I once watched a certification auditor spend three days at a plant and not find a single nonconformity. The quality manager was delighted. The plant manager was relieved. The certificate was renewed. I was there as an observer, preparing to take over the quality function, and I found seventeen nonconformities in my first week. Not because I was smarter. Because the auditor had not looked.
Your certification auditor is the most important external relationship in your quality system. Not because they are the most knowledgeable — often they are not. But because their assessment determines whether your certificate is credible or decorative. And the range of quality among certification auditors is staggering.
The auditor spectrum
In twenty years, I have worked with auditors who were genuinely transformative — people whose observations improved the quality system more than any consultant I could have hired. And I have worked with auditors whose primary contribution was showing up on time and signing the certificate. The difference is not experience. I have seen twenty-year veterans who were checklist tourists and relatively new auditors who dug deep and found things that mattered.
The spectrum runs roughly like this:
The checkbox auditor. Follows the standard clause by clause. Checks whether documents exist. Checks whether records are maintained. Checks whether the process is defined. Does not check whether the process works. This auditor will certify a system that is perfectly documented and completely dysfunctional. They are the most common type.
The process auditor. Follows the process, not the clauses. Picks a product or a process and traces it from start to finish. Looks for gaps between the described process and the actual process. This auditor finds more meaningful nonconformities because they are looking at reality, not documentation.
The systems thinker. This is the rare auditor who understands that nonconformities are symptoms, not causes. When they find a gap, they trace it upstream to the system condition that produced it. Their reports do not just list findings — they describe the systemic weaknesses that the findings reveal. This auditor makes your quality system better. There are perhaps five of these in any given country.
An auditor who finds nothing is not confirming that your system is perfect. They are confirming that their method is inadequate.
How to evaluate your auditor
You choose your certification body, but you often do not choose your auditor. They are assigned to you. And once assigned, they tend to stay — auditors develop familiarity with your site, and both parties prefer continuity. This means that if you get a poor auditor, you may be stuck with them for years.
Here is how I evaluate whether an auditor is adding value:
Do their findings surprise me? If every finding is something I already knew about, the auditor is not finding anything new. If their findings reveal problems I was not aware of, they are doing real work. The value of an external auditor is independent perspective. If the perspective is the same as mine, I did not need them.
Do they trace causes or just symptoms? When the auditor finds a nonconformity, do they stop at "the record was not maintained" or do they ask "why was the record not maintained, and what does that tell us about the system?" The former is reporting. The latter is auditing.
Do they understand your industry? An auditor who has never worked in automotive does not understand PPAP, doesn't grasp the implications of a customer-specific requirement, and cannot assess whether your control plan is adequate. They can audit the ISO framework, but they cannot assess the operational quality system. For manufacturing, you need an auditor who has been in a plant.
The time I had to push back
I had a certification auditor who issued a major nonconformity because the internal audit programme did not cover every process every year. This was technically incorrect — the standard requires a risk-based audit programme, not a blanket annual coverage. The auditor was applying an outdated interpretation from a previous edition of the standard.
I did not accept the finding. I pushed back, respectfully, with the standard text and a rationale for our risk-based approach. The auditor held firm. I escalated to the certification body's technical reviewer. After a review, the finding was reclassified as an observation. The auditor was replaced the following year.
This is the part nobody tells you about auditors: you can push back. You can challenge findings. You can request a different auditor. You can change certification bodies. Too many organisations treat the auditor's word as gospel and accept findings they should contest. The audit is a professional service. You are the customer. You have the right to competent, knowledgeable, value-adding service.
The bottom line
Your certification is only as credible as the auditor who issued it. A certificate from a checkbox auditor is a piece of paper. A certificate from a systems thinker is evidence that your quality system has been stress-tested by someone who knows what to look for.
When I audit a supplier, the first question I ask is: who is your certification body and who is your auditor. The answer tells me more about the reliability of their certificate than the certificate itself. Choose well. Push back when you should. And if your auditor finds nothing, find a new auditor.
