There are three main types of quality system audits for enterprises manufacturing hardware structural components: third-party audits conducted by certification bodies (for ISO 9001 or IATF 16949 certification), second-party audits conducted by customers (factory inspections), and internal audits conducted by the enterprise itself. Regardless of the type, the core logic regarding “how to prepare and how to respond” remains the same: the system must be genuinely operational, and tangible evidence must be available.
This article breaks down the entire process, focusing primarily on the ISO 9001 certification audit.
I.
Two Stages of Certification Audits: Stage 1 and Stage 2
Initial ISO 9001 certification typically involves two stages: Stage 1 is a readiness assessment or document review (which can be conducted remotely). Auditors examine the system scope, policies and objectives, the completion of at least one round of internal audits, the execution of management reviews, and awareness of laws and regulations to confirm that you are “ready.” Stage 2 is an on-site implementation audit; auditors verify—through sampling—whether documented processes are actually being followed, whether records are complete, and whether personnel understand their job requirements. The outcome of Stage 2 determines whether certification is granted.
Findings from Stage 1 serve as a “free early warning,” and any issues identified must be rectified before Stage 2 takes place.
II. Classification of Non-conformities and the Closed-loop Corrective Action Process
Audit findings fall into three categories: Major (Major Non-conformity)—indicates the complete absence or systemic failure of a required process, preventing certification issuance; typically requires submission of a containment plan within 5 working days and completion of root cause analysis, corrective actions, and effectiveness verification within 30–90 days, potentially necessitating a dedicated follow-up audit. Minor (Minor Non-conformity)—represents an isolated deviation that does not block certification but requires the submission and verification of a corrective action plan within the certification body’s specified timeframe. Observation—indicates a potential risk that does not yet constitute a non-conformity; while no formal response is required, these often serve as precursors to escalation into non-conformities in future audits.
Remediation must follow a closed-loop process of “root cause analysis → correction → verification”;
simply retroactively filling in records without modifying the actual process renders the effort futile.
III. Audit Focus Checklist for Hardware Structural Component Manufacturers
- Inspection Records: Complete records for incoming material, in-process, and finished product inspections; actual measurements of critical dimensions and sampling quantities must match recorded data; traceability by batch (or order number) is required.
- Process Control: Process parameters (pressure, temperature, time, speed) for stamping, welding, and heat treatment must be clearly quantified and recorded; monitoring records must exist for special processes.
- Metrology and Equipment: Measuring tools and gauges must be within their calibration validity period and clearly labeled; calibration logs and schedules must be maintained; equipment must have records of routine checks and maintenance—a single expired measuring tool can constitute a major finding.
- Traceability Drill: Random checks of product batches must allow for both forward and backward tracing to material lots, personnel, equipment, and inspection data; batches must be uniquely identified with no mixing or misidentification.
- Statistical Techniques: Provision of SPC control charts/Cpk and MSA (Measurement System Analysis: Gauge Repeatability and Reproducibility) records when required by the customer; automotive components also require a PPAP (Production Part Approval Process) package and a reaction plan.
IV. How to Prepare for Customer Factory Audits (Second-Party Audits)
Customer audits focus primarily on your ability to ensure stable supply. Key areas include: on-site 5S and clear identification/segregation of work-in-progress, semi-finished goods, and defective items; use of the latest work instructions with strict employee adherence; complete records of critical process parameter monitoring; documented customer authorization for the acceptance of non-conforming products under concession; and comprehensive equipment maintenance records.
On the day of the audit, arrange for appropriate accompanying personnel and have the relevant documents ready according to the audit route. Avoid “last-minute record filling”—experienced auditors will quickly spot inconsistencies when asking for details.
V.
Practical Recommendations
Make audit preparation a routine practice rather than a sporadic “campaign.” Conduct internal audits according to the annual plan with genuine inspections and corrective actions (internal audits and management reviews are mandatory items for Stage 1); ensure version control for external documents and work instructions;
and maintain a rolling monthly update for the metrology and calibration log. Industry experts summarize it this way: quality system audits “examine habits, not just documents.” If daily operations are solid, the audit is simply a demonstration;
if you rely on last-minute rushes, the audit will expose the reality of the shop floor.
