As Jim mentioned, audit against documented requirements.
One note that would make it easier to ensure that their procedures / policies are properly written (thereby making auditing to them much easier.
I've spent a lot of time recently working with Indirect / Service departments and organizations, and I find the biggest struggles for them with ISO 9001 is their policies are written by the same people who wrote the procedures for manufacturing, and it is incredibly difficult to standardize judgement.
I find when service/judgement/creative departments have procedures that dictate how a task should be done, they will invariably get audit findings because different people follow different mental processes to get to the same destination. I've found great success in ensuring that departments understand when it's appropriate to standardize the process (put tab A in slot B) and when to standardize the outcome. When the creative/judgement team has a standardized outcome (see: Checklist Manifesto), they tend to have better control and more beneficial audits.