Every ISO audit is a little different, but auditors tend to ask for the same core set of documents nearly every time. If you’ve got these ten ready, organized, and current, you’ve handled the backbone of what a Stage 2 or surveillance audit runs on — and you’ve avoided the single most common source of audit-day stress, which isn’t failing a requirement, it’s not being able to find the evidence that you met it.
Here’s what they’ll almost certainly ask for, and — more useful — what they’re actually checking when they do.
1. Your Scope Statement
The first thing an auditor establishes is what they’re auditing. Your scope statement defines the boundaries of your management system — which sites, products, services, and processes are covered. They’re checking that it’s clearly defined, that it matches what you actually do, and that you’re not quietly excluding something that should be in. A vague or inaccurate scope undermines everything downstream.
2. Your Policy (Quality, Environmental, Safety, etc.)
Whether it’s the quality policy for ISO 9001, the environmental policy for ISO 14001, or the OH&S policy for ISO 45001, the auditor wants to see it — and wants to see that it’s more than a framed paragraph nobody reads. They’re checking that it fits your organization’s actual context and direction, that it’s been communicated, and that your people have some genuine awareness of it. Expect them to ask a staff member what the policy means in practice.
3. Objectives and Plans to Achieve Them
Your policy makes commitments; your objectives are how you deliver on them. Auditors look for measurable objectives tied to the policy, with real plans behind them — who’s responsible, what resources, what timeline, how you’ll know you succeeded. The common finding here is objectives that exist on paper but have no evidence of being tracked or acted on.
4. Risk and Opportunity Assessments
Risk-based thinking runs through modern ISO standards, so auditors want to see that you’ve identified the risks and opportunities relevant to your system and done something about them. They’re not looking for a perfect crystal ball — they’re looking for evidence that you thought it through systematically and that your actions connect back to the risks you identified.
5. Internal Audit Program and Records
This is a big one, and it’s where a lot of systems come up short. The auditor wants your internal audit schedule, the records of audits actually conducted, and evidence they covered your full scope over the cycle. A gap here — like an internal audit program that lapsed after the first year — is a serious finding, because it signals the system wasn’t really operating. Have the schedule, the reports, and the auditor independence sorted. Our step-by-step guide to ISO 9001 internal audits covers how to set that up.
6. Management Review Records
Management review is the clause that gets skipped most and cited most. Auditors want minutes showing leadership actually reviewed the system — with the required inputs (audit results, objectives performance, customer feedback, nonconformities, and so on) and real outputs (decisions, actions, resource allocations). “We talked about it informally” doesn’t survive an audit. They want documented evidence that the review happened and produced something. See what auditors actually want to see in a management review.
7. Corrective Action Records
When something goes wrong, what do you do about it? Your corrective action records show the auditor how you handle nonconformities — and they’re looking for depth, not just closure. Did you find the root cause, or just fix the symptom? Did you verify the action actually worked? Corrective actions closed with a quick patch and no effectiveness check are a frequent finding.
8. Competence and Training Records
ISO standards require that people doing work affecting your system are competent to do it. Auditors ask for training records, competence matrices, and evidence that you’ve identified what competencies each role needs and confirmed your people have them. The gap they look for: training logs that prove attendance but nothing that proves the training actually made someone competent.
9. Monitoring and Measurement Records
How do you know your system is working? This covers the data you collect to monitor performance — inspection records, test results, process metrics, calibration records for any measuring equipment, environmental monitoring, safety metrics, whatever’s relevant to your standard. Auditors check that you’re measuring the right things, that your equipment is calibrated and controlled, and that you’re actually using the data rather than just filing it.
10. Control of Documented Information
Finally, the auditor checks how you control your documents and records themselves — the master list, version control, how obsolete documents get withdrawn, and whether records are retrievable when someone asks. This one’s almost meta: it’s the audit of whether you can produce everything else on this list. An organization that can’t quickly find its own records has a document control problem regardless of how good the records are.
The Pattern Behind the List
Notice what ties these together. Auditors aren’t trying to catch you out with obscure paperwork — they’re verifying that the core loop of a management system is actually running: you set direction (policy, objectives), you identify what could go wrong (risk), you check yourself (internal audit, monitoring), leadership steers (management review), and you fix and improve (corrective action) — all of it documented well enough that an outsider can follow the thread.
If your documents tell that story clearly, audits get a lot less stressful. If they don’t, the audit becomes a scramble to reconstruct evidence of work that may or may not have happened. The difference is mostly preparation and organization, not luck.
A Practical Tip
The single best thing you can do before any audit is a pre-audit review — walk through this list (and the specific requirements of your standard) and confirm you can actually produce each item, current and complete, without hunting. Most audit-day problems aren’t “we didn’t do it.” They’re “we did it but can’t find the proof.” Catching those gaps a few weeks out, when you still have time to fix them, is far cheaper than discovering them while an auditor waits. We cover why in how pre-audits save companies thousands in corrective actions.
Quick answers
What documents are mandatory for an ISO audit? The exact list depends on your standard, but auditors nearly always want your scope, policy, objectives, risk assessments, internal audit records, management review minutes, corrective actions, competence/training records, monitoring data, and document control evidence.
What’s the most commonly cited missing document? Management review records and a consistent internal audit trail are among the most frequently cited gaps, because they’re easy to let slip between audits.
Do I need documents for a surveillance audit too? Yes. Surveillance audits sample the same core areas to confirm you’re maintaining the system — the internal audit and management review trail especially.
How do I avoid the audit-day scramble? Run a pre-audit review ahead of the visit to confirm every required document is current, complete, and retrievable. Most audit stress comes from not being able to find evidence, not from not having done the work.
Want to walk into your next audit knowing every document is ready? A pre-audit review is one of the most cost-effective things you can do — book a free readiness call and we’ll help you find the gaps before the auditor does, or score your system to get a quick read first.
