Quality · 30 May 2026 · 6 min read

ISO 9001 audit prep: three days of dread, or three hours?

There's a specific kind of dread that lands on a UK precision shop three times a year: the surveillance audit. You always pass. It's the three days before the auditor walks in that are the problem.

You know they're coming a fortnight out. You know what they'll ask for. You know roughly where most of it lives — and "roughly" is the operative word. The NCRs are partly in a Word folder, partly in the quality manager's notebook, partly buried in customer email threads. The FAI evidence for that bracket job back in March is in somebody's inbox. Calibration certificates are in the metrology cabinet. The CAPAs are "we definitely did one of those, give me a minute."

You'll pass. You always pass. But the prep is folder archaeology, and it's hell.

Passing isn't the point — the prep is the cost

Here's roughly how a typical prep week goes, and it's the same in most shops I've spoken to:

• Monday: pull the NCR folder, try to remember which jobs had which non-conformities, cross-check against the defects pad. Search the inbox for "FAI" — some have PDFs attached, some don't; for the ones that don't, you ring the customer and ask, which is awkward.
• Tuesday: CAPAs. Open each one, verify the effectiveness check was actually done. A few weren't — quietly do them now. Customer complaints — some never got formally closed. Close them now. Internal audit this quarter — did we…? Phone the consultant.
• Wednesday: print 200 pages, tab the binders, pray.

Three days where nobody's running the shop. Multiply by three audits a year. You don't need a fabricated industry stat to feel the weight of that — do the arithmetic for your own shop: your prep days, times your senior cost-per-day, times three. Whatever number you land on, it's rarely small, and it's almost never free time.

Why it takes three days

The honest root cause isn't laziness or a bad quality manager. It's that the records get created after the fact, in separate places, with nothing linking them together. The defect gets written on a pad and typed up later (maybe). The NCR lives in one system, the job in another, the calibration in a spreadsheet, the complaint in email. So when the auditor asks "show me the CAPA for the March bracket non-conformity," answering it means walking between four systems and a filing cabinet to reassemble a story that was never stored as one.

Fix that root cause and the three days collapse on their own.

What makes it three hours instead

This is the part we built DMOS around. Three principles do all the heavy lifting — and none of them is magic, they're just discipline the system enforces so you don't have to remember to.

1. Capture at source

When a defect happens on the floor, the operator logs it there and then — component, description, cause, quantity, photo — and it's automatically stamped with the job, the part-revision, the machine, the operator and the exact time. No Word doc to fill in later. No pad to lose. The evidence exists at the moment the event happens, not when someone remembers to write it up.

2. Linkages the system enforces

Promote that defect to an NCR and it inherits the job, part-revision, machine and operator automatically — no re-typing, no transcription errors. Raise a CAPA off the NCR and it's linked to it; the NCR is linked to the defect, the defect to the job, the job to the customer. When the auditor asks for the trail, it's a few clicks, not forty-five minutes of folder-flipping — because the chain was stored as a chain in the first place.

3. The audit-ready export

When the audit's on the horizon, one button bundles the period's NCRs (open and closed), the CAPAs with their effectiveness-check status, the FAIs with characteristic-level evidence, the calibration register, the customer complaints with resolutions, the internal-audit findings, training records and document version history — into a single clause-sequenced PDF. The prep becomes reviewing that pack for an hour, not building it from scratch over three days.

Why I built this

I'm not writing this as a software vendor who read about audits. I ran a UK precision-machining shop for years, and I did audit prep the old way — the folder week, the quiet closing of CAPAs, the binders. DMOS is the operating system that ran that shop, turned into a product. The QMS module exists because I needed it, refined over real audits and real non-conformities, not because it looked good on a feature list.

That's also why I won't dress this up with a fictional ROI table. If audit prep is eating senior days three times a year, taking the folder-archaeology out of it gives those days back — and a quality system that's lived rather than performed is a calmer audit. Run your own numbers against the Pro tier (£149/month) and decide whether that trade is worth it for your shop.

The honest objections

• "We're too small." If you're ISO 9001 certified, you're not too small — DMOS is built for 5–30-person shops.
• "My QM won't change tools." Fair. The floor screen takes about twenty minutes to learn; the full QMS module a couple of hours. The test is whether it's less work than the pad-and-Word routine — for capture-at-source, it is.
• "We've too many old records to migrate." You don't migrate them. DMOS records everything from go-live; your historical paper stays as reference. You're not digitising the past to comply going forward.

If your next ISO 9001 surveillance is more than 90 days out, you've got the runway to make the next one a check-in instead of a defence.