Most organisations treat a quality management system audit as an examination. They panic, collate loose documents, and hope the auditor does not look too closely at the process layer. This reactive approach generates nonconformities because it focuses on hiding cracks rather than proving the system works.
An audit is an independent verification that your documented processes match your operational reality. If you are struggling to demonstrate this, the audit is not your problem. Your QMS is broken, and the surveillance audit is simply the mechanism that exposes the failure.
I have implemented and transitioned ISO 9001 and AS9100 systems at a major aerospace manufacturer, SNOP, and WITTE Automotive. The difference between a plant that prepares for ninety days and one that scrambles in the final week is not a few minor findings. It is the difference between a clean bill of health and a major nonconformity that threatens your certification. The ninety-day window is where the outcome is decided.
Phase 1: Assessment and Internal Audit (Days 1 to 30)
The first month is about exposing weaknesses before the external auditor arrives. Confirm the audit scope, identify the specific sites and processes involved, and verify the standard against which you will be assessed, whether that is IATF 16949 or AS9100. You cannot prepare for boundaries you have not defined.
Execute a full internal audit using the exact criteria of the upcoming external assessment. Do not rely on a superficial check. Record every discrepancy and classify them strictly as major, minor, or observations. A weak internal audit hides the exact gaps that will derail the certification attempt later.
Compare these internal findings against the previous external audit results. Look for recurring themes. If document control failures appear year after year, your corrective action process is ineffective. Prioritise critical gaps immediately. A systemic calibration failure requires more urgency than a single missing signature on a training record.
Phase 2: Correction and Root Cause Closure (Days 31 to 60)
The second month demands rigorous corrective action. For every internal finding, conduct a root cause analysis, implement corrective actions with strict deadlines, and verify the effectiveness of those actions. Closing a finding without verifying its effectiveness guarantees the nonconformity will resurface during the external audit.
During this window, focus on the core mechanisms auditors always scrutinise. In my experience building greenfield QA departments, the failure points are predictable. You must ensure your management review records contain actionable inputs and outputs, your CAPA system has no open 8D reports lingering without verified effectiveness, and your calibration intervals are strictly maintained.
Do not overlook document control and training records. Auditors trace a process from the approved work instruction directly to the operator on the floor. If the revision level on the document does not match the controlled register, or if the operator lacks recorded competency training for that specific revision, you will receive a nonconformity.
Core Audit Evidence Requirements
Phase 3: Mock Audit and Team Preparation (Days 61 to 90)
The final thirty days shift from systemic correction to operational rehearsal. Conduct a mock audit that simulates the real event. Bring in an external consultant or a manager from a different department to act as the auditor. They must follow the same format and ask the same penetrating questions as the certification body.
During this simulation, identify lingering weak points and train your audit guides and interview participants. The goal is not to provide rehearsed answers. The goal is to ensure every process owner understands their role within the QMS and can locate the objective evidence that proves the process is followed.
Ensure all documentation is organised and immediately accessible. When an auditor asks for the last management review, the PFMEA for a specific line, or the latest MSA study, producing a chaotic stack of paper signals a loss of process control. Immediate retrieval demonstrates a functioning management system.
Evidence Over Explanations: Handling Auditor Interviews
Auditors ask standard, mechanism-driven questions. They will ask to see your process for document changes, how you identify training needs, and how you measure the effectiveness of the QMS. They will request the latest management review records and ask how you ensure supplier performance meets requirements.
An unprepared team answers with explanations. A prepared team answers with evidence. Never tell the auditor how a process theoretically works. Instead, physically present the record. Show the logged customer complaint, the raised 8D, the implemented corrective action, and the verification record that proves the failure mode is closed.
Do not explain the system. Show the record that proves the system functions.
This requires absolute clarity from your process owners. If an operator is asked about quality objectives, they must be able to point to the specific target and explain how their daily routine influences that metric. If they cannot, the communication of the quality policy has failed, and the audit will reflect that failure.
Standard Questions and the Required Evidence
Preparation means mapping anticipated questions to specific records. Auditors look for the thread connecting the quality manual down to the shop floor execution. Anticipating these queries allows you to prepare the exact documentation required, preventing hesitation or defensive behaviour during the actual interview.
| Auditor Inquiry | System Mechanism | Required Objective Evidence |
|---|---|---|
| How do you identify training needs? | Annual competency matrix review | Approved matrix and gap analysis records |
| Show me the last management review. | Scheduled QMS review meeting | Signed minutes with actionable outputs |
| How do you handle customer complaints? | CAPA system trigger | 8D report with verified effectiveness |
| How do you control document changes? | Engineering change order process | Approved revision history and distribution log |
The Payoff: Zero Findings Through Structured Preparation
I have seen this framework transform audit outcomes. An automotive Tier 1 supplier preparing for an IATF 16949 surveillance audit had previously received twelve findings, including two majors. They deployed this ninety-day plan. The first month exposed eight latent nonconformities across document control, CAPA, and training records.
The second month focused on systemic correction. All procedures were updated to their correct revision levels. The CAPA system was redesigned to mandate automatic effectiveness verification, closing the loop on open 8Ds. Six employees who lacked recorded competency training were assessed and certified.
The final month involved a rigorous mock audit by an external consultant who identified three remaining vulnerabilities. The team closed those gaps. The result of the external surveillance audit was zero findings. It was the first clean audit in the history of the plant. Effective preparation eliminates the fear of the auditor because it replaces panic with proof.