Preparing for the certification audit: internal audit, management review and common nonconformities

Most problems at a certification audit are visible weeks earlier in the internal audit and management review. Done properly, these two steps turn the external audit into a confirmation rather than a surprise.

What the certification body expects before stage 2

Whether you are certifying to ISO/IEC 27001, ISO 9001, ISO 14001, ISO 45001 or another management system standard, the certification body will expect at least one complete internal audit covering the scope, and at least one management review, before the stage 2 audit. Missing either is a frequent reason for a stage 1 audit to conclude that the organisation is not ready.

Planning the internal audit

1. Audit programme. Decide which processes, sites and requirements will be audited and when. For a first certification, the whole scope needs to be covered. In later years the programme can be risk-based.
2. Auditor competence and independence. Internal auditors need training in the standard and in audit technique; ISO 19011 is the usual guide. They must not audit their own work. In small Georgian companies this often means bringing in an external internal auditor or exchanging auditors between departments.
3. Criteria. Audit against the standard, your own procedures and the legal requirements in your register, for example the Law of Georgia on Personal Data Protection or the Organic Law on Occupational Safety.
4. Sampling. If you have sites in Tbilisi and Batumi, or remote staff, the sample should reflect that.
5. Language. Records can be in Georgian or English. Make sure evidence can be explained to the certification auditor, who may not read Georgian, or plan for an interpreter.

Running and reporting the internal audit

Interview the people who do the work, not only the system manager. Look at records, not only documents. For each finding, state the requirement, the evidence and the gap. Classify findings consistently and agree corrective actions with owners and dates. An internal audit report that lists no findings at all for a new system rarely convinces a certification auditor.

Management review

Top management must review the system and record its decisions. The standards list the required inputs. Common ones are:

• status of actions from previous reviews;
• changes in external and internal issues, including new laws and client requirements;
• performance against objectives and monitoring results;
• internal audit results and nonconformities;
• results of risk assessment and status of risk treatment;
• feedback from customers and other interested parties;
• opportunities for improvement and resource needs.

The output should contain decisions: resources approved, objectives changed, actions assigned. Minutes that only list the inputs are a typical finding.

Common nonconformities at certification audits

• Risk assessment not linked to controls. Risks are listed but nobody can show how a specific control treats a specific risk.
• Objectives without measurement. Objectives exist but are not measured, or the data is not reviewed.
• Legal register out of date. Recent Georgian legislative changes or regulator changes not reflected, for example the transfer of data protection supervision to the State Audit Office in 2026.
• Competence evidence missing. No records showing that people in key roles are qualified or trained.
• Supplier control on paper only. A procedure exists but suppliers have not been evaluated.
• Corrective actions closed without root cause. The symptom is fixed; the cause is not analysed.
• Documents not controlled. Old versions in use, no approval or review dates.
• In ISO/IEC 27001 audits specifically: statement of applicability inconsistent with implemented controls, access reviews not performed, backups never tested, and incidents not recorded.

At the audit itself

Nominate a guide for the auditors, prepare a room or video setup, and make sure the people named in the audit plan are available. Answer the question asked and show the record. If the auditor raises a nonconformity, agree the facts and plan the correction. Major nonconformities must be closed and verified before the certificate is issued, within the period set by the certification body; minor ones need an accepted action plan.

The choice of certification body affects how smoothly this goes. See how to choose a certification body in Georgia.

How BALTUM helps

We train internal auditors, carry out independent internal audits, facilitate the management review and run a pre-assessment that simulates the stage 2 audit. We also support you during the certification audit and with corrective actions. More on the standards: ISO 27001 and ISO 9001.

To arrange an internal audit or pre-assessment, use the form on this site or write to info@baltum.org.

Frequently asked questions

Can an external consultant perform our internal audit?

Yes. The standards require competent and impartial internal auditors, not that they are employees. An external auditor is common in smaller organisations, but the consultant who built the system should not audit their own work.

What happens if the auditor finds a major nonconformity at stage 2?

The certificate is not issued until the nonconformity is corrected and the certification body has verified the correction, which may require a follow-up visit or document review.

More articles from BALTUM Georgia