Choosing a Certification Body: 10 Checks Before You Sign

Most organisations choose a certification body on price and turnaround. Both are the wrong first questions.

A certificate is not a document you buy. It is a third party’s documented opinion that your management system meets a standard — and that opinion is worth exactly what the body issuing it is worth. A certificate from a body with no accreditation, or with accreditation that does not cover your standard or your industry, is not a cheaper version of the same thing. It is a different thing, and your client’s procurement team may treat it as worthless.

These are ten checks you can run yourself, before you sign anything. Most take minutes.

1. Confirm the body is accredited — and find out by whom

Accreditation is third-party recognition that the certification body itself is competent and impartial. Bodies certifying management systems are assessed against ISO/IEC 17021-1. Product certification bodies work to ISO/IEC 17065, persons certification bodies to ISO/IEC 17024.

Any organisation can print a certificate. Accreditation is what makes it mean something.

Ask directly: which accreditation body accredits you, and what is your accreditation number? A body that answers vaguely, or points only to a membership logo or an association badge, has told you the answer.

Note the distinction: membership of an industry association is not accreditation. Neither is certification of the body’s own management system.

2. Verify it on the accreditation body’s own register — not theirs

Every recognised accreditation body publishes a searchable register of who it accredits, the scope of that accreditation, and its current status.

That register also reflects suspension and withdrawal. A body whose accreditation has been suspended may still be displaying the logo. The register is the source of truth; the website is marketing.

What to do: Go to the accreditation body’s site directly and search from there. Do not follow a link the certification body sends you.

3. Check the accreditation covers the standard you need

This is the check most often skipped, and the one that most often causes problems later.

Accreditation is granted scheme by scheme, not as blanket approval. A body accredited for ISO 9001 is not automatically accredited for ISO 45001, ISO 14001, ISO 22000 or ISO 27001. Each is assessed separately, and a body may hold some and not others.

What to do: On the register entry, read the accredited scope line by line. Confirm your standard appears — and in the edition you need. Standards revise; accreditation follows on a transition timetable, and a body may not yet be accredited to the new edition.

4. Check the accredited scope covers your industry

Accreditation for a standard is further limited by sector. Management system accreditation uses IAF codes to define which industries a body is competent to audit. A body accredited for ISO 9001 in general manufacturing may hold no accreditation for construction, food, healthcare, aviation or energy.

If a body audits you outside its accredited sector scope, what you receive is not an accredited certificate for your activity — even though the body is genuinely accredited for other things. This is the failure that surfaces in a tender, long after the audit.

What to do: Ask which IAF code your operation falls under, and confirm that code appears on their accreditation. Get it in writing before the audit is scheduled.

5. Confirm the certificate will be recognised where you need it

A certificate matters where your clients, regulators and tender bodies accept it. That acceptance runs through international arrangements — the IAF Multilateral Recognition Arrangement for certification, and ILAC for inspection and testing. Accreditation bodies that are signatories produce certificates recognised by other signatories.

Your client’s requirement may be more specific than “accredited”. Some name the accreditation bodies they accept. Some sectors and some public procurement frameworks are stricter still.

What to do: Ask your largest client, or the tender you are targeting, what they require — before you choose. Reversing this decision later means recertifying.

6. Read the proposed scope statement before you sign

The scope sentence on your certificate is what a procurement team reads. It defines what you are certified to do, and at which sites.

A scope that is too narrow fails tenders. A scope that is too broad commits you to auditing activities you did not intend to include, and can be challenged. Scope wording is negotiable before it is issued and awkward to change afterwards.

What to do: Ask for the proposed wording in writing during quotation, not after the audit. Read it as your client’s procurement officer would. Check it names every site you need covered, and does not exclude an activity your clients assume is included.

7. Ask how the audit duration was calculated

Audit duration is not a commercial choice. For management system certification it is calculated from effective headcount, complexity, risk, number of sites and scope, using mandatory accreditation rules — principally IAF MD 5, with IAF MD 1 governing multi-site sampling.

An unusually low quote almost always means the audit days have been under-calculated. That is a finding against the certification body at their next accreditation assessment — and if their accreditation is suspended or withdrawn, your certificate is affected.

What to do: Ask for the calculation, not just the price. A competent body will show you the inputs: effective number of employees, complexity factors, number of sites, and the resulting days for Stage 1, Stage 2 and each surveillance visit. If they cannot produce it, that is your answer.

8. Ask who is auditing, and what they have audited

Standards knowledge is not the same as sector knowledge. An auditor who has never seen your process will spend the audit learning it, and will find less that is useful to you.

Certification bodies are required to demonstrate auditor competence for the sector they audit. It is assessable, not a matter of opinion.

What to do: Ask which auditor is assigned, what sector experience they hold, and whether they have audited your industry before. Ask what happens if that auditor becomes unavailable.

9. Check impartiality — particularly consultancy

A certification body may not certify a management system it consulted on. This is fundamental to ISO/IEC 17021-1, and accreditation bodies publish impartiality requirements covering it.

The risk in practice is structural rather than obvious: a certification body and a consultancy under common ownership, shared management, shared premises or shared personnel, presented to the client as separate companies.

What to do: Ask directly whether the body, or any related company, provides consultancy or implementation services. Ask how the separation is managed and who reviews it. If the same person sold you the implementation and the certification, that is a problem regardless of how the invoices are addressed.

10. Confirm your certificate will be publicly verifiable

Your clients will want to check your certificate. If it cannot be verified independently, its value in a tender is limited.

Accredited management system certifications are validated globally through IAF CertSearch, and accreditation bodies publish the status of the bodies they accredit.

What to do: Ask whether your certificate will appear on IAF CertSearch and on the certification body’s own public register, and how soon after the audit it appears.

---

The quick version

Check	Where to verify
Accredited at all	Accreditation body’s public register
Accredited for your standard	Scope on the register entry
Accredited for your sector	IAF code on the register entry
Recognised in your market	IAF MLA / ILAC signatory status; your client’s requirement
Scope wording	Proposed wording in writing, before signing
Audit days	Written calculation to IAF MD 5
Auditor competence	Named auditor, sector experience, in writing
Impartiality	Direct question about consultancy links
Verifiable certificate	IAF CertSearch

The question behind all ten

Every check above is really asking the same thing: if my client challenges this certificate, what happens?

A certificate that cannot survive that question has cost you money and given you nothing. One that can is worth what you paid.

All of these checks are available before you commit, and most take minutes. The cost of skipping them is not discovered at the audit. It surfaces later — when a client asks for verification, when a tender rejects the scope, or when the standard revises and the body handles the transition badly.

Ask the questions while you are still the customer.

---

This guide is provided for information only and does not constitute professional or compliance advice. Accreditation schemes and requirements change — verify current requirements directly with the relevant accreditation body. ITMAD accepts no liability for any action taken in reliance on it.