How ISO certification works

From deciding which standard applies to holding a certificate a buyer can verify — the sequence, who does what, and the step most organisations underestimate.

Two organisations, and why that matters first

Certification involves a certification body, which audits you and issues the certificate, and an accreditation body, which audits the certification body. The second is what makes the first worth anything.

This matters before you start, not after, because an unaccredited certificate costs about the same in effort and is worth nothing in a tender. If you are weighing providers, settle this question first.

Everything below describes accredited certification. The accreditation page explains how to check any certificate, including ours, in under a minute.

Step 1 — Decide the standard, and the scope

The standard follows the problem. Quality and consistency of delivery is ISO 9001; environmental performance is ISO 14001; worker safety is ISO 45001; information security is ISO 27001; food safety is ISO 22000. If a tender or a client named one, that is your answer.

The scope is the harder decision and the one that gets rushed. It states which activities and which sites are covered, and it is printed on the certificate. A scope that is narrower than the work you are bidding for will be read, and it will be challenged. A scope far wider than you can actually control makes every audit harder for years.

• Name the activities exactly as a client would describe them
• List every site that performs them, including stores and yards
• If you operate in several emirates or countries, decide early whether all of them are in
• Where a tender specifies a standard or an accreditation body, follow the tender

Step 2 — Build the management system

A management system is the set of decisions, responsibilities and records by which you run the work — not a folder of documents. The documents exist to make it repeatable and to make it auditable.

Most standards share the same backbone, so an organisation certifying to a second standard finds much of this already done: context and interested parties, a policy, objectives, risks and opportunities, defined responsibilities, competence and training records, document control, internal audit, management review, and handling of nonconformity.

• A policy signed by someone with the authority to mean it
• Objectives that are measurable, and evidence they are measured
• A risk assessment that reflects the work actually done
• Procedures for the activities that would hurt a client if they went wrong
• Records showing the procedures were followed, not merely written

Step 3 — Run it long enough to have evidence

This is the step organisations underestimate, and the most common reason an audit goes badly. An auditor samples records. A system switched on a fortnight before Stage 2 has almost no records to sample, and that is visible immediately.

The system needs to have been operating long enough to have produced real evidence: completed checks, a handled complaint, a corrective action closed out, training that happened, a supplier assessed. How long that takes depends on how often your work cycles, which is why no honest page gives a single number.

Step 4 — Internal audit and management review

Before an external auditor arrives, you audit yourself and your leadership formally reviews the result. Both are requirements, and both are the single most common thing found missing when an organisation turns out not to be ready.

An internal audit that finds nothing is a finding in itself. Auditors read it as an audit that was not really performed, and they are usually right. Finding problems and closing them is exactly what the step is for, and a file showing that is far stronger than a clean sheet.

Lead auditor training exists for this step. A team that can run an internal audit properly arrives at Stage 1 ready, and the evidence shows it.

Step 5 — Stage 1: the readiness audit

Stage 1 checks whether you are ready to be audited properly. The auditor reviews the documented system, confirms the scope makes sense, checks that internal audit and management review have happened, and identifies anything that would make Stage 2 pointless.

Being told at Stage 1 that you are not ready is not a failure. It is the audit doing its job at the cheapest possible moment. The alternative is discovering it at Stage 2, with more time and money already spent.

Step 6 — Stage 2: the certification audit

Stage 2 examines the system in operation. The auditor interviews the people who do the work, samples records, follows processes through from start to finish, and tests whether what is written down is what actually happens.

Findings are raised as nonconformities, major or minor, with a stated requirement each one relates to. Minor findings are normally closed with a corrective action plan and evidence. A major finding means the issue must be fixed and verified before a certificate can be issued.

A corrective action is not the repair. It is what you changed so the same thing does not recur — and that distinction is what auditors test.

Step 7 — The certificate, and the public registry

Once findings are closed, the certificate is issued, naming the standard, the scope and the accreditation body. Certificates issued through an accredited body are listed on IAF CertSearch, where any buyer can look you up by company name or certificate number.

That listing is the point. A certificate that cannot be verified independently asks a buyer to take your word for it, which is precisely what they are trying to avoid.

Step 8 — Surveillance, and the three-year cycle

Certification is not a one-off purchase. The certificate is maintained by surveillance audits across a three-year cycle, after which a recertification audit reassesses the whole system.

A system that stops being maintained between audits gets found out at the next one, and a certificate can be suspended or withdrawn — which is also visible on the registry. Keeping it is less work than rebuilding it, and considerably less than explaining a withdrawal to a client.

Why organisations are found not ready

• Internal audit and management review were never actually done
• The system was written but not operated, so there are no records to sample
• The scope on paper does not match the work the organisation really performs
• Risk assessments describe a generic business rather than this one
• Corrective actions fix the instance and leave the cause untouched
• Nobody outside the quality manager can describe how the system affects their job

Every one of these is cheaper to find before Stage 1 than during Stage 2. If you are unsure which apply to you, say so before you start.

What this costs, and how long it takes

Price depends on the standard, the scope and the accreditation body, and is published per standard rather than quoted in generalities — the standards index lists each one with its price and what is included.

Duration depends mostly on Step 3: how quickly your work produces evidence to audit. The paperwork is rarely the constraint. An organisation that already runs disciplined records moves fast; one starting from nothing should plan for the system to run before it is examined.