ISO 9001 System Audit for Packaging Companies: 3-Step Preparation + 4 Common Rejection Issues

A printing factory in Wuxi that makes cosmetic boxes paid a consulting firm RMB 80,000 to coach them through ISO 9001 — yet on audit day they were still issued 4 non-conformities. After the auditor left, the owner called me, and his first words were: "We built the employee handbook — how could you still write up non-conformities?" I sent him the audit report: 3 of the 4 non-conformities were related to "records," and not a single one was about "the handbook being wrong." This is the most common misconception in ISO 9001 audits — believing that having documents in place means having a system in place.

An ISO 9001 audit is an on-site audit; documents are only a reference. What the auditor really checks is whether "your system is actually running." Below I'll share the practical lessons I've learned from guiding 7 printers through external audits.

3 Preparation Steps Before the Audit: 10× More Important Than Writing the Handbook

Step one: "walk through the process" — not "read through the handbook." The concrete action is: starting from the customer inquiry, follow a real order all the way to shipment. At every step, stop and ask yourself "Is this action recorded?" If the answer is verbal, WeChat, or just in the boss's head, you need to add a record. The core requirement of ISO 9001 is "controllable processes," and the credible evidence of "controllable processes" is records.

Step two: "pull the 3 most recent shipments for reverse traceability." One of the auditor's favorite questions is: "What were the customer's special requirements for this order? How did you confirm that your production met them?" If the order-taker can't explain, or the special requirements weren't archived in email, you'll almost certainly get a non-conformity.

Step three: "make sure frontline employees can explain their work." The auditor will definitely go to the shop floor and ask at least 2 frontline employees. One is a machine operator — "What did this machine print yesterday? Any abnormalities?" The other is a QC inspector — "How do you handle customer complaints? Who signs off after resolution?" If frontline employees can't answer, the auditor will directly issue a non-conformity for "insufficient employee competence and awareness."

4 Common Categories of Non-Conformities: The Traps Printers Fall Into Most

Category one: missing design and development records. Does the printer review the customer's artwork? Who signed off on the review? How many revisions? What changed in each revision? All of this must be recorded. At many printers, "design review" is just a salesperson sending a photo to the customer on WeChat saying "we can do it" — without even saving a screenshot. When the auditor sees no review records in the design department, they issue a non-conformity right away.

Category two: missing production process monitoring records. What printers most often lack are "first-article inspection records" and "in-process patrol inspection records." Some printers print 5,000 boxes without ever doing a color-difference check; some don't even record machine changeovers. When the auditor sees machine logs with only dates and no content, that's a non-conformity.

Category three: customer property and intellectual property. Customer-supplied artwork, proof samples, and printing films all count as "customer property." Does the printer have an inventory? Dedicated storage? Accountability if lost? Does the printer have a confidentiality system for customer artwork? These two areas are particularly easy to fail in the packaging industry, because much of the customer artwork is itself confidential — printers take the easy route and share it via WeChat. The auditor sees "your customer property list doesn't include the artwork transferred on WeChat" and issues a non-conformity.

Category four: non-conforming product control. It's normal to have scrap during production, but does the printer record how much was scrapped? Why it was scrapped? How the scrap was disposed of? Did any scrap get mixed into conforming products for shipment? The last question is the most serious — last year a printer in Zhejiang had an incident: 30 of 1,000 gift boxes were made using leftover stock paper from the previous batch's scrap, the customer caught it during incoming inspection, and the printer paid RMB 80,000 in compensation. When auditors encounter this, they almost always issue a "major non-conformity," and the entire audit is wasted.

3 Documents the Owner Should Personally Oversee

Document one: "Management Review Records." Management review is required by ISO 9001 clause 9.3 — in short, the owner must hold at least one meeting per year to discuss quality objectives, customer complaints, audit findings, and internal audit results together, then form resolutions. The resolutions must state "what to do next, who does it, by when." At many printers, management reviews are ghostwritten by consulting firms — the resolutions say "strengthen training" without concrete actions. The auditor spots it at a glance and issues a non-conformity.

Document two: "Internal Audit Report." An internal audit is the printer auditing itself, at least once per year. The internal audit needs a plan, checklists, findings, and corrective actions. If every item in the internal audit report says "conform," it's basically a fake report — the auditor will ask "How did you conclude everything conforms? What was your sampling method?"

Document three: "Customer Satisfaction Analysis." ISO 9001 requires printers to collect and analyze customer satisfaction. How to collect it? The simplest way is to send customers a short WeChat survey each quarter — the response rate doesn't matter, what matters is having an action in place. If the printer hasn't even done this, the auditor will ask "How do you know whether customers are satisfied?" If the owner can't answer, another non-conformity is issued.

3 Details on Audit Day to Avoid Awkward Silences

Detail one: prepare a complete set of handbooks and procedure document lists in the meeting room — both paper and electronic versions. The auditor will flip through them on the spot, and it's embarrassing if a document can't be found. Detail two: hold a short briefing for employees before the audit, telling them today's audit is happening, and that they should answer honestly — if they don't know, say they don't know; don't guess. Detail three: prepare what the auditor needs to see on-site half an hour in advance — machine logs, inspection records, scrap forms, training sign-in sheets.

An audit rejection isn't the end of the world. Issuing 4-6 minor non-conformities on the first audit is normal, and they can typically be closed within 3 months after consulting-firm coaching. Only major non-conformities (such as lost customer property, or production without a design review) will prevent certification.

A final word for printer owners: ISO 9001 is not about "getting a certificate to hang at the door." It's the first question customers ask during a factory audit and a hard threshold for admission to large-customer supply chains. I've seen too many owners spend RMB 80,000 on certification, then lock the handbook in a cabinet after the audit. The next time a customer comes for a factory audit, they ask the same questions — and you still can't answer.

Further Reading

What are the common certifications in the packaging industry? A corporate certification guide　BSCI/SEDEX social responsibility audits in the packaging industry: Why do European and American customers audit factories?　Packaging factory on-site inspection checklist: 7 details to review before visiting the factory　3 common types of violation cases and penalty standards for packaging companies