Treat your ISO 9001 audit like a program launch
The nine-point process brief that took a multi-department organization through weeks of external audits and into recertification.
A few years ago I supported several weeks of external ISO 9001 audits in a large organization with dozens of processes and departments. The audit went well, and the organization was recommended for recertification under ISO 9001:2015. The reason was not a last-minute push. Every process owner walked into their session with the same pre-built brief.
That is the lesson I keep coming back to as a program manager.
An audit is a delivery milestone. It has a fixed date, many owners, hidden dependencies and a reviewer who judges evidence, not intentions.
Run it like a launch and it becomes predictable.
The nine-point process brief
Each process owner prepared one brief, in the same order, before their audit session:
- Organization. Where the process sits in the management system and which processes it feeds or depends on. A clear map also signals leadership support.
- Quality policy link. How this process contributes to the quality policy, backed by at least one KPI.
- Roles and responsibilities. Who owns, executes and approves. ISO doesn't prescribe levels, so be explicit about yours.
- Process focus areas. Purpose, outputs and the few steps that matter most.
- Process map. A Turtle diagram or SIPOC: the roadmap the auditor can follow.
- Risks and mitigations. The top process risks, the actions taken and how effectiveness was checked.
- KPI performance. The dashboard, plus what happened when a target was missed. Separate the correction, which fixes the instance, from the improvement, which prevents recurrence.
- Continual improvement. Active projects with owners, sponsors, timelines and status.
- Competence and training. Skills matrix, training cadence and backup coverage for critical roles.
Why it works
- It standardizes the interface. Auditors meet the same structure in every session, so time goes to substance instead of orientation.
- It exposes gaps early. A process owner who can't fill a section has found a nonconformity before the auditor does.
- It reflects the real system. The brief is only as good as the management system behind it. It turns the audit into a status review of work that already exists.
The takeaway
Whether it's an ISO audit, a silicon tape-out or a customer release, the pattern is the same: define a standard baseline, give every owner the same template and review evidence before the milestone, not during it. Complexity doesn't make an organization fail audits. Inconsistency does.
How do you prepare process owners for audits? I'd like to hear it. Message me on LinkedIn.