SGS common mistakes
SGS · Understand the traps and how to avoid them.
Citing ISO 19011 guidance clauses (e.g., "the auditor shall prepare a checklist") as if they were auditable requirements, or attaching the wrong clause number to a nonconformity (e.g., quoting 8.5.1 for a calibration failure instead of 7.1.5).
Candidates memorise clause lists and audit-guidance text in the same study block and then retrieve whichever clause number surfaces first under time pressure; they also conflate the certification standard with the guidance standard because both are 'ISO' documents.
What to do instead
Before writing any finding, re-open the standard index and confirm the clause text verbatim in the copy provided. Keep a one-page personal map of the audited standard's clause-to-intent structure, and mark clearly at the top of any notes that ISO 19011 is guidance and cannot itself generate a nonconformity.
Accepting an audit assignment covering a process the auditor previously managed, or continuing an audit after accepting a meal, gifts or hospitality from the auditee, without declaring it.
Candidates focus almost entirely on technical audit skill in preparation and treat ethics as 'common sense'; the familiarity and self-interest threats feel benign in the moment, and declaring them feels like admitting incompetence.
What to do instead
Run a written threat check at the start of every audit plan: self-review, familiarity, self-interest, advocacy, intimidation. If any applies, state it in writing to the audit programme manager and request reassignment or mitigation. Decline hospitality beyond what is offered equally to all staff and record the decision.
Auditing documents rather than processes: sitting in a meeting room for the whole audit reading procedures, work instructions and records, and marking a process 'conforming' because the procedure describes what should happen.
Document review is comfortable, controllable and produces a visible paper trail, whereas walking the process requires following material and information flows into unfamiliar areas with less predictable conversation.
What to do instead
Structure each process audit as: observe the process in operation first (go to the workplace), then interview the process owner and operators, then sample records to test what was observed. Use a 'turtle diagram' or process-flow template (inputs, outputs, sequence, controls, resources, measures) rather than a clause-by-clause checklist.
Recording 'the organisation has a risk register' as sufficient evidence of risk-based thinking, and never testing whether identified risks actually determine process controls, objectives, resources or monitoring.
The presence of a document is a fast, defensible-looking observation, and candidates are unsure how to audit an abstract concept without a prescribed record to point at.
What to do instead
Trace a line from risk to action: take two or three process risks, then verify a matching control in the process, a matching objective or KPI, and evidence the control is operating and monitored. Ask process owners what could go wrong and how they know it is controlled; compare their answer with the register.
Producing an audit plan that lists only clause numbers and elapsed hours, omits the audit criteria and scope statement, and allocates no time for opening/closing meetings, sampling, or travel between sites.
Plans are drafted from a template copied from previous audits, and candidates underestimate how long process walk-throughs and interviewing take, so the schedule is built to fill the form rather than to fit the audit.
What to do instead
Build the plan from the process map and the audit objectives: for each process, state the process owner, the clauses/criteria to be covered, the evidence to be sampled, the auditor, and a realistic start and end time. Block explicit slots for the opening meeting, daily review with the auditee, and the closing meeting, and keep contingency time in the schedule.
Sampling whatever record is nearest to hand - the last three files, or the ones the auditee volunteers - and never documenting how many items were available or why that selection was made.
Convenience sampling is fast and usually shows the process working, so it produces a smooth audit with no awkward challenge; candidates often do not know they are expected to justify sample design.
What to do instead
State the population size, the sample size, and the selection basis (random, stratified across shifts/sites/product lines, or risk-targeted) in the working documents. Deliberately include an edge case - a new starter, a returned item, an out-of-hours run - and record the rationale so the sample is defensible in the report.
Interrogating only the department manager and asking closed or leading questions such as 'you do verify the calibration before use, don't you?' rather than speaking with operators and asking open questions.
Managers are easier to locate, speak the language of standards, and give clean answers; leading questions are a nervous habit used to keep the interview moving and to avoid silence.
What to do instead
Follow the chain of activity to where the work is done and interview at least one operator per process. Use open stems ('walk me through…', 'show me how…', 'what happens when…') and then stay silent while the auditee answers. Reserve closed questions for confirming a specific fact after a broad answer.
Writing findings as opinions - 'the process is not well controlled' or 'documentation is poor' - with no objective evidence quoted, no audit criteria referenced, and no statement of what the requirement actually demands.
Candidates observe the symptom in the moment and write it up immediately, so the note captures their judgement rather than the evidence; the three-part structure (requirement, evidence, gap) is known but not practised under time pressure.
What to do instead
Write every finding in three parts: the exact requirement (clause and its sense), the objective evidence (document ID, date, sample size, observation, names replaced by role), and the resulting gap. Test it by asking 'could the auditee disagree with the evidence, or only with my interpretation?' If they can dispute the facts, the evidence is too vague.
Closing a nonconformity because the auditee 'retrained the operator' or 'reissued the procedure', without checking whether the root cause was identified or whether effectiveness of the action was verified.
Correction and corrective action are easily conflated in the language of the standard, and candidates want to sign off quickly during the follow-up window when the auditee reports that 'it's fixed'.
What to do instead
For each nonconformity, ask explicitly: what was the correction, what was the root cause analysis, what action addresses the cause, and how was effectiveness verified? Do not close until you have seen evidence of the effectiveness check (results, not a promise), and state the verification method and date in the follow-up record.
Treating a certificate, years of experience or a completed training course as proof of competence, and leaving the audit without evaluating its own performance or recording any continuing professional development activity.
Qualifications are visible and easy to tick off, while competence requires judging demonstrated knowledge, skill and personal behaviour; self-evaluation feels uncomfortable and is often skipped when the audit runs over time.
What to do instead
Assess competence against defined criteria covering knowledge, skill and personal behaviour, using evidence such as observed audit performance, reviewed reports and technical-specialist interviews - not certificates alone. At the end of each audit, record a short self-evaluation and one specific improvement action, and keep a CPD log tied to the sectors, standards and techniques you actually audit.