How to Prepare Your Lab for a Third-Party Audit: A 6-Week Plan

You have a date on the calendar: a certification audit, an accreditation assessment, or a customer audit. Six weeks feels like plenty until you start pulling records. This guide is for QA managers and lab leads at food, cosmetic, supplement and environmental testing labs. It gives you a week-by-week plan for lab audit preparation, so you go into audit day knowing where your gaps are and what you have already done about them.

Short answer: Spend the first two weeks confirming the audit scope and the exact standard and edition, then reviewing your system against it. Spend weeks three and four fixing documents, records and training gaps. Use week five for a mock audit and week six for closing findings and logistics. Preparation improves your readiness. The auditor, certification body or accreditation body still makes the decision.

Most audit surprises come from preparing against the wrong document. "ISO audit" or "GMP audit" is not a scope. Confirm in writing which document the auditor will use, for example:

• ISO/IEC 17025:2017 for testing and calibration lab accreditation (common for environmental and food testing labs; environmental labs may also be assessed to the TNI Environmental Laboratory Sector standard)
• SQF Food Safety Code, Edition 9 for current audits, with Edition 10 audits expected no earlier than January 2, 2027, subject to GFSI benchmarking
• 21 CFR Part 117 (human food CGMP and preventive controls) or 21 CFR Part 111 (dietary supplement CGMP), when a customer audit checks regulatory compliance
• ISO 22716:2007 (cosmetics GMP guidelines) for cosmetic sites
• a customer's own supplier-audit questionnaire

Ask for the audit agenda, the audit type (initial, surveillance, recertification or customer), the areas in scope, and any prior findings that will be followed up. Under ISO/IEC 17025, for example, assessors typically follow up on whether earlier findings were closed effectively.

Week 1: Scope and team

1. Confirm the standard, edition, audit date, auditor and agenda in writing.
2. Name one coordinator and an owner for each area (sampling, testing, EM, documents, training, equipment).
3. Pull the previous audit report and your open CAPAs (corrective and preventive actions).
4. Book the people who must be on site on audit day.

Week 2: Gap review

1. Walk through the standard clause by clause, or the questionnaire line by line, and note where your evidence lives.
2. Mark each item as "evidence ready," "evidence incomplete" or "missing."
3. Sample real records, not just SOPs: pick a few recent test reports or batches and trace them end to end.
4. Use our Pre-Audit Verification Checklist as a starting list for data integrity, environmental monitoring and documentation checkpoints.

Week 3: Documents and records

1. Check that SOPs are current, approved and match how work is actually done. Revise through document control, not by hand edits.
2. Confirm the master list of controlled documents is accurate and obsolete versions are withdrawn.
3. Check records for completeness, legibility and correction practice (single-line corrections, initialed and dated; audit trails on for electronic systems). For electronic records at FDA-regulated sites, 21 CFR Part 11 may apply.
4. Confirm retention times. Under 21 CFR Part 117, for example, records must be kept at least 2 years (21 CFR 117.315(a)(1)). Dietary supplement records under Part 111 have their own retention rule; check 21 CFR 111.605.

Week 4: People, equipment and methods

1. Review training records and competency assessments for every analyst who signs results.
2. Check calibration and maintenance records for balances, pipettes, incubators, thermometers and autoclaves, and confirm nothing is overdue on audit day.
3. Confirm media and reagent records: lot numbers, receipt dates, expiry and growth-promotion or QC results where your method requires them.
4. For accredited methods, check method verification or validation records and proficiency testing results. ISO/IEC 17025:2017 expects labs to monitor the validity of their results, which often includes proficiency testing.

Week 5: Mock audit

1. Have someone not involved in the work run a mock audit against the same standard, ideally in the same format as the real audit.
2. Include a trace exercise: pick one result or lot and follow it from sample receipt to report.
3. Practice interviews. Analysts should be able to explain what they do and show where the procedure is, without guessing.
4. Write the mock findings up the way an auditor would, with the requirement, the evidence and the gap.

Week 6: Close, confirm, prepare logistics

1. Close what you can. For what you cannot close, document the root cause, the plan, the owner and the date. An honest open CAPA with a plan is better than a rushed fix.
2. Re-check that corrected records and revised SOPs are approved and in use.
3. Prepare a document room or shared folder, a contact list, and an opening-meeting summary of your scope.
4. Brief staff: answer the question asked, show the record, and say "I'll find out" rather than guess.

• Preparing to the wrong standard or an outdated edition
• Reviewing SOPs but never tracing real records against them
• Backdating, rewriting or "cleaning up" records. Correct records transparently instead.
• Treating every gap as equal instead of fixing food-safety, data-integrity and result-validity gaps first
• Closing CAPAs with "retrained staff" and no effectiveness check
• Skipping the mock audit because "we know the system"

This is an illustrative scenario, not a client case. A small food testing lab has an ISO/IEC 17025 surveillance assessment in six weeks. In week 2, a trace exercise finds that one incubator's temperature log has gaps on weekends. In week 3 the lab documents the gap, assesses which results could be affected, and adds a continuous data logger with alarm checks to the SOP. In week 5 the mock auditor confirms the new records exist and asks how the impact assessment was done, so the lab adds that reasoning to the CAPA record. On audit day the lab can show the finding, the assessment and the fix.

Outside help makes sense when you have not been audited to this standard before, when your last audit left repeat findings, when your team is too close to the system to spot gaps, or when six weeks is not enough internal time. Micro-Core's laboratory auditing services include gap reviews and mock audits against the standard you name. You can start with the free pre-audit checklist. We help you prepare; the auditor, certification body or accreditation body makes the decision.

Is six weeks enough to prepare for a lab audit?

For a lab with a working quality system, six weeks is often workable for finding and fixing documentation and record gaps. It is not enough to build a quality system from scratch or to generate months of missing records. If the gap review in week 2 shows large missing pieces, talk to the auditor or customer early about timing.

What's the difference between a mock audit and an internal audit?

An internal audit is a planned, recurring check of your own system, often required by the standard you follow (management-system standards such as ISO/IEC 17025 and the SQF Code include internal-audit requirements; check your standard's clause). A mock audit is a rehearsal of a specific upcoming external audit, run in the same format and ideally by someone independent of the work.

Should we fix every gap before the audit?

Fix the gaps that affect food safety, product safety, data integrity or the validity of results first. For the rest, a documented root cause and a dated corrective action plan shows the auditor your system is working. Do not create records after the fact to fill gaps.

Does passing a mock audit guarantee we'll pass the real one?

No. A mock audit lowers the chance of surprises, but the auditor samples different records and may interpret requirements differently. The certification or accreditation decision belongs to the auditing body.

This article is general information, not regulatory or legal advice. Requirements depend on your products, markets and certifying bodies. Confirm against the current edition of each standard. No consulting engagement guarantees a regulator, customer, auditor or certification decision.

Request a consultation · Download the Pre-Audit Verification Checklist

1. ISO/IEC 17025:2017 (Edition 3; confirmed 2023), General requirements for the competence of testing and calibration laboratories: https://www.iso.org/standard/66912.html ↗
2. TNI standards: https://nelac-institute.org/content/CSDP/standards.php ↗
3. SQFI, Which Code Edition Should I Use: https://www.sqfi.com/the-sqf-code/comply-with-the-code/which-code-edition-should-i-use ↗ and Edition 10 FAQ: https://www.sqfi.com/the-sqf-code/comply-with-the-code/edition-10-faq ↗
4. 21 CFR Part 117: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117 ↗ ; 117.315 record retention: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-F/section-117.315 ↗
5. 21 CFR Part 111: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111 ↗
6. 21 CFR Part 11: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11 ↗
7. ISO 22716:2007 (Edition 1; confirmed 2022), Cosmetics GMP guidelines: https://www.iso.org/standard/36437.html ↗