02 / Auditing
Find the findings before the registrar does
Internal audits, pre-assessments and gap analyses written the way a certification body writes them, because that's where the writing was learned.
An auditor asks for your internal audit records. You have them, but the last one was fourteen months ago, and the person who ran it also runs the process it covered. Two findings, before anyone has looked at the actual work.
That's why internal auditing exists as a service. It's a requirement of every standard, it's one of the most cited clauses in the industry, and in a small organization it's genuinely hard to do properly, because the person who understands a process well enough to audit it is usually the person running it.
There's a practical argument beyond conformity. A finding you identify yourself costs you time to fix. A finding the certification body identifies costs you time, follow-up audit fees, and a corrective action they have to verify. The internal audit is the cheapest place to discover a problem.
What we run
Four different audits, four different reasons
People use "audit" to mean all of these. They aren't the same job.
- Gap analysis
Before you have a system. Requirement by requirement, producing a prioritised build list rather than a conformity verdict.
- Internal audit
The audit the standard requires you to perform, run independently of the people who own the processes, with retained records.
- Pre-assessment
A dress rehearsal shortly before your certification audit, run the way the registrar will run it.
- Supplier audit
Auditing your suppliers or downstream vendors, which for R2v3 is part of the due diligence requirement, not an optional extra.
Why an outside auditor helps
The standard requires auditor objectivity. In a small organization that's genuinely hard. The person who understands the process well enough to audit it is usually the person running it.
Bringing in an outside internal auditor solves the objectivity problem and removes a recurring source of findings. It also means the audit actually happens, rather than slipping until the month before certification.
-
Recycling & ITAD
R2v3 & RIOS Electronics recyclers, ITAD providers, refurbishers and brokers. Take the R2 path → -
Manufacturing & services
ISO standards Quality, environmental, health & safety and energy management. Take the ISO path →
We can run your internal audits. We cannot be your certification body, and no consultant can. That separation is fundamental to how certification works.
Questions
Common questions
Can you be our internal auditor on an ongoing basis?
Yes. Several clients have us run the internal audit programme annually, which keeps it independent and means it doesn't get postponed.
How is this different from a gap analysis?
A gap analysis measures you against the standard before you have a system, and produces a build list. An internal audit tests a system that already exists and produces findings you have to close. Different question, different output.
Will you write the corrective actions for us?
We'll support them — root cause, action plan, effectiveness review, but the actions have to be owned by your people. An auditor can tell the difference.
What does the audit report look like?
The way a registrar writes findings: requirement reference, objective evidence, and a clear statement of what is nonconforming. Not a colour-coded score.
Next step
Want an honest audit before the real one?
Book a free call and we'll tell you which of the four audits your situation actually calls for. They aren't interchangeable.