Preparation for an EOMS certification audit
This domain tests how an EOMS reaches a certification audit and what auditors will expect.
How certification works
An accredited certification body audits against ISO 21001:2018 under ISO/IEC 17021-1. The two-stage model applies: Stage 1 reviews readiness - scope, documented information, context analysis, completed internal audit and management review, resources identified; Stage 2 tests implementation and effectiveness by sampling processes, interviews and records. Findings are classified as major or minor nonconformities; the certification decision follows closure of majors and acceptance of corrective action plans for minors. Certificates run three years with surveillance audits, then recertification.
Readiness evidence
You should be able to show: scope and any requirements determined not applicable with justification; process map and documented information actually in use; risk and opportunity register with actions; objectives and performance data; internal audit covering all clauses; management review with decisions; corrective action records with effectiveness checks.
Worked example
A training company schedules Stage 2. At Stage 1 the auditor finds the internal audit covered only clauses 7 and 8, and no management review has been held. These are readiness gaps, not minor findings to fix later: the check-and-review cycle has produced no evidence, so the Stage 2 date is at risk.
Traps
Booking Stage 2 before a full audit cycle; treating Stage 1 as a formality; assuming the certificate covers every site when scope or multi-site sampling excludes some; arguing with a finding instead of correcting the system; expecting staff to recite the standard rather than describe their own processes.