Audit readiness: what happens when an inspector or a customer arrives at the gate

Establish which rulebook the visitor is applying

Preparation goes wrong when a site prepares generically. A customer auditing to their own supplier standard, a certification body assessing a management system, a notified assessment body examining product documentation and a public inspector checking legal compliance each look at different things and accept different answers. Ask in advance what scope, which standard or regime, which products and which time period will be covered, and who will attend. That conversation also tells you what to gather, and a visitor who will not answer it is unusual enough to be worth noting.

The document pack and the retrieval test

Most external audits open with a request for a defined set: organisation and responsibilities, current certificates and permits, procedures relevant to the scope, records for a named period, training and competence evidence, calibration status, complaint and non-conformity history, and evidence of management review. The failure mode is rarely absence; it is a document controller who has to hunt through three systems and a filing room. Run a timed retrieval rehearsal on genuinely random requests, including records from a period covered by a superseded system, which is where the delay always appears.

Who speaks, and what they should not do

Auditors form a view of the operation partly from how staff answer. The two damaging patterns are guessing and over-answering: an operator inventing a plausible reason, or a manager volunteering material about a different area that opens a new line of enquiry. Brief people to answer what is asked, from what they actually know, and to say they will find out otherwise. Assign a host who tracks every request and every commitment made, because the closing meeting is much easier when somebody has a running list rather than a memory of the day.

Findings, response windows and what escalation looks like

Expect findings; a spotless audit of a working factory invites scepticism. What matters is the response: a corrective action addressing cause rather than symptom, evidence the auditor can verify, and delivery within the window set by the scheme or the authority. Unresolved findings escalate differently depending on who raised them — a certification body can suspend, a customer can withhold new business, an inspector can use statutory powers. Knowing the escalation path in advance helps a management team allocate effort proportionately rather than treating every observation as an emergency. Agreeing realistic dates at the closing meeting beats promising a timescale you will visibly miss.

The gap between internal audit and this

Internal auditing exists to find problems and belongs to the quality system rather than to compliance readiness; using it only as a dress rehearsal for external visits wastes it. Where the two connect is coverage: if internal audits have never examined an area an external party will assess, that area is unknown territory. Since the applicable standard, powers and consequences depend entirely on who is visiting and under what authority, confirm expectations with the scheme owner or the regulator concerned rather than generalising from the last audit you hosted. Auditors also notice when internal findings never reappear in the corrective action record.

Frequently asked questions

How much preparation is reasonable before an announced audit?

Enough to have current documents in one place, records retrievable, staff briefed on scope and any known gaps identified with a plan attached. What is not reasonable, and is usually detected, is manufacturing evidence for the visit: backdated records, procedures written the week before, or a site cleaned to a standard it will never hold again. Experienced auditors probe consistency between documents and practice, and a site presenting an unfamiliar version of itself tends to unravel under questions.

Should we tell an auditor about a problem they have not found?

Where the issue is known, being investigated and has a documented action underway, raising it generally builds credibility, because the auditor sees a system that detects its own problems. Concealment carries the greater risk: a discovered issue that management clearly knew about turns a technical finding into a question about integrity. For matters with legal exposure, take advice on how and what to disclose before the visit rather than deciding at the table.

What is different about an unannounced regulatory inspection?

There is no preparation window, the visitor may have statutory powers of entry and to take records or samples, and the scope can widen based on what is observed. Readiness therefore means the ordinary state of the site rather than a prepared state: current documentation in use, records filed as work happens, and a defined procedure for reception to notify the right manager immediately. Confirm the powers and expected conduct with the relevant authority so staff are not improvising.