External Audits: Process, Preparation, and the Most Common Mistakes

An external audit decides whether you keep your certificate, whether customers trust you, and often whether you win specific contracts. Yet preparation is routinely underestimated - leading to findings that could easily have been avoided with a bit of lead time. This article walks through the typical process and the most common pitfalls.

What Is an External Audit?

An external audit is conducted by an independent party - usually an accredited certification body or a customer running a supplier audit. Unlike an internal audit, an outside party assesses whether the organization actually meets the requirements of a standard (e.g., ISO 9001, IATF 16949) or contractually agreed criteria.

The Typical Process

1. Audit announcement and planning. Date, scope, involved departments, and a rough schedule are agreed - usually weeks in advance.
2. Document review (Stage 1 for initial certification). The auditor checks beforehand or at the start whether the quality manual, process descriptions, and records are fundamentally compliant.
3. On-site (or remote) audit execution. Interviews with process owners, walkthroughs, and sampling of records. The auditor works through a question catalog aligned to the standard’s clauses.
4. Findings and closing meeting. Deviations are classified - typically as major nonconformity, minor nonconformity, or observation - and presented in the closing meeting.
5. Action plan and follow-up. Every finding requires a documented root cause, corrective action, and a target date for effectiveness verification.

The Most Common Preparation Mistakes

Missing links between evidence and standard clauses. If process owners have to search for minutes to find which document satisfies which requirement, it doesn’t just look unprofessional - it lengthens the audit and increases the risk of findings.

Internal audits treated as a box-ticking exercise. Internal audits performed purely pro forma fail to surface the weaknesses that later show up in the external audit.

Outdated or inconsistent documentation. Process descriptions that no longer match actual practice are one of the most common causes of findings - not because the process itself is wrong, but because documentation and reality have drifted apart.

Unprepared subject-matter teams. Auditors don’t just interview the quality team; they talk to people in production, procurement, or sales. If those employees can’t explain their own process in their own words, it quickly signals immature processes.

Open actions from the last audit. Nothing stands out more negatively than a corrective action from last year that is still not closed.

How to Prepare Properly

• Run an internal mini-audit of the most likely focus areas 4-6 weeks before the external audit.
• Make sure every finding from previous audits is demonstrably closed, including effectiveness verification.
• Brief subject-matter teams shortly before the audit - not just on content, but on the process itself, so nobody is caught off guard.
• Keep evidence organized so it can be traced to the relevant standard clause in seconds, instead of being assembled during the audit itself.

The actual audit execution - including structured capture of findings during the live session - is described in the qportal documentation on conducting fieldwork.

To stop “open actions from the last audit” from becoming a problem in the first place, it’s worth looking a level up: our guide to building an audit program shows how to factor prior-year findings into next cycle’s risk-based planning, while our article on findings management covers the path from finding to effectiveness check in detail. Organizations running SAP S/4HANA will also find our look at SAP QM and audit management useful for understanding why this kind of tracking often falls short in the standard module.

Conclusion

An external audit isn’t a surprise event - it’s the outcome of a year-round process. Organizations that consistently link evidence to the relevant standard clauses, take internal audits seriously, and close open actions without delay walk into every external audit with significantly less risk.