What a stage 1 report has to conclude

A stage 1 report that ends with a list of documents reviewed has not done its job. Stage 1 exists to answer one question — can this system be audited in stage 2, and if so, how — and the report has to say so in a way the lead auditor, the client and, later, the technical reviewer can all act on.

The four conclusions the report owes

The first is scope. Not repeating what the client wrote on the application, but confirming it against what the documentation actually describes: the sites, the processes, the products and services, and any exclusion with the justification the standard requires. A scope confirmed at stage 1 is a scope that will not have to be renegotiated during stage 2.

The second is readiness. There are a handful of things whose absence makes a stage 2 pointless: an internal audit that has actually been performed across the scope, a management review that has taken place with real inputs, and evidence that the system has been running long enough to produce records. A client with a beautiful manual and no internal audit is not ready, and saying so at stage 1 is cheaper for everyone than discovering it on site.

The third is the areas of concern: the clauses where the documentation is thin, ambiguous or inconsistent with what the client says it does. These are not nonconformities — stage 1 does not raise them — they are the questions stage 2 has to answer, ranked so the audit plan can allocate time where the risk is. The fourth is the consequence: whether stage 2 proceeds as planned, needs more days, needs a different competence on the team, or should wait.

Why the interval matters

The report also has to state the interval to stage 2, and give the client time to close what stage 1 surfaced. Leave it too short and the concerns arrive unresolved; leave it too long and the picture stage 1 painted is out of date, which in some schemes forces stage 1 to be repeated. Recording the reasoning for the interval you chose is part of the report, not an afterthought.

All four conclusions come out of the same reading, and the reading is the expensive part: hundreds of pages mapped clause by clause before anyone can say whether the system holds together. Doing that mapping completely rather than by sampling is where the Desk Review Agent earns its place — the conclusions are still the auditor’s, but they are drawn on the full document set instead of on whatever there was time to read.