Preparation for an SMS Certification Audit
This domain tests how certification actually works: who audits against what, how the two stages differ, how findings are graded, and what must be true before you book anything.
The rules of the game
Certification bodies are governed by ISO/IEC 17021-1 and ISO/IEC 20000-6; the organization is audited against ISO/IEC 20000-1 only. Select an accredited body, agree the certification scope (services, sites, units), and expect a Stage 1 audit that reviews readiness - documentation, scope, understanding, and confirmation that internal audit and management review have been completed - followed by a Stage 2 audit that seeks evidence of implementation and effectiveness, largely through interviews, records and sampling.
Findings and lifecycle
Findings are typically graded as major nonconformity (a requirement not met, or a systemic breakdown), minor nonconformity, or opportunity for improvement. You respond with root cause, correction, corrective action and evidence; the certification decision is made independently of the audit team. Certificates run on a three-year cycle with surveillance audits at least annually and a recertification audit before expiry.
Preparing properly
Build an evidence matrix mapping each clause to documents, records, owners and sample evidence. Rehearse interviews with process owners. Confirm internal audit covered all clauses and that management review minutes show decisions. Have service reports, competence records, nonconformity logs and the improvement register to hand.
Worked example
At Stage 1 the auditor finds internal audit covered only the operational clauses, and management review has no input on risks or audit results. Reasoning: these are requirements of 9.2 and 9.3, so this is a major nonconformity and Stage 2 should not proceed until the gap is closed and evidenced - the organization cannot demonstrate the check-and-act half of PDCA.
Traps
Booking Stage 2 before internal audit and management review are complete; assuming consultant-written documents equal implementation; disputing findings instead of fixing the systemic cause; forgetting surveillance obligations; letting the certificate scope drift from the real service scope.