What documentation a stage 1 audit has to cover

Before an auditor ever sets foot in the applicant’s plant, someone at the certification body has already spent days reading: the manual, the procedures, the scopes, the org charts. The stage 1 desk review is the least visible work in the certification cycle — and one of the pieces that most shapes how stage 2 will go.

What a stage 1 has to produce

The purpose of stage 1 is not to find nonconformities: it is to confirm that the applicant’s system is ready to be audited, and to plan stage 2 with real information. Three things have to come out of it: confirmation of the scope, the areas of concern the audit team must dig into, and a stage 2 plan grounded in what the documentation actually revealed.

The problem is volume. An eighty-page manual, twenty procedures and a risk matrix per applicant — multiplied by every application that month. The reading cannot be skipped: every requirement of the standard has to be mapped against the documentation, and every gap documented before stage 2 gets scheduled.

Where the time goes — and where it shouldn’t

In practice, a stage 1 splits into three tasks: reading and mapping (the bulk of it), checking clause coverage against the standard, and drafting the report in the body’s accredited format. Only one demands professional judgment from start to finish: deciding what counts as an area of concern and what doesn’t. The other two are desk work that burns qualified auditors on tasks that don’t require their qualification.

That is where AI agents change the equation. An agent can read the full documentation, map it clause by clause and propose a draft report with the areas of concern prioritized — and the auditor reviews, corrects and decides. Days of reading become hours of review, and the judgment stays where it belongs. That is the whole remit of the Desk Review Agent: read everything, map it against the standard, and hand the lead auditor a draft with the areas of concern already ranked.

Stage 1 is not going away: it is a requirement and a good practice. What can go away is the part of it that treats a qualified auditor as a PDF reader.