By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - the practical platform helping businesses achieve ISO 9001, ISO 14001, ISO 45001 and ISO 27001 through structured templates, AI-powered tools and real-world guidance. Having audited and implemented systems across multiple sectors, Russell understands exactly what causes audits to succeed - and what causes them to stumble.
One of the most common questions I hear before an audit is this:
“Can we actually fail?”
It’s a fair question. Audits can feel high-stakes. There’s pressure from clients, directors, and teams who’ve invested time building the system. Nobody wants to “fail.”
So let’s be clear about how it really works.
Yes, you can fail - but it’s not what most people think
An ISO audit is not like an exam where you score 49% and get sent home.
Certification bodies assess whether your management system:
- Meets the requirements of the standard
- Is implemented in practice
- Is effective
If there are gaps, the auditor raises nonconformities.
These are usually categorised as either minor or major.
A minor nonconformity means there’s a weakness or inconsistency - but the system fundamentally works.
A major nonconformity means something significant is missing or not implemented properly. For example, no internal audits have been conducted, or there’s no evidence of management review, or key controls simply don’t exist.
If major nonconformities are raised, certification is typically delayed until you address them.
That’s the closest thing to “failing.”
What actually causes audits to go wrong?
In my experience as both consultant and auditor, businesses don’t struggle because they lack paperwork.
They struggle when there’s a disconnect between:
- What the documented system says
- What actually happens in practice
For example:
If your procedure says supplier performance is reviewed annually, I will expect to see records of that review.
If your ISMS says access is reviewed quarterly, I will ask to see evidence of those reviews.
If your Quality Policy says you monitor objectives monthly, I’ll want to see how that’s done.
Auditors aren’t trying to trip you up. But they will test whether the system is real.
The biggest red flag in an audit isn’t a mistake - it’s inconsistency.
What doesn’t cause you to fail
Minor administrative errors rarely derail certification.
- An outdated template header.
- A training record missing one signature.
- A document formatted slightly differently.
Those things may be noted - but they won’t sink the system.
What matters is whether the framework is there, understood, and functioning.
How to avoid major issues
The businesses that move through audits smoothly tend to do three simple things:
First, they run proper internal audits before the external one. Not superficial reviews - but meaningful checks that test whether processes are being followed.
Second, they conduct management reviews that genuinely evaluate performance, risks and improvement - rather than copying and pasting last year’s minutes.
Third, they ensure their team understands the system. When staff can confidently explain how they do their job and how it links to ISO requirements, audits become conversations rather than interrogations.
A reality check from the audit side
As an auditor, I’m not looking for perfection.
I’m looking for evidence that:
- The organisation understands its risks
- It has appropriate controls in place
- It monitors performance
- It improves when issues arise
If those foundations are present, certification usually follows.
The only time audits truly fall apart is when the system exists only on paper.
So, can you fail?
Yes - if there is no real system.
No - if you’ve built something practical, honest and aligned with how your business actually operates.
The goal isn’t to impress an auditor. It’s to build a system that works every day - and can stand up to scrutiny when asked.
If you’re preparing for certification and want a structured way to build a system that passes audit because it genuinely works, you can explore The Compliance Companion here:
https://the-compliance-companion.co.uk/harness-the-future-of-iso