Avoiding Pitfalls in Stage 1 ISO Certification Audit

Summary
In this conversation, Michael Venner and Alan Gould discuss the intricacies of Stage 1 audits in the certification process. They explore the purpose and importance of Stage 1 assessments, the preparation required by organizations, and the potential pitfalls of neglecting this crucial step. The dialogue emphasizes the collaborative nature of audits, the need for organizational readiness, and the role of management systems in ensuring successful outcomes. Through their insights, they highlight the significance of building relationships with clients and the continuous improvement that comes from thorough assessments.

Takeaways
-Stage 1 audits are essential for verifying management systems.
-Building relationships with clients is crucial during assessments.
-Organizations must prepare adequately for Stage 1 audits.
-Communication and awareness are key to successful audits.
-Stage 1 assessments help identify gaps before Stage 2.
-Management commitment is vital for effective audits.
-Documentation and control are critical components of the process.
-Skipping Stage 1 can lead to significant pitfalls.
-Continuous improvement is a goal of the audit process.
-Stage 1 is not a pass or fail but a preparatory step.

Chapters
00:00 Introduction to Stage 1 Audits
02:28 Understanding Stage 1 Assessments
05:43 Importance of Stage 1 Assessments
07:40 Preparing for Stage 1 Assessments
10:11 Conducting Stage 1 Assessments
12:50 Consequences of Skipping Stage 1
15:57 Final Thoughts on Stage 1 Audits

Key Links

Apple Podcast:  https://podcasts.apple.com/gb/podcast/by-all-standards/id1771677594

Spotify: https://open.spotify.com/show/79OUNj3vY9dmESR3okwHJa?si=871837f56dc149b6

YouTube:  https://www.youtube.com/@auvacertification/podcasts

Auva Website: www.auva.com

LinkedIN: https://www.linkedin.com/company/auva-certification-ltd 

Instagram: @auvacert

Michael Venner:  https://www.linkedin.com/in/michaelvenner-isocertificationexpert/ 

Alan Gould:  https://www.linkedin.com/in/alanmichaelgould/ 

Chapters

• 0:00 Introduction to Stage 1 Audits
• 2:28 Understanding Stage 1 Assessments
• 5:43 Importance of Stage 1 Assessments
• 7:40 Preparing for Stage 1 Assessments
• 10:11 Conducting Stage 1 Assessments
• 12:50 Consequences of Skipping Stage 1
• 15:57 Final Thoughts on Stage 1 Audits

Transcript

Michael Venner (00:16)
Okay, Alan if you want to start by introducing yourself.

Alan Gould (00:16)
it Hi, my name's Alan Gould and I'm Business Development Officer for Auva certification I've been working here for about six or seven months now. I've been in the certification industry for nine years next year is my tenth year and

Michael Venner (00:31)
been in the certification industry for nine years, next year is my 10th year and I'm excited to be here today to discuss the preparation of a Stage 1 audit. So did you want to tell everyone how you first got into this industry? Yeah sure, so... Because it's a funny story. Long story cut short, I very first worked with the guys who were in the certification in their previous capacities back in 2002

Alan Gould (00:39)
Excited to be here today to discuss the preparation of a stage one audit Yeah, sure so Long story cut short I very first worked with the guys from Auva certification in their previous capacities back in 2002 and I did my year nine work experience and I was literally just

Michael Venner (01:02)
and I was literally just delivering mail shots and putting them together, on the road, working with the guys for three weeks. Funny story actually, they used to let me use their computer at lunchtime when I was bored, I was playing Solitaire and Miniclip, and those types of games.

Alan Gould (01:08)
delivering mail shots and putting them together, ready to send out licking envelopes, that kind of thing. Worked with the guys for three weeks. Funny story actually, that they used to let me use their computer at lunchtime when I was bored. I was playing sort of solitaire and, and mini clip, those kinds of the games. And one day decided to see what would happen if.

Michael Venner (01:30)
One day I decided to see what would happen if my computer was dragged into the recycling bin. and of course the result was pretty bad and the whole management system went down. So I can definitely say that I left my mark on the organisation during those three weeks. So you won't ever be a ISO 27001 auditor. Probably not. Unless the failsafe controls are quite robust.

Alan Gould (01:35)
my computer was dragged into the recycling bin. Of course, result was pretty bad and the whole mainframe system went down. So that I can definitely say that I left my mark on the organisation during those three weeks. Probably not, no, unless the failsafe controls are quite robust in that organisation.

Michael Venner (01:59)
Yeah, you did delete our entire computer system, didn't you? So, yeah, and we still employed you. We done something really wrong, I think. Okay, so what are we talking about today? So today we're going to talk about how an organisation would prepare for their stage one assessment, what we call the initial assessment. Okay, okay. So what is a stage one assessment?

Alan Gould (02:02)
Yeah. Must have done something right. Yeah.

So today we're going to talk about how an organisation would prepare for their stage one assessment, what we call the initial assessment.

is a stage one assessment? A stage one assessment is what we call a preparedness assessment. an auditor would go into the organisation to verify that there's a management system that has been established. We're not actually looking to see whether the management system directly conforms to the clauses of the standards, that will come later, but we're just making sure that there is

Michael Venner (02:28)
A stage one system is what we call preparedness assessment. but also go into the organisation and verify that there's a management system that has been established. We're not actually looking to see whether the management system directly conforms to the clauses of the standards. That will come later, but we're just making sure that there is a management system in place.

Alan Gould (02:54)
management system in place, documents have been established, there's a policy, a scope, roles and responsibilities and some operational controls have been established and awareness has been created. Well, a stage one assessment can be done remotely but it depends on the risk within the organisation. So for example, if we're auditing a service provision company

Michael Venner (02:57)
documents have been established, policies and scope, roles and responsibilities, some operation controls have been established and awareness has been created. So are they always done on site? Well, state of the art can be done remotely but it depends on the risk within the organisation. So for example, if we're auditing a service provision company then absolutely for 9001 we could do

Alan Gould (03:22)
then absolutely for 9 ,001 we could do a remote assessment. But if the organisation are involved in higher risk activities such as construction and maybe some types of heavy manufacturing, then it would be more appropriate to go on site and conduct the audit there. Well, no, it's more up to the certification body.

Michael Venner (03:26)
a remote assessment but if the organisation are involved in higher risk activities such as construction and maybe some types of heavy manufacturing then it would be more appropriate to go on site and conduct the audit there. Okay, okay so is that up to the auditor to kind of decide on that? Well it, no it's more up to the certification body to determine

Alan Gould (03:52)
to determine the risk associated with the organisation and that will obviously come into the sales process and when we do a contract review we'll look at the risk level within the different standards that the organisation wish to be certified for and then we can determine whether we can do an onsite or remote assessment.

Michael Venner (03:53)
Okay, what would you prefer?

Alan Gould (04:15)
Personally, I enjoy doing assessments on site. I think that remote assessments have their place and especially the more hybrid way of working, which is quite prevalent now after COVID. But going on site, getting a real feel for the organisation, you'll get to see a lot more than what you would naturally.

Michael Venner (04:15)
Personally, I agree with the assessments on site. think that remote assessments have their place, especially the more hybrid way of working, which is quite prevalent now after COVID. But going on site, in a real field of organised isolation, you'll get to see a lot more people naturally in a remote assessment. And I think that that enables much better planning.

Alan Gould (04:40)
in a remote assessment and I think that enables a much better planning for a stage two assessment.

Michael Venner (04:45)
stage two assessment. I think it helps you build that relationship as well with the clients doesn't it yeah breaks down the barriers things like that. Okay cool so why do we do stage one assessments? So stage one assessment is a critical part of the certification process as I've said before what we look to do is to verify that the organisation established

Alan Gould (04:49)
Absolutely.

Okay, cool. So why do we do stage one assessment? So the stage one assessment is a critical part of the certification process. As I said before, what we're looking to do is to verify that the organisation have established documents, document control, they've established a policy, a scope of certification, they've excluded,

Michael Venner (05:13)
documents, document control, they've established a policy, scope of certification, they've justified any one applicable clauses, they don't wish for us to certify for it. But then also to verify processes or procedures, process maps have been established, they are really implemented and integrated into the organisation.

Alan Gould (05:23)
justified any non -applicable clauses that they don't wish for us to certify for, but then also to verify that processes or procedures, process maps have been established and they are really implemented and integrated into the organisation and that if and when the stage two assessment is conducted that

Michael Venner (05:43)
if and when the age two assessment is conducted that the organisation will demonstrate that procedures and processes have been fully effective and operated.

Alan Gould (05:50)
the organisation are able to demonstrate that their procedures and processes are being fully effectively operated.

Michael Venner (05:56)
So what's the benefit of having a stage one assessment then? So the benefit of having a stage one assessment are multifactorial. So for us as a certification body, it enables us to get to know the client, get to know their organisation, get to know the structure, the context and some of the activities that they're carrying out. But also for client.

Alan Gould (05:56)
So what's the benefit of having a stage one assessment? So the benefits of having a stage one assessment are multifactorial. for us as a certification body, it enables us to get to know the client, get to know their organisation, get to know the structure, the context and some of the activities that they're carrying out. But also for the client, it's good for them to get to know us and

Michael Venner (06:23)
good for them to get to know us and get to see how we operate, our processes are, how we been conducting ourselves at the stages 2 audit Because obviously, at the end of the stage one, we need to start planning the stage 2 assessment, what processes we're going to be looking at. So the stage one really helps both of us to get a feel for each other and ensure that we have a more effective planning.

Alan Gould (06:25)
get to see how we operate, what our processes are, how we are going to conduct ourselves at the stage two audit, because obviously at the end of the stage one, we need to start planning the stage two assessment, what processes we're going to be looking at. So the stage one really helps both of us to get a feel for each other and ensure that we have a more effective planning and

Michael Venner (06:52)
eventually affect the conduct of the stage 2 process. Okay, so is there time when you have to have sort of the stage 1 before stage 2 or anything or can you just go straight from stage 1 into stage 2 or is it a bit of time? Is it dependent? Well, it depends. If there are any gaps found

Alan Gould (06:52)
eventually effective conducting of the stage two assessment.

from stage one and stage two.

Well, it depends really. If there are any gaps found at the stage one assessment, we don't actually raise non -conformities, we raise potential non -conformities because stage two is where we are actually auditing against the clauses of the standard. So it depends really on how many issues the client has to resolve.

Michael Venner (07:24)
raise our on the platform.

Alan Gould (07:40)
Also, a back -to -back stage one and stage two assessment can take place, but it's not advisable. Really, we'd like to allow a certain period of time for the organisation to complete all of the tasks that they need to in order to then come forward for stage two.

Michael Venner (07:42)
Also, back to stabilised stage 2 is better. It can take place, but it's not advisable. Really, you have a certain period of time for organisation to complete all the tasks that they need to in order to then come forward with stage 2.

Alan Gould (08:05)
the total amount of time I believe the stage two has to take place within six months of the stage one assessment and that is one of the rules within our UKAS accreditation.

Michael Venner (08:05)
So if they don't have it within the six months what happens then?

Alan Gould (08:20)
So if they can't have their audit for whatever reason within six months, then we'd have to start again at stage one again. usually most organisations unless they're going through sort of restructuring or operational difficulties, they're usually able to conduct the audit within six months. We obviously work with them the best we can to in order to make that happen.

Michael Venner (08:31)
Have you ever turned up for a stage one and just like nothing is ready?

Alan Gould (08:50)
Absolutely. I remember when I very first started auditing, I was pretty fresh and myself and my colleague at the time turned up to a stage one assessment and the client said to us, right, what do we need to do then to get certified? And I said, well, let's have a look at your management system. We start going through the documents and they said, I thought you were going to do that for us.

Michael Venner (08:55)
I was pretty fresh. said, well, my colleague, time turned up to a slight drop. And I said, what do we need to do? And I said, well, let's have a look at your management system. We start going through the documents and they say, I thought you were doing that for us. And then we realised that  what they were actually looking for was a consultant

Alan Gould (09:17)
And then we quickly realised that actually what they were looking for was a consultant. obviously as part of our, again, our UKAS requirements, we have to remain impartial to the process. So we can't get involved in any consultancy or giving of advice. was a very quick one. And unfortunately for the client, it's very hard to justify any sort of cancellation when it's on the day. Yeah.

Michael Venner (09:21)
And obviously as part of our requirements, have to remain impartial to the process so we can't get involved in any consultancy or giving advice. So it was a short -lived stage one then? It was a very short -lived one. It was very hard to justify any sort cancellation. I think stage ones are helpful because

Alan Gould (09:48)
Thanks, bye.

Michael Venner (09:51)
But before your time, we didn't do stage ones and quite often we'd turn up and we'd have exactly that same conversation, but that would be their total initial assessment not a stage one. So there is a benefit to them. Yeah, absolutely. Yeah, it does help. Like I said, it breaks down barriers and as you get no people and things like that. what are the types of things you cover on stage one? So what we cover on stage

Alan Gould (09:53)
stage once and quite often we turn up we'd have exactly that same conversation. Right. it is a benefit to them. absolutely.

as you get to know people and things like that. So what are the types of things you cover on a stage one? So what we cover on a stage one is to begin with we'll go through the opening meeting which is a set agenda as required by our accreditation rules and we'll go through with the organisation the standard that we're going to be auditing them to.

Michael Venner (10:21)
is to begin with, go through the OVMETE, which is a state agenda that has required our orientation goals, we'll go through the new organisations and what we're to be able to do, what the scope of the certification they wish to be certified to, which we would have had information before about the sales order, the sales entry process. We will then go through the audit plan for the day

Alan Gould (10:35)
what the scope of certification that they wish to be certified to, which we will have had that information before at the sales order, sales entry process. We'll then go through the audit plan for the day. Even though an audit plan isn't necessarily required by stage one, we do always put an audit plan together just so that the client knows what we're going to be looking at for the day. And then we'll start looking at

Michael Venner (10:51)
even though management is not necessarily required by the study department we do in the case. We've got an automated system so the client knows what we're going to be looking at for the day. And then we start looking at the management system, whether it's quality, environmental or health and safety for the three standards. I would have a look at the policy to make sure that the right commitments are in the policy. It's been approved or at least reviewed.

Alan Gould (11:04)
the management system, whether it's quality, environmental, or health and safety for the three standards that I audit. Having a look at the policies, making sure that the right commitments are in the policies, it's been approved or at least reviewed by senior management and how that's communicated within the organisation. And then look at the scope of certification, as I mentioned too, and what the boundaries are.

Michael Venner (11:20)
senior management and how they're communicating with the organisation. And then look at the scope of certification, as I mentioned, too, what the boundaries are, what the risks associated and the treatment which they don't be operating in. And then have a look at some of their procedures, their processes, their process maps, whether they're finished because of course it is only stage one, the organisation does have time as we said.

Alan Gould (11:30)
and what the risks associated and the industry for which they're going to be operating in. And then have a look at some of their procedures, their processes, their process maps, whether they're finished, because of course, it is only stage one. So the organisation does have time between, as we said, between stage one and stage two to finish any of these kind of documents, one of which I'll sort of allude to a bit later. we also look.

Michael Venner (11:50)
We also add roles and responsibilities, they're defined or not, within the management system, there are roles to follow. Most people really are hierarchical of an organisation, such as senior management. Obviously, the standards are all about leadership and commitment, and that really obviously comes down from the top, we want to see that cascaded right down

Alan Gould (11:58)
at the roles and responsibilities, whether they've been defined. Obviously, within the management system, there's roles for most people in the hierarchy of an organisation, such as senior management. Obviously, the standards talk about leadership and commitment, and that really obviously comes down from the top. And we want to see that cascaded right down to the sort of operational and workers within the organisation. So.

Michael Venner (12:19)
So

Alan Gould (12:23)
All of this starts to give us a good feeling that the organisation has got a management system in place and they're switched on, they're doing it for the right reasons and that they are really sort of committed to continue improvement, which is at the end of the day, that's what it's all about. We talk about the spirit of the standard and that's what we're looking for. That's what we're trying to get an impression for us at stage one. When we're talking about some of the more...

Michael Venner (12:50)
some of the documents we look at management review internal audits, objectives and even though we're not actually auditing them thoroughly all of it we just look to see if they've been established because as I said this is something that can be established between stage one and two and that's why we advise that there is a bit of time between those two so that the organisation can have a little bit of exposure from us as the sort of Certification body auditors and then look to establish

Alan Gould (12:50)
some of the documents, we look at management review, internal audits, objectives, and even though we're not actually auditing them thoroughly, we just look to see if they've been established because as I said, this is something that can be established between stage one and two and that's why we advise that there is a bit of time between those two so that the organisation can have a little bit of exposure from us as the certification body auditors and then look to establish

Michael Venner (13:19)
their procedures, their objectves also their procedures, and then do internal audits and check that the procedures are effectively implemented and maintained, and then do the management review. And then it all starts to come together. So when we go to stage two, everything's ready and we can just go for it. So if they haven't done all of the bits at the stage one such as management review, internal audits, it's not a big deal or it is a big deal?

Alan Gould (13:19)
their procedures, their objectives and also their procedures and then do internal audits to check that the procedures have been suitably and effectively implemented and maintained and then do your management review and then it all starts to come together so that when we go to stage two, everything's ready and we can just go for it.

you

Michael Venner (13:49)
Personally, I would say it's a big deal. Obviously, it's potential for non-conformance So that's would have to be raised And naturally as it's a stage two. We'll look at that anyway. whilst I would say that it's advisable that an organisation tries to get their management system fully implemented, perhaps before stage one, because then it's time to deal with

Alan Gould (13:49)
Personally, I wouldn't say it's a big deal. Obviously, it's a potential nonconformity. So that would have to be raised in the report. And naturally, as it's a stage two, we'll look at that anyway. whilst I would say that it's advisable that an organisation tries to get their management system fully implemented before stage one, because then it's starting to build that.

that feeling that the organisation are ready. It's not the be all and end all. And there might also be discussions which take place at the stage one that will enable later activities for the organisation which may then need management review, internal audit, etc.

Michael Venner (14:38)
okay. So sometimes they take the information from the stage one to do their management review and things like that. Is that what you're saying?

Alan Gould (14:48)
What I'm saying is because the stage one would be the first time that they have been exposed to the whole ISO 9001, ISO 14001 environmental, ISO 45001 occupational health and safety management system process is that they might start to raise more awareness within the organisation. And that will get people thinking, okay, the auditors are going to be looking at this. They mentioned that.

Michael Venner (15:05)
They might start to raise awareness within the organisation and that will get them thinking about the audiences are going to be good at this, they're making that. We need to think about that because that could come up in stage 2. So that's what I by this. Got it, understand. They might learn something that they've got to do to...

Alan Gould (15:16)
We need to think about that because that could come up at stage two. So that's what I mean by additional actions might be required.

Yeah, exactly.

Michael Venner (15:29)
Dot the I's cross the T's so to speak. Do you speak to everyone in the organisation at the stage one or is it? I don't speak to every single person but I personally would speak to all of people that have a large contribution to the management system. especially senior management as I said to earlier, there's a real one

Alan Gould (15:36)
I don't speak to every single person, but I personally would speak to all of the people that have a large contribution to the management system. So, senior management, as I said to earlier, there's a requirement at stage two to conduct the senior management interview to really extract information about...

Michael Venner (15:57)
stage two to conduct senior management interviews to really extract information about the context of the organisation. me. Context of the organisation, interest of parties, research opportunities, also their commitment to leadership and customer focus. So what are the different stage ways of senior management interviews and preparedness?

Alan Gould (16:04)
the context of the organisation.  Context of the organisation, interested parties, risks and opportunities, but also their commitment to leadership and customer focus. So what I would do at stage one is have a senior management interview preparedness period for an hour or so just to go through with the client what the expectations would be from the stage two.

Michael Venner (16:27)
So I can go away and cheat and get their answers really.

Alan Gould (16:32)
and to raise a bit of awareness and to get them thinking.

Yeah, I mean, it sounds like a very formal discussion, but really all we want to know is what the organisation are trying to achieve, what their objectives are. Exactly. just understand the strategic direction and how they're going to go about it. So once you start getting leaders talking, they don't stop basically.

Michael Venner (16:55)
Type thing in their understanding. So once you start talking, they don't stop. Yeah, we know that. Okay, okay. So what can an organisation do to sort of plan for the stage one? So things they've got to do, or do they just wait for you to rock up, or is there things that they could do to just to make the whole process go a bit smoother?

Alan Gould (17:07)
Yeah.

So.

things they've got to do or do they just wait for you to rock up or is there things that they could do to just wait for the whole process to go to extreme? So an organisation can decide two ways to begin with. They can either put together the management system themselves or they can go down the route of finding an external consultant to help them with the process. Obviously the latter is much easier for them because they'll have an expert that can

Michael Venner (17:25)
So, an optimization in this guy has two ways to begin with. They can either put together the management system themselves, or they can come up a way finding a consultant to help them with the process. Obviously the lab group is much easier for them because they'll have an expert that can actually consult and advise them, and sometimes even give them a management system to work to.

Alan Gould (17:45)
that can actually consult and advise them and sometimes even give them a management system to work to. So we see both types of organisations at stage one. If an organisation goes down the first option, they really have to go through the plan, do, check, act cycle. And they need to

Michael Venner (17:54)
So we see both types of organisations at stage one. If an organisation has found the first option, then they really have to start the go through the plan, do check out the cycle and they need to plan out what they want the management system to achieve. They have to go through and start.

Alan Gould (18:14)
plan out what they want the management system to achieve. They'd have to go through and start to create control documents because, documented information is a key.

Michael Venner (18:29)
Okay. So how can someone prepare themselves as an organisation? How can they prepare themselves actually for the stage one? What can they do themselves? Okay. So once they've established...

Alan Gould (18:29)
How can someone prepare themselves for stage one? What can do themselves?

Michael Venner (18:42)
management system or  as far as they can. They need to start raising awareness within the organisation because often we find they've got a quality department environmental or health and safety, the EHS department that can work with the management system together that really needs to buy in from everybody and as this is going to be multiplied by people and groups involved in the audit they need to start the liaising with the

Alan Gould (18:55)
Environmental and Health and Safety, the EHS department that will put the management system together. But really it needs the buy -in from everybody. And as there's going to be multiple people and groups involved in the audit, they need to start liaising with the different departmental leads or even champions within certain subjects to really give them, raise their awareness and what is expected of them within the audit. Obviously,

Michael Venner (19:11)
to really

Alan Gould (19:24)
The audit process involves a lot of discussion and sometimes even interview style questions from the auditor. Obviously, we try to put people at ease as much as possible, but we're looking for specific information which relates to the standard and which relates to their processes. So people need to be well -versed on how to answer our types of open -ended questions and give us the information that we're looking for.

Michael Venner (19:40)
Alright, okay. So do they get anything before the stage one to help them prepare themselves?

Alan Gould (19:53)
So as a certification body, part of our process when we go through the planning of the stage one audit is to put together, as I said, is to put together a stage one audit plan. The stage one audit plan will detail the different processes, the timings on the day and...

Michael Venner (19:52)
As a. Process. As I said, is to together. Detailed processes. The timing. This will help.

Alan Gould (20:14)
This will help the organisation to coordinate internally in order to ensure that people are available for the time specifically when we are going to come in and need their expertise.

Michael Venner (20:18)
in order to ensure that they are available for the other times specifically when we had to open and take their expertise. Have you ever turned up and they weren't even aware that an audit was taking place? you had that? many times in i've been to the organisations and the auditee that I needed to speak to wasn't available.

Alan Gould (20:35)
Yeah, many times actually, many times I've been to organisations and the auditee that I needed to speak to wasn't available or they weren't aware that we were coming on site and really that's quite a detri...

Michael Venner (20:50)
Really that is quite

really that's one thing that matters to the organisation because if they haven't prepared their staff then it can cause problems however on the flip side it can be quite good because if there are potential issues raised then that could lead to improvement opportunities so actually what we see is that sometimes we go on site people could be well 

Alan Gould (20:53)
Really, that's quite detrimental to the organisation because if they haven't prepared their staff, then it can cause them problems. However, on the flip side, it can be quite good because if there are any potential issues raised, then that could lead to improvement opportunities. So actually, what we see is that sometimes we go on site and people will be

well prepared, well versed on the expectation. And sometimes the client will say, I haven't even told them that you're coming because actually they want the benefit of putting their people in the spotlight. Exactly. Exactly. Yeah.

Michael Venner (21:23)
the system. Okay. Have you ever turned up to an audit though and the auditee wasn't, like no one was aware, like knocking the door, how I'm here to do your audit and they're like, what?

Alan Gould (21:50)
I think that that happens less and less nowadays because of the improvements in technology, emails, all of our systems within Auva have multiple emails that go out to clients at different stages. So it would be very difficult for that to happen now. Really?

Michael Venner (21:53)
that happens less and nowadays because of improvement in technology, mouths, all of our systems within our own, and how to come out to clients with different settings. So it would be very difficult for that to I did have one the other week. Really? He wasn't aware, he actually got the days wrong. And interestingly,

Alan Gould (22:20)
interested me the consultant had other days in the diary even though the letters all went out. were prepared for which is good actually. You're supposed to be tomorrow. No, and then we checked all the emails and said you'll get planned.

Michael Venner (22:21)
the consultant had other days in the diary, even though the letters all went out and things like that. was quite, I mean, they were prepared, which is good actually. But yeah, he turned around and he was like, what are you doing here? You're supposed to be tomorrow. I was like, no. And then we checked all the emails and even said the audit plan, we all had the right day. So I was safe. So it was his mistake, which fine. It was only a day early. He was all prepared. And then he said, my consultant's not here. So he phoned the consultant.

Alan Gould (22:42)
That's the thing, it? Internally as an organisation, we try to mitigate that as much as possible, but you can't help human error. But one of the good...

Michael Venner (22:51)
The consultant thought it was in two days time. So I don't know what went on there? It happened, but to be fair, the audit went smoothly. So it was a good test of their system, to be fair.

Alan Gould (23:12)
one of the good testers there was that even though they weren't necessarily ready on that day, they were ready. And that again, gives a good impression because sometimes you go to an organisation and they'll, I'll say, right, let's have a look at your management system. And they'll be like, there you go. Whereas here, obviously it's more of a living, breathing thing. So they were probably more ready for that reason.

Michael Venner (23:41)
Cool. Okay. So what happens if you don't do a stage one assessment or if we didn't have that in the requirements or if you didn't do it properly or let's just say the client wasn't prepared for the stage one, what can sort of go wrong? What could be the pitfalls?

Alan Gould (23:43)
What?

Well

Michael Venner (23:59)
That could be quite a great issue actually because obviously all of the information we gather at stage 1 enables us to conduct a more effective and efficient stage 2. So if the client didn't conduct a more effective and stage 2, we could have lot more processes going to and on stage 2 and obviously have an impacts our time to conduct the stage 2 audit effectively.

Alan Gould (23:59)
That could be quite a great issue actually, because obviously all of the information that we gather at the stage one enables us to conduct a more effective and efficient stage two. So if the client didn't conduct or weren't ready for their stage one, we could have a number of processes when we turn up at stage two that we weren't aware about. And obviously that impacts our time to conduct the stage two audit effectively.

Michael Venner (24:29)
that could, again, cause a lot of findings for the client or the organisation put together before they are eventually certified. But really, I  think we have to conduct a stage one. I mean, it's part of what we call...

Alan Gould (24:29)
That could, again, cause a lot of findings for the client, for the organisation to put together before they're eventually certified. But really, we have to conduct a stage one. That is part of what we call the initial assessment, the stage one and the stage two. And when we are quoting our clients, we have to...

Michael Venner (24:48)
And when we are wanting confidence, have to give a suitable time to do both of those steps because they kid of marry together. You can't really do the stage 2 without the stage 1. do We can't run before we walk Very true.

Alan Gould (24:54)
give suitable time to do both of those steps because they kind of marry together. You can't really do the stage two without the stage one. You can't run before you walk, right?

Michael Venner (25:06)
Okay. So you saying that an effective stage two will occur or more likely to occur if you've done a really good stage one. Is that what you're sort of saying? Absolutely. Yeah. Absolutely. If anything, the stage one is an additional time for you to spend getting to know the client and by the time the stage two comes up and have already

Alan Gould (25:08)
So you say in effect stage two, the more light...

Absolutely. Absolutely. In any, if anything, the stage one is just additional time for you to spend to get to know the client. And by the time stage two comes around, you've already met each other. You've done all your formal introductions. The client's already a little bit more at ease with you. And you've done all of that kind of, all of that planning work.

Michael Venner (25:36)
You've done a lot of work with the clients, we've written a lot of more details with them. And you've done all of that planning work with regards to the management system, the policies, the scope, context, etc. And then you've increased the focus on the key processes and verified whether they're being effectively conducted and also whether they meet with the requirements and standards.

Alan Gould (25:47)
with regards to the management system, the policies, the scope, the context, et cetera. And then you can really focus on the key processes and verify whether they're being effectively conducted and also whether they meet the requirements of the standard, which is at the of the day, the goal.

Michael Venner (26:07)
So can someone actually fail a stage one?

The only way you can fail a stage 1 is if you haven't got anything in place I 

Alan Gould (26:10)
The only way that you could fail at stage one is if you haven't got anything in place, you haven't got a management system, you just have no awareness of what's required by the standard. We could certainly go into an organisation that have got the bare minimum, the bare bones, and we would just raise many potential non -conformities. And then the organisation would need to go away.

Michael Venner (26:18)
You just.

away.

We could certainly.

and we would just raise many potential ones and then the other ones would need to go away and put all the other things right before they go to stage 2. you don't fail but you could have a big long list of things to work through. Absolutely, and one thing that we always say is this isn't a pass or fail process.

Alan Gould (26:39)
and put all of those non -conformities right before they go for stage two. So, so yeah.

Absolutely. And, and one thing that we, we, we always say is this isn't a pass fail process. This is, you're, I don't like the word pass because it seems more, checkbox kind of exercise, but you would achieve certification or you'd achieve certification with minors, majors, et cetera. And you have to put them right with evidence before, before you obtain your initial certification.

Michael Venner (26:58)
I don't like the word path because it seems more checkbox kind of exercise but you would choose a position or you would take a position with monitors and monitors etc. with a full view to hear which is how it's actually done. So you'd always sort of do a stage one and then progress to the stage two or could you...

sometimes like, no, you've got to do another stage one. that happen? Yeah. If they didn't have anything yet, you'll probably do another stage one because there's a magic number of potential issues that. think we're aware of is the organisation are using us a gap analysis tool. If they're not aware of what's going on.

Alan Gould (27:25)
Yeah.

I think what we have to be aware of as auditors is that the organisation aren't using us as a gap analysis tool. If you go into an organisation and they're not aware at all of what's required, then I would say you're not ready for stage two. And maybe it would be better for you to go away, do a bit of research.

Michael Venner (27:54)
I would say you're not ready for stage two. Maybe it's better for to go away and do a bit of research if you need to find some help from a consultant or just spend a bit more time getting through it.

Alan Gould (28:04)
if you need to find some help from a consultant or just spend a bit more time getting through, understanding the requirements of the standard. you probably can, yeah, you can fail a stage one if nothing's in place. But again, we try to work with the organisation. We want to certify them. We want to help them as much as we can, but obviously we can't consult.

Michael Venner (28:13)
And so you probably can. You can have mistake if it's not in place. you can try to work with the organisation. We want to do the obvious. We want the possibility to try and console

So when would someone need to have a stage one? When should they sort of go ahead and have one?

Alan Gould (28:34)
So with someone.

So I would say that once the organisation has implemented their management system, along with the control of documents, of records, of processes and procedures, and that they've done the activities of raising awareness, getting the buy -in from departmental heads, and conducted at least some internal audits,

Michael Venner (28:45)
in the system.

processes and procedures that they have done that have been effective in raising awareness.

and conduct it at least on internal audits, then they should go for the stage 1 . So what we want to see is the management system is 90% of the way implemented and ready for certification . Because if there's a few issues then they can be rectified and then go for stage 2 it's not the same as this. There is all internal audits.

Alan Gould (29:09)
then they should go for their stage one. what we'd like to see is that management system is 90 % of the way implemented and ready for certification. Because then if there's a few issues, then they can be rectified and then we'll go for stage two. But it's not always necessary that all internal audits are conducted because of course,

There might be some findings at stage one that require re -audits and management review being conducted. They're really the only two activities that we often see that haven't been completed at stage one, but then will be done by stage two. All of the control of documents, the procedures have been established, even goals and objective that have been established and they've been communicated. It's really just those two activities that take place.

Michael Venner (30:07)
Okay, great. Thanks for your time. It's been good.

Alan Gould (30:09)
Brilliant. Thanks very much. Really enjoyed it. Good. Cheers.