What is a certification body?

How accreditation works

Accreditation is a chain. National accreditation bodies, such as UKAS in the UK, ANAB in the US and DAkkS in Germany, assess certification bodies for competence and impartiality against ISO/IEC 17021-1 and the extra rules for each standard: ISO/IEC 27006 for ISO 27001 and ISO/IEC 42006 for ISO 42001. Accreditation bodies that sign the International Accreditation Forum’s mutual recognition arrangement accept each other’s accreditations, so an accredited certificate is recognised across borders.

Unaccredited certificates also exist and some buyers reject them. Before you sign, check that the body is accredited for the standard you need, by an accreditation body your customers recognise.

What a certification body does

The initial audit has two stages. Stage 1 reviews documentation and readiness. Stage 2 tests whether the management system works in practice. Someone who was not on the audit team then makes the certification decision. The certificate lasts three years, with surveillance audits in the first and second years and a recertification audit before it expires.

Auditors raise nonconformities where a requirement is not met. To protect impartiality, a certification body may not provide consultancy to the organisations it certifies, which includes writing their policies or building their management system.

Choosing one

Audit time is set by rules tied to the size and complexity of the scope, so quotes from accredited bodies for the same scope should be broadly comparable. A much lower quote is worth questioning.

• Accreditation. Accredited for the exact standard you want, and the scope of your business.
• Experience. Auditors who know your sector and the technology you run.
• Audit time. A quote based on headcount and scope, following the audit-time rules for the standard.
• Recognition. A body your customers accept, since some buyers ask for a particular accreditation.

Related terms

Surveillance audit

The yearly audit between ISO certification and recertification, checking that the management system is still being run. Shorter than the initial Stage 2 audit.

Nonconformity

An ISO audit finding that a requirement is not met. A minor nonconformity needs a corrective action plan; a major one must be resolved before a certificate is issued.

ISMS

Information security management system: the scope, policies, risk process, controls and reviews that ISO 27001 certifies. The certificate covers the management system, not a product.

Internal audit

A review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 require one before certification and at planned intervals after it.

Attestation report

An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.