What is ISO certification?

Who issues ISO certificates?

The International Organization for Standardization (ISO) writes standards but does not certify anyone. Certificates are issued by independent certification bodies. Many certification bodies are themselves accredited by a national accreditation body, which checks that they follow ISO/IEC 17021-1, the international standard for bodies that audit and certify management systems. In Pakistan that accreditation body is the Pakistan National Accreditation Council (PNAC).

What does a certification body actually check?

A management-system certificate does not certify a product. It confirms that the organisation has a system that is designed and working to meet the standard's requirements. For ISO 9001 that means, for example, that customer requirements are reviewed before orders are accepted, that production is controlled, that nonconforming output is identified and handled, and that internal audits and management reviews take place and lead to improvement.

• Scope: the activities, products and sites covered, written on the certificate.
• Evidence: records, interviews and observation sampled by auditors.
• Effectiveness: whether the system achieves its intended results, not only whether documents exist.

How does the process work?

Initial certification has two stages. Stage 1 checks readiness: documented information, site conditions, legal obligations, internal audit and management review. Stage 2 evaluates implementation and effectiveness on site. Nonconformities must be corrected, and an independent decision is then taken by people who were not part of the audit. See our certification process for each step.

How long is a certificate valid?

A certification cycle lasts three years. Surveillance audits take place at least once each calendar year, the first within 12 months of the certification decision. A recertification audit before expiry renews the certificate for a new cycle.

What certification does not prove

• It does not certify that every product is defect-free.
• It does not replace legal permits or regulatory approvals.
• It is only as credible as the certification body behind it, which is why you should always verify a certificate and check the certifier's accreditation scope.

Key takeaways

• Certificates come from certification bodies, not from ISO.
• Certification covers a defined scope and must be maintained through annual surveillance.
• The audit, the review and the certification decision should be done by different people.