Preparation for an SeMS certification audit
What the exam tests
This domain tests the certification process and readiness, not new SeMS requirements. Know the roles of the certification body, the client and the auditor; the difference between Stage 1 and Stage 2; and how nonconformities are handled.
Core rules and concepts
- Certification bodies operate under ISO/IEC 17021-1 and ISO 28003. Certification is a third-party conformity assessment; consultants should not certify their own work.
- The audit programme usually includes application and contract review, Stage 1 readiness assessment, Stage 2 certification audit, surveillance audits and recertification.
- Stage 1 checks readiness: scope, documentation, internal audit, management review, understanding of requirements and key risks. Stage 2 tests implementation and effectiveness.
- Prepare evidence: scope statement, risk assessment and treatment, objectives, internal audit reports, management review minutes, incident records, supplier controls and competence records.
- Manage nonconformities. A major nonconformity generally requires correction, root cause analysis, corrective action and verification before certification; a minor may be closed within an agreed period.
- The certification decision is made independently of the audit team. The certificate has a scope and expiry; surveillance maintains it.
Worked example
A company fails Stage 1 because management review minutes show no decisions and internal audit covers only the warehouse. It completes a full internal audit, holds a proper management review and closes the gaps. At Stage 2, the auditor finds a major nonconformity: carrier contracts lack security clauses. The company adds clauses, trains procurement and provides evidence; the certification body verifies closure before issuing the certificate.
Traps that cost marks
Treating Stage 1 as a practice run with no consequences; hiding a nonconformity; assuming a certificate proves zero risk; using a consultant to audit its own implementation; and letting the certified scope drift beyond the audited activities.