Process plant during daytime operation
  1. Home
  2. Certification
  3. Nine steps, and three people who must not be the same person.

Nine steps, and three people who must not be the same person.

ISO/IEC 17021-1:2015 separates the audit, the technical review and the certification decision. That separation is what a certificate is worth, and it is the reason the cycle looks the way it does.

The cycle

From application to renewal.

  1. Application and review

    Scope, sites, headcount, shifts, processes and any outsourcing are established in writing. This determines audit time; an inaccurate application produces an audit programme that will not survive Stage 1.

    Client and body

  2. Contract and audit programme

    The certification body confirms competence for the scope, determines audit time and appoints an audit team with no conflict of interest.

    Certification body

  3. Stage 1 — readiness

    Documentation, internal audit, management review, site conditions and the scope as stated. The output is a written statement of what must be in place before Stage 2, and when.

    Audit team

  4. Stage 2 — implementation

    Evidence that the system is implemented and effective, gathered on site through interview, observation, record sampling and process walkthrough.

    Audit team

  5. Findings and correction

    Nonconformities are stated with the requirement and the evidence. The organisation submits correction, root-cause analysis and corrective action; the body verifies effectiveness, not intention.

    Client, then body

  6. Independent technical review

    A competent reviewer who took no part in the audit examines the file for completeness, consistency and whether the evidence supports the recommendation.

    Independent reviewer

  7. Certification decision

    Taken by authorised personnel who neither audited nor reviewed. The certificate is issued with a scope, sites and validity that match exactly what was assessed.

    Authorised decision

  8. Surveillance

    Periodic audits confirm continued conformity and address changes to scope, sites, personnel, complaints and use of the mark.

    During the cycle

  9. Recertification

    A full review of performance across the whole cycle before renewal — not a repeat of Stage 2, and not a formality.

    End of cycle
Steps 4, 6 and 7 must involve different people. A body in which the auditor also reviews and also decides is not operating ISO/IEC 17021-1:2015, whatever its documents say.
Frequently confused

What certification is not.

A certification audit

What it does
  • Tests whether a management system meets a standard and is effective.
  • Samples evidence against the audit programme.
  • Reports nonconformities against stated requirements.
  • Leads to a decision by someone independent of the audit.

Consultancy

What the same body must not do
  • Design or write the management system it will certify.
  • Provide specific solutions to the nonconformities it raised.
  • Train the organisation on implementing its own system in a way that amounts to consultancy.
  • Certify a system it built — under any group or brand arrangement.
Where an organisation needs help building the system, that work is available from advisory firms, including Extreme Energy Solutions within this group, which is a separate entity. In that case the certification is performed by a body with no involvement in the preparation.

The rest of the certification route

ServicesCertification servicesRulesPublic informationActApply

Describe the claim — not the service.

Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.

Start a pre-engagement reviewContact the right entity