Five weeks from stage 2: whether to proceed

The decision turns on the purpose of stage 1. A two-stage initial audit exists so that stage 1 can evaluate the organisation's readiness - whether the management system is implemented, whether the internal audit and management review cycles have operated, and whether the scope and documentation are adequate - before stage 2 tests effectiveness on site. Stage 1 concerns are not yet nonconformities, but they are exactly the issues stage 2 will test, and they are the issues most likely to become major nonconformities.

Proceeding as-is is a poor bet. If stage 2 finds a major nonconformity, certification is withheld until correction and corrective action are verified, usually after a further visit, so the client timeline slips anyway - with the added damage of a public failure. The open improvement notice makes it worse: the regulator has already found that a required arrangement is missing, and that finding will be in the public domain.

Three realistic options: (a) proceed, but only if the rescue plan, the north region and rope-access audits, and root-cause analysis on the two open nonconformities are completed with evidence before the audit; (b) ask the certification body to defer stage 2 by six to eight weeks and use the time properly; (c) request a second stage 1 once the system is demonstrably running.

Recommendation: open the conversation with the certification body now, present a dated remediation plan, and defer if the plan cannot be delivered. Do not ask the auditor for advice on how to fix things - that compromises impartiality.

Grading depends on the certification body's rules, but the usual logic is that a major nonconformity involves a missing or ineffective system element that affects the capability of the management system, while a minor is an isolated lapse.

1. No internal audit of the north region or rope-access work. Close by completing a competent, independent audit of both with findings and actions tracked. Likely major: an entire significant activity and a whole region outside the audit programme (9.2) undermines assurance.
2. Three objectives without performance data. Close by showing measurement against each objective, with data and review. Likely minor if 6.2 planning exists but monitoring is patchy; potentially major if the objectives were never operationalised.
3. Scope excluding subcontracted blade repair and Belfast. Close by re-determining scope under 4.3 with a defensible rationale, or by bringing both in. Likely major: a scope that omits a significant controlled activity misrepresents the system, and the certification body must verify the scope statement it puts on the certificate.
4. Two open second-party major nonconformities without root-cause analysis. A client audit finding is not automatically a certification-body nonconformity, but leaving it open without investigation indicates 10.2 is not effective. Close with recorded investigation, root cause, action, effectiveness check and updates to risk assessment. Grade follows the underlying failure.
5. One-page management review minutes. Close by producing records showing the 9.3.2 inputs and 9.3.3 outputs. Likely minor if the review happened but recording is poor; major if inputs were never considered.

Remember the certification body verifies correction and corrective action for major nonconformities before granting certification.

The incident is handled under 10.2, not under audit preparation. Required actions:

• React: make the work safe, provide first aid and support to the injured worker, secure the scene.
• Investigate to root cause: was the transfer point a design issue (8.1.2 engineering), a procedure and training issue, a supervision issue, or all three? Record the findings.
• Review the risk assessment for height work and the rescue arrangements, and extend the review to similar transfers across all depots.
• Implement proportionate corrective action, verify effectiveness, and update documented information and competence records.
• Evaluate compliance with legal requirements (9.1.2) and update the legal register (6.1.3) for the improvement notice.
• Consult and involve workers in the redesign and the rescue plan (5.4), and communicate openly (7.4).
• Test the rescue plan under 8.2, including drill records.

The improvement notice runs on its own legal clock of 28 days; it is a regulator's finding, not a certification issue, but non-compliance is evidence that 6.1.3 and 9.1.2 are not working.

What to avoid: backdating revised documents, closing the incident internally as 'no action required', instructing staff not to discuss it with auditors, or treating the notice as a paperwork exercise. Auditors are required to be impartial, so do not ask them to validate the fix; instead present the evidence at the opening meeting and let them test it. A failure discovered and properly corrected is a different story from a failure concealed.