Machine shops: what an audit looks like

ISO 9001 certification body (accredited)

Stage 1 and Stage 2 audits for the initial certificate, then surveillance and recertification audits against the quality management system. Existing ISO 9001:2015 clients also need a transition audit to the 2026 edition.

How often. Three-year cycle: surveillance audits in the first two years (about one-third of initial audit days per year in total) and a recertification audit in year three.

Source ↗

OEM customers (second-party supplier audits)

OEM buyers audit the shops they source from. ISO 9001 guidance notes it can be advantageous for a buyer to audit an intended provider to settle communication, product specifications and delivery parameters.

How often. No standard interval is published. The customer's supplier quality terms set the schedule.

Source ↗

OSHA, or the State Plan agency in a state-run program

Federal OSHA schedules inspections in priority order: imminent danger, fatality or catastrophe, complaints and referrals, then programmed inspections.

How often. No fixed interval. Employers report a work-related death within 8 hours and an inpatient hospitalization, amputation or loss of an eye within 24 hours.

Source ↗

OSHA 300 logs, 300A summaries and 301 incident reports

The compliance officer reviews three prior calendar years, plus total hours worked, average employees and a roster with job classifications and work areas. Copies must be produced within four business hours of the request.

OSHA Field Operations Manual (CPL 02-00-164), Chapter 3, Review of Records; 29 CFR 1904.40(a)Source ↗

Written hazard communication program, chemical list and safety data sheets

One written program per workplace describes labels, safety data sheets and employee training, and includes the list of hazardous chemicals. It must be available on request to employees and to OSHA.

29 CFR 1910.1200(e), (g), (h)Source ↗

Lockout/tagout procedures, training certifications and annual inspection records

Energy control procedures are documented. Training certification lists each employee's name and dates, and the periodic inspection certification identifies the machine, date, employees included and inspector.

29 CFR 1910.147(c)(4)(i), (c)(6)(ii), (c)(7)(iv)Source ↗

Quality policy, objectives and management review records

Auditors trace how the policy was communicated, whether objectives are measurable and cascaded, and whether management review outputs show decisions and actions.

ISO 9001 clauses 5.2, 6.2 and 9.3; ISO 9001 Auditing Practices Group paper on policy, objectives and management reviewSource ↗

Internal audit program, reports and follow-up

Auditors look at risk-based planning, auditor competence and impartiality, management involvement, and how audit results feed evaluation of the system.

ISO 9001 clause 9.2; ISO 9001 Auditing Practices Group guidance on internal auditsSource ↗

Competence and training records

Competence is determined for each role, gaps are closed, and the effectiveness of those actions is evaluated, with appropriate documented information retained as evidence.

ISO 9001 clause 7.2; ISO 9001 Auditing Practices Group guidance on competenceSource ↗

Approved external provider list and performance monitoring

Auditors check the up-to-date list of approved providers, orders placed against the defined criteria, monitoring of outsourced processes and the activities that confirm requirements were met.

ISO 9001 clause 8.4; ISO 9001 Auditing Practices Group guidance on external providersSource ↗

Evidence collected where the work happens

ISO 9001 auditor guidance says evidence is gathered at the place of the activity, preferably in real time, with samples across shifts and representative sites and processes.

People interviewed about the quality policy

Auditors interview staff to see whether they understand how the quality policy relates to their own work, and are told not to ask anyone to recite it.

Shop floor on the OSHA walkaround

The compliance officer walks the facility, interviews employees privately and reviews records. A partial inspection can expand when injury records, interviews or plain-view conditions point to other areas.

Outsourced processes and accepted exceptions

ISO 9001 guidance on external providers points auditors to outsourced processes in the supply chain, credit notes for rejected product and concessions that accepted previously rejected product.

Lockout/tagout (29 CFR 1910.147)

1,863 citations, rank 3 FY2026 (Oct 1, 2025 to Aug 31, 2026, preliminary)

Ranked third on OSHA's preliminary top 10 most frequently cited standards across all industries, ahead of respiratory protection and powered industrial trucks.

Source ↗

Hazard communication (29 CFR 1910.1200)

1,961 citations, rank 2 FY2026 (Oct 1, 2025 to Aug 31, 2026, preliminary)

Ranked second on the same preliminary list and the most cited general industry standard on it.

Source ↗

Machine guarding (29 CFR 1910.212)

1,072 citations, rank 10 FY2026 (Oct 1, 2025 to Aug 31, 2026, preliminary)

Tenth on the same list. OSHA publishes the list so employers can find and fix recognized hazards before an inspection.

Source ↗

ISO 9001 management review and internal audits

Rank 1 and 2 of 5 areas; PJR publishes no counts 2018 data, published 2021

PJR, an ISO 9001 certification body, mined its own audit data and ranked management review (clause 9.3) first and internal audits (clause 9.2) second among the five most commonly cited nonconformance areas, ahead of quality objectives, calibration and external provider controls.

Source ↗

Documented information in ISO 9001:2026

Global ACI describes new wording on documented information and a clarified statement that documented information shall be available. Clause 7.3 now adds awareness of organizational quality culture and ethical behavior.

Evidence the quality policy was communicated

Auditors collect evidence of effective dissemination of the quality policy and test awareness through interviews, so a record of how and when it reached each person gives them something to trace.

Written OSHA programs and who was trained

Lockout/tagout training certification must carry each employee's name and dates. Hazard communication training is due at initial assignment and when a new chemical hazard is introduced, and the written program must be available to employees on request.

PPE hazard assessment certification

A written certification must identify the workplace evaluated, the person certifying and the dates. If none exists, the compliance officer reads the OSHA 300 log to decide which protective equipment applies.