Most first-audit failures are not caused by bad work. They are caused by a certificate that claims to cover more than the company actually does. This page is the boundary: what is inside your 9001, what is deliberately outside it, and what the auditor will ask your people on the day.
One sentence on the certificate. It is the most consequential sentence in the whole project.
Why this comes first: We write the scope statement with you before any documentation starts, because everything else — the procedures, the records, the internal audit plan — follows from it.
The standard's own words are dense. This is what they are actually asking for.
| The standard calls it | What it means on a normal Tuesday | What the auditor will look for |
|---|---|---|
| Context and interested parties | Who cares about your work, and what each of them expects from you | A short written list — not a strategy deck |
| Leadership | The boss is genuinely in it: sets the direction, chairs the review, signs the policy | The top person in the room, answering questions themselves |
| Planning | What could go wrong, and what you have decided to do about it | Risks with actions attached, and dates |
| Support | People trained, equipment working, information written down where it is needed | Training records, maintenance records, the current version of a document |
| Operation | The actual day-to-day work, done the same way each time | A live job in progress, and the paperwork that goes with it |
| Performance evaluation | Measuring a few things that matter, and checking the system still fits | Numbers over time, and the management review minutes |
| Improvement | Fixing what went wrong — and stopping it happening again | Complaints, returns, non-conformances, and what changed afterwards |
They sample documents and trace them backwards and forwards: this record, that procedure, this person, that job.
Your staff get asked simple questions about their own job. Rehearsed answers are obvious and count against you.
They usually watch one real piece of work from the customer's request to delivery.
Customer complaints and internal non-conformances are the richest evidence you have. Hiding them wastes the best material.
Say this out loud to whoever asked you for it, so nobody expects the wrong thing.
Then the auditor walks into a part of the business nobody prepared, and the day goes badly. Narrow and true beats broad and wobbly.
A 90-page manual written for the auditor and read by no one is a liability, not evidence. We write what your people will actually follow.
Your internal audit is your practice exam. Companies that run it properly three to four weeks out find and fix the real problems in time.
For a typical SME: one policy, six to ten short procedures, and the records your work already generates. If someone proposes forty documents, ask them which forty your people will genuinely keep up.
Yes, and it is yours to keep. The text is copyrighted, so we work from licensed copies and you hold your own. The certification body's fee is separate again and paid directly by you.
Six to ten weeks for a first certification on one site, working alongside normal operations. Multi-site adds roughly two to three weeks per additional site.
Yes, and it is cheaper than starting fresh because the skeleton is already there. Companies often add the second standard at their first surveillance audit.
That is normal and expected. Minor findings are usually closed with evidence within days. Major findings are rare on a properly prepared first audit, and we sit through the audit with you either way.
Tell us what the business does, from where, and who asked. We will draft the scope statement in plain English and quote the fixed fee before you commit to anything.