The road to ISO certification — understanding the ISO management system certification process

For organizations pursuing management system certification, the process is more than just an audit or certificate. It's a journey that begins with preparation and continues through ongoing monitoring and recertification. Understanding each step can help you prepare more effectively and avoid unnecessary delays.

Certification is a structured process that begins long before auditors arrive on site and continues as the certificate is maintained. Each step provides confidence that a management system is effectively implemented and capable of meeting organizational, customer, regulatory, and industry requirements. Knowing this process can help organizations seeking certification reduce delays, improve audit outcomes, and maximize the value of certification process.

Fully understanding the standards pays dividends when navigating the certification process. Organizations can begin their journey with training, gap assessments, or implementation support — or you can start by simply reading the certification standard. This preparation helps organizations understand the requirements of the applicable standard and evaluate how existing processes align with those requirements.

Training and gap assessments are examples of technical assistance that can significantly improve readiness, but certification bodies must maintain impartiality in accordance with ISO/IEC 17021-1. This means they cannot certify management systems they have designed or implemented on behalf of a client. ISO/IEC 17021-1 establishes those requirements for audits and certification of management systems, serving as the foundation for accredited certification programs.

The process starts by filling out the application for the certification body. The application is more than just administrative paperwork. The information you provide establishes the certification scope, determines auditor competency requirements, identifies applicable technical sectors, and forms the basis for calculating audit duration.

The application typically includes:

• Products and services provided by the organization
• Physical locations and remote activities
• Number of employees and contractors
• Operational processes and complexity
• Regulatory requirements
• Existing certifications and management systems
• Desired certification standards

Not only does the application define the scope of certification, it also defines the activities, products, services, and locations covered by the management system — all appearing on the certificate itself. An inadequate scope can create significant challenges. If the scope is too narrow, important activities may be excluded from certification. Too broad of a scope adds unnecessary audit time and cost. A well-defined scope ensures auditors evaluate the appropriate business activities and that stakeholders clearly understand what is certified.

One of the most common questions organizations ask is, "How long will the audit take?" Under accredited certification programs, audit duration is not determined arbitrarily. Certification bodies must follow internationally recognized requirements and guidance when calculating audit time. Audit duration varies by factors, including:

• Number of personnel
• Number of sites and locations
• Complexity of processes
• Level of environmental or occupational risk
• Degree of integration among management systems
• Type of regulatory requirements
• Maturity of the management system
• Scope of certification

For multisite organizations, requirements contained in IAF Mandatory Document MD 1 govern eligibility and audit-planning considerations. IAF MD 1 provides requirements for the certification of management systems operated across multiple locations and helps ensure consistency among accredited certification bodies. Certification bodies must also comply with the principles and requirements of ISO/IEC 17021-1, which establish the framework for determining audit programs, competence requirements, and certification activities. For ISO 19443 certifications, ISO/TS 23406:2024 establishes requirements for audit duration.

Preassessments are not required but provide an opportunity to identify weaknesses and gaps before the formal certification process. During a preassessment, auditors review selected aspects of the management system and provide feedback regarding areas that may require improvement. Preassessments can be particularly valuable for first-time certification or when a significant change in scope is requested.

The Stage 1 Audit serves as a readiness review. At this stage, auditors evaluate whether the management system is adequate and well implemented, and whether the organization is prepared for the certification audit. Activities typically include reviews of:

• Management system documentation
• Scope definition
• Context of the organization
• Risks and opportunities
• Internal audit results
• Management review activities
• Regulatory considerations

The Stage 1 Audit does not certify the organization. Rather, it determines whether the management system has matured sufficiently to proceed to Stage 2. Any significant concerns identified during Stage 1 should be addressed before the certification audit begins.

The Stage 2 Audit is the formal certification assessment. During this audit, auditors evaluate whether the organization’s management system conforms to the standard and  is being effectively implemented. The emphasis shifts from documented procedures to objective evidence, demonstrating that processes are functioning as intended. Auditors may conduct:

• Employee interviews
• Process observations
• Record reviews
• Facility walkthroughs
• Sampling of operational activities

The audit may identify nonconformities to the standard, which will be classified as major or minor. Any nonconformities must be addressed through a corrective action process. Once requirements are satisfied, the certification body independently determines whether to issue the certificate.

Management system certification is not a one-time event. Most accredited certificates are issued for a three-year cycle, during which surveillance audits are conducted annually or semiannually. Surveillance audits evaluate selected portions of the management system to verify ongoing conformity and continual improvement.

Auditors focus on areas such as:

• Internal audits
• Management reviews
• Corrective actions
• Changes within the organization
• Achievement of objectives
• Continual improvement activities

Because surveillance audits evaluate selected portions of the system rather than their entirety, they are shorter than the initial certification audit.

Before the three-year certification cycle expires, organizations undergo a recertification audit. Unlike surveillance audits, recertification provides a broader evaluation of the management system's effectiveness over the entire certification cycle. Auditors assess sustained performance, organizational changes, corrective action effectiveness, and evidence of continual improvement. Once recertification is successfully completed, a new certificate is issued and a new three-year certification cycle begins. Transfers between certification bodies can be accomplished anywhere within the certification cycle.

The application establishes scope and forms the basis for audit duration calculations, while Stage 1, Stage 2, surveillance, and recertification audits provide ongoing confidence in the effectiveness of the management system. As your organization grows and evolves, the scope of your certification can be modified, and new certifications can be added.

Certification bodies issue certifications to internationally recognized requirements such as ISO/IEC 17021-1, IAF MD 1, and ISO/TS 23406. Various accreditation bodies oversee these activities. This level of oversight gives customers, regulators, and stakeholders confidence that certified management systems are functioning as intended and continually improving to meet evolving business and industry expectations.