« Mock audit », « pre-audit », « dry run »: the wording varies, the request never does. A company aiming for ISO 9001 certification, or dreading its recertification, wants to know what an external auditor will find before he finds it. The exercise is useful, but only under precise conditions, and most disappointing mock audits fail on the same four.

What a mock audit is not

It is not a second internal audit. The internal audit required by clause 9.2 of ISO 9001:2015 tests your system against the standard and against your own rules; it is planned, known, and carried out by people from the house. A mock audit tests something else: your organisation against the way a certification body will audit it. It is not the same angle, and that is why a system that passes its internal audits with no findings can come out of a mock audit with a dozen.

No standard requires a mock audit. Not doing one is not a nonconformity, and nobody will ask you for evidence of it. It is a preparation practice, and it is judged only on what it teaches you.

The four conditions that make it worth doing

A badly set up mock audit produces a reassuring report and no information. Four conditions separate it from a courtesy visit.

  1. The auditor did not write the system. This follows directly from clause 9.2.2 c), which asks that the selection of auditors and the conduct of audits ensure the objectivity and impartiality of the audit process. Someone auditing the manual they drafted reads what they meant to write, not what is applied.
  2. The sample is not announced in detail. The scope and the programme are shared, of course. The files, batches, workstations and records that will be asked for are not. An audit whose list of documents is known in advance measures the ability to prepare a list.
  3. Interviews go down to the operators. The most common certification finding is not in the documents, it is between what the procedure describes and what the person actually does. That gap only shows at the workstation, by asking the person who works it.
  4. Findings are written as they would be in certification. A dated fact, the clause concerned, the evidence observed, and a wording that holds up when challenged. A finding written in the style of an internal note prepares you for nothing.

What it tests that an internal audit does not

Three things, and they are rarely the expected ones.

How long it takes to produce the evidence. In certification, a record that takes twenty minutes to find counts as a record that cannot be found. A mock audit measures that real delay, at a real workstation, with the person who will have to produce it on the day.

The consistency between what is said and what is done. A control procedure calling for three checks where the operator does two and justifies it perfectly is not an operator problem: it is a procedure describing work that nobody does. A mock audit is the chance to discover that without it costing a finding.

How the closing meeting is handled. That is the moment when an unprepared team turns a minor finding into a discussion, and a discussion into a major. Listening to a finding, asking for the evidence behind it, and accepting or challenging it on facts is something you learn by doing it once.

When to schedule it

Early enough to correct, late enough for the system to have run. Two symmetrical mistakes: the mock audit a fortnight before certification, which leaves time to correct only the formatting of documents, and the mock audit six months before, on a system that has not yet produced records and where nothing can therefore be checked. Two to three months leaves time to act on causes, which is the only kind of correction that survives to the real audit.

For a recertification the reasoning changes: what matters is having gone through a full cycle, with a management review and an internal audit, because that is precisely what the body will come to check.

What to do with the findings

Mock audit findings are not nonconformities in the sense of your system: they do not open your nonconformity process, and they have no business feeding your indicators. They feed a dated action plan, with an owner per line, and that is all.

The trap fits in one sentence: a finding corrected by changing a document rather than a practice will come back at certification, unchanged. If the mock audit shows the procedure calls for three checks and the workstation does two, the question to settle is which of the two descriptions is right, not which is quicker to rewrite.

The conduct standard is the same one

A mock audit is conducted to ISO 19011, like an internal audit and like a certification audit: same principles, same sequence, same demand on objective evidence. That is what makes the exercise representative, and it is also what lets you have it carried out by someone whose competence you can verify. On auditor grades and what to expect of each, see the three levels of ISO auditor; on how a finding is worded, passing the quality auditor exam sets out the exercise.

HEMC carries out internal audits and mock audits to ISO 19011: see our audit services.