- Home
- Certification
- Services
- Initial certification.
Initial certification.
Two stages, not one. The first decides whether the second can usefully happen — and the certification decision is taken by people who did not audit you.
What actually happens.
- Application and contract review, checking the requested scope against what we are accredited to certify
- Audit programme for the full three-year cycle, and audit time determined against documented criteria
- Stage 1 — documented information, site conditions, and whether internal audit and management review have actually been performed
- Documented Stage 1 conclusions, including any area of concern that would be raised as a nonconformity at Stage 2
- Stage 2, on site, covering conformity to every requirement of the standard
- Performance against your own objectives and targets, and against statutory, regulatory and contractual requirements
- Operational control, internal auditing, management review and management responsibility for the policy
- Correction and corrective action on findings, with verification of effectiveness
- Independent review, then a certification decision taken by personnel who did not carry out the audit
The rules this runs under.
| The rule | What it requires | Reference |
|---|---|---|
| Two stages are mandatory | The initial certification audit is conducted in two stages. There is no provision to waive Stage 1 for a first certification. | ISO/IEC 17021-1:2015, 9.3.1.1 |
| Stage 1 is a readiness gate, not a partial audit | It determines preparedness for Stage 2, establishes the scope and site conditions, and evaluates whether internal audit and management review have been planned and performed. | ISO/IEC 17021-1:2015, 9.3.1.2.2 |
| The interval between stages is decided, not fixed | No maximum is set. It is determined by your need to resolve Stage 1 areas of concern and by any need to revise the Stage 2 arrangements. | ISO/IEC 17021-1:2015, 9.3.1.2.4 |
| Stage 2 is on site | It evaluates implementation and effectiveness, and covers conformity to all requirements of the standard. | ISO/IEC 17021-1:2015, 9.3.1.3 |
| Major and minor findings close differently | Major nonconformities must be corrected and the correction verified before the decision. Minor nonconformities require a reviewed and accepted plan. | ISO/IEC 17021-1:2015, 9.5.2 |
| The decision is separated from the audit | The persons taking the certification decision are competent and are not the persons who carried out the audit. | ISO/IEC 17021-1:2015, 9.5.1.1 |
| The cycle starts at the decision | The three-year certification cycle begins with the certification decision — not with the audit and not with the certificate print date. | ISO/IEC 17021-1:2015, 9.1.3.2 |
What you will be asked to produce.
- The documented management system information, in the language of the audit or with agreed interpretation
- Evidence that at least one full internal audit cycle has been completed against the standard
- A completed management review with inputs, outputs and decisions recorded
- The list of sites, processes, shifts and outsourced processes inside the requested scope
- The applicable statutory and regulatory requirements you have identified, and how you monitor compliance with them
- Effective number of personnel including permanent, temporary, part-time and shift staff — this drives audit time
- Your own objectives and targets, and the performance data against them
Where this goes wrong.
The most common failure is arriving at Stage 1 with a documented system but no completed internal audit and no management review. Clause 9.3.1.2.2(g) makes that an explicit Stage 1 objective, so it is not something that can be deferred to Stage 2. Where Stage 1 areas of concern are not resolved, all or part of Stage 1 may have to be repeated and Stage 2 postponed — clause 9.3.1.2.4. The second most common failure is a requested scope that describes what the organisation wants to sell rather than what it operates and controls; that surfaces at Stage 1 as a scope problem and delays everything behind it.
How the audit time is determined.
Audit time is determined against documented criteria and includes time on site plus off-site planning, document review and reporting. Travel and breaks are not counted in it. The principal drivers are the effective number of personnel, the complexity of the management system, the technological and regulatory context, outsourced processes, and the number and geography of sites. Duration should typically not fall below 80% of the calculated time.
The rest of the certification route
Describe the claim — not the service.
Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.