The 7 reasons businesses fail their ISO audit

Most businesses don't fail an ISO audit because they're careless. They fail because, somewhere along the way, the system got built for the certificate instead of the business. The manual reads well. The folders are full. And then the auditor spends an hour on site and the gap between the document and the day-to-day work does the rest.

I audit these systems for a living, and the same seven patterns come up again and again. None of them are paperwork problems. They're all signs of the same thing: a system that describes a business that isn't quite yours. Here are the seven, the list first, then the detail from the auditor's chair.

The seven reasons at a glance

1. The system describes a business that doesn't exist. The manual and the real work don't match.
2. Internal audits that never really happened. No dates, no findings, no follow-up (clause 9.2).
3. Management review is missing or hollow. No data in, no decisions out (clause 9.3).
4. The legal and compliance register is out of date. Obligations identified once, never evaluated again.
5. Objectives with nothing to measure. "Improve safety" isn't an objective (clause 6.2).
6. Corrective actions closed without a root cause. Fix the symptom and the finding returns (clause 10.2).
7. Nobody below management knows the system exists. Awareness fails with the crew (clause 7.3).

Prefer the one-pager? The same seven live in the downloadable guide, with no email gate.

1. The system describes a business that doesn't exist

Manuals copied from a template or another company are the fastest route to a nonconformance. An auditor doesn't start with your manual. They start with your work. Within the first hour they'll ask a supervisor to walk them through a live job, then open your procedure for the same task and compare. The failing version: a procedure naming a safety committee that has never met, equipment you don't own and a document controller nobody can name, while the supervisor describes the job in different words. The moment the person and the paper disagree, the paper loses. What good looks like is plainer and far more durable: short procedures written from how the work actually happens, in the language your people already use, covering the risks your sites actually carry. A step that only exists to look impressive in the manual will fail you on audit day.

2. Internal audits that never really happened

Internal auditing is mandatory under clause 9.2, not optional. The auditor asks three things: show me the audit programme, show me the last reports, and show me what happened after the findings. The failing answer is a stack of checklists completed the week before the certification audit. Every box "compliant", no findings, nothing followed up because nothing was found. That convinces no one. Real internal audits leave a trail: a programme spread across the year and weighted toward the riskier parts of the business, reports with dates and named auditors, findings genuinely raised, and records showing what was done about each one. And a note from the chair: an internal audit that never finds anything isn't reassurance. Every real system has something worth fixing, and your records should show you finding it first.

3. Management review is missing or hollow

Clause 9.3 asks for specific inputs and outputs, not a meeting for its own sake. In: audit results, incidents and performance data, progress on objectives, risks and resource needs. Out: decisions and actions, with owners. The auditor asks for your last review and reads it. The failing version is a one-line minute saying "all good, no changes", or a review that hadn't happened in two years, suddenly dated the week before the audit. Neither survives a single question. The review exists to show leadership actually looks at the system and steers it. What good looks like doesn't need to be elaborate: a standing agenda mirroring the clause 9.3 inputs, honest minutes, decisions recorded with a name and a due date beside each, and at the next review, evidence those decisions happened. Half a page that's true beats twenty pages of theatre.

4. The legal and compliance register is out of date

Every management system rests on knowing what the law, your licences and your contracts require of you. The auditor's questions are simple: which obligations apply, when did you last check, and how do you know you're meeting them? The failing answer is a register dated years ago, still citing superseded regulations, with no owner and no review date. Obligations identified once and never revisited. For ISO 14001 and 45001 there's a second layer: clause 9.1.2 requires you to evaluate compliance, and knowing a rule exists isn't the same as showing you meet it. What good looks like: a register with a named owner and a review cycle, each obligation tied to real evidence: the licence that's current, the inspection that was done, the monitoring result that's in range.

5. Objectives with nothing to measure

"Improve safety" isn't an objective. It's a hope. Clause 6.2 asks for objectives you can plan and measure, and an auditor tests them with three questions: what are you trying to achieve, how do you measure it, and what are you doing about it? Most systems can't answer the second one. The failing version is a poster of aspirations with no numbers behind it, a measure nobody has collected data for since the system was written, or an objective with no owner and no plan. What good looks like is small and concrete: a handful of objectives, each with a measure you genuinely track, a plan with actions and resources, a named owner and a review date, and the results turning up in management review. Three real objectives, measured and moving, beat a page of ambitions every time.

6. Corrective actions closed without a root cause

The auditor will pick a nonconformity or an incident and ask you to walk them through what you did. The failing file reads: root cause: "worker didn't follow the procedure"; action: "worker retrained"; closed the same day. Fix the symptom, close the ticket, and the finding comes back, and repeat findings escalate, because they show the improvement loop under clause 10.2 isn't working. The real question is always why: why didn't the procedure fit the job, why wasn't it known, why couldn't it be followed on a live site? What good looks like goes past the person to the system: a root cause that names the real driver, an action that changes it, whether the procedure, the planning, the equipment or the training, and an effectiveness check weeks later to confirm it held. Show the why, not just the fix.

7. Nobody below management knows the system exists

Auditors talk to the crew, not just the office. At some point the auditor will stand beside a worker and ask plainly: what are the risks in today's task, which controls apply, where's the procedure, and what happens if the job changes? The failing answer is a blank look, or "there's a folder in the site office". Awareness fails under clause 7.3, and the credibility of everything else goes with it, because a system the workforce has never met isn't running the business. What good looks like isn't recitation: it's a crew who can explain the risks and controls in their own words, toolbox talks tied to the actual procedures, and inductions built around the person's real tasks rather than generic slides. It's as much a safety problem as a certification one. It's the same gap we close in WHS and safety consulting work for businesses not chasing a certificate at all.

The thread running through all seven

Each of these is a symptom of the same disease: a system built to get the certificate rather than to run the business. Build it the other way around, so the documents describe how the work actually happens and the records fall out of doing the job, and the audit largely looks after itself. That's the logic behind our approach to ISO certification: build the system to be certification-ready because it's real, not because it's impressive on paper.