify the delivery-check rule and the affected job references instead of writing only “records need improvement”. Keep the evidence traceable so another reviewer can confirm the finding. ISO 9001 Auditing Practices Group material offers useful guidance on evidence and findings; it does not add requirements to the selected standard.
Use a readiness decision, not a document count
Before booking, ask whether the scope is clear, the selected requirements have been assessed, operating evidence is available and significant gaps have an effective response. Where a critical process has not yet operated, acknowledge the missing evidence and agree the implications rather than treating an unused procedure as proof.
Begin with one process and build its evidence trail this week. Use the result to prioritise remaining gaps. Read about choosing a certification body and standards, certification and accreditation. ATMACSS ISO implementation and readiness support can help structure preparation while the certification decision remains independent.