Certification, Accreditation and External Assurance

Introduction

An ISO quality management system (QMS) becomes credible beyond the organization when competent, independent parties evaluate whether it conforms to defined requirements and whether it is capable of delivering intended results. This external assurance environment includes certification, accreditation, customer audits, supplier audits, regulatory inspections and other forms of conformity assessment. These activities are related, but they are not interchangeable.

Certification normally concerns an organization, product, process or person and is performed by a certification body. Accreditation is the formal recognition that a conformity-assessment body is competent to perform specified activities. A customer audit is undertaken to obtain confidence in a supplier, while a regulatory inspection determines compliance with legal requirements. Understanding these distinctions is essential because organizations often prepare for external audits as if they were merely examinations. In reality, an audit is an evidence-based evaluation of a management system, its implementation and its effectiveness.

This chapter examines the certification cycle for ISO 9001-based QMSs, the roles of certification and accreditation bodies, stage-one and stage-two audits, surveillance and recertification, and practical preparation for external, supplier, customer, remote and hybrid audits.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish certification, accreditation, inspection, auditing and assurance.
2. Explain the stages of an ISO management-system certification cycle.
3. Analyse the purpose and evidence requirements of stage-one, stage-two, surveillance and recertification audits.
4. Evaluate the roles of certification bodies, accreditation bodies, regulators, customers and suppliers.
5. Prepare an organization for on-site, remote and hybrid audits.
6. Manage nonconformities, corrective action and appeals with professional integrity.
7. Critically assess the benefits and limitations of third-party assurance.

1. The Conformity-Assessment Architecture

1.1 Certification and accreditation

Certification is third-party attestation that a conformity-assessment body has evaluated an object against specified requirements and determined that conformity has been demonstrated. In an ISO 9001 context, the object is usually an organization’s QMS and its defined scope.

Accreditation is third-party attestation that a conformity-assessment body meets specified competence requirements and is authorized to conduct particular conformity-assessment activities. An accreditation body does not normally certify operating organizations against ISO 9001. Instead, it evaluates certification bodies against applicable standards and accreditation rules.

The distinction can be represented as follows:

Accreditation increases confidence in certification, but an unaccredited certification body is not automatically incompetent. The practical issue is whether the body is competent, impartial, recognized by relevant stakeholders and operating under an appropriate conformity-assessment framework. In many markets, accredited certification is expected because procurement bodies, regulators and customers use accreditation as a confidence mechanism.

1.2 Relevant conformity-assessment frameworks

The international conformity-assessment system is commonly associated with the ISO/IEC 17000 vocabulary and family of standards. Important examples include:

• ISO/IEC 17021-1: requirements for bodies providing audit and certification of management systems.
• ISO/IEC 17011: requirements for accreditation bodies accrediting conformity-assessment bodies.
• ISO 19011: guidance on auditing management systems; it is guidance rather than a certification standard.
• ISO 9001: requirements for a quality management system.
• ISO/IEC 17025: competence requirements for testing and calibration laboratories.
• ISO/IEC 17065: requirements for bodies certifying products, processes and services.

The exact accreditation rules vary by jurisdiction and scheme. Therefore, an organization should verify the certification body’s scope of accreditation, not merely display an accreditation logo. A body accredited for environmental certification, for example, is not necessarily accredited for quality-management certification in every industry sector.

1.3 Assurance is not proof of perfection

A certificate provides bounded assurance. It indicates that an audit team sampled evidence against defined criteria during a defined period. It does not prove that every transaction, product or decision is conforming, nor does it transfer management responsibility to the certification body. The organization remains accountable for its QMS, legal compliance, product safety and customer commitments.

This limitation is central to sound governance. Certification should be treated as one element in a wider assurance system that includes internal audits, management review, performance measures, risk management, complaints analysis, regulatory controls and direct customer feedback.

2. Selecting and Contracting a Certification Body

Certification begins before the first audit. The organization should define its intended certification scope, sites, activities, outsourced processes, applicable statutory requirements and relevant industry codes. The certification body uses this information to determine audit duration, competence requirements, sampling arrangements and commercial terms.

Selection criteria should include:

• accreditation by a recognized accreditation body;
• accreditation scope covering ISO 9001 and relevant industry sectors;
• auditor competence and technical knowledge;
• impartiality safeguards and conflict-of-interest controls;
• rules for multisite, remote and transfer audits;
• complaint, appeal and dispute processes;
• clear treatment of audit time, travel, interpretation and special processes;
• confidentiality and information-security arrangements; and
• reputation for evidence-based, consistent auditing.

Commercial price alone is a poor selection criterion. Excessively short audits, vague scopes or weak technical competence may produce an apparently inexpensive certificate but create operational, contractual and reputational risk. Certification bodies must also avoid consulting their certification clients in ways that compromise impartiality.

The contract should state the certification criteria, audit programme, responsibilities, use of marks, reporting arrangements, treatment of nonconformities, certificate suspension or withdrawal conditions, confidentiality and appeal rights. The organization should understand that certification is not a one-time purchase: it is a continuing conformity relationship.

3. The Certification Cycle

For a conventional three-year cycle, the sequence is generally:

1. application and contract review;
2. audit planning and audit-team assignment;
3. stage-one audit;
4. stage-two certification audit;
5. certification decision;
6. surveillance audits during the certificate period;
7. recertification before expiry; and
8. possible special audits following significant changes, complaints, serious incidents or major nonconformities.

The precise timing and audit duration are controlled by applicable certification rules and the certification body’s procedures. A certificate is not renewed automatically because the organization has passed earlier audits. Each certification decision must be supported by current evidence.

3.1 Application and review

The certification body reviews whether it can undertake the work competently and impartially. It considers organizational size, complexity, sites, shifts, language, technological environment, regulatory context and the scope claimed. Misleading or excessively broad scopes can create disputes later. The organization should describe what it actually controls and avoid excluding activities merely because they are difficult to audit.

3.2 Audit programme and audit plan

An audit programme covers the certification cycle; an audit plan covers a particular audit. The plan identifies objectives, criteria, scope, locations, functions, processes, time allocations, auditors and methods. Risk-based planning should give greater attention to processes with significant customer, regulatory, safety, continuity or performance consequences.

An audit plan is not a script that limits inquiry. Auditors may follow evidence across process boundaries when records, interviews or observations indicate that further examination is necessary.

4. Stage-One Audit: Readiness and Planning

Stage one is primarily a readiness and planning evaluation. It commonly involves review of documented information and an assessment of the organization’s context, scope, significant processes, locations, operational conditions and preparedness for stage two. The auditor may examine whether internal audits and management reviews are planned or conducted, whether performance information exists and whether the organization understands applicable requirements.

Stage one has several purposes:

• confirm that the proposed scope is realistic;
• assess the maturity and implementation level of the QMS;
• identify areas requiring attention before stage two;
• determine whether the organization is ready for a full conformity audit; and
• develop an effective stage-two audit plan.

Stage one is not a reduced certification audit. Evidence gathered at stage one does not replace the need for stage two. The auditor may identify concerns, observations or areas requiring clarification. If readiness is inadequate, the organization and certification body may agree on a delay or revised arrangement.

Typical stage-one evidence includes the QMS scope, process architecture, documented policies and objectives, key performance information, internal-audit programme and results, management-review outputs, legal or regulatory registers, site information and records relating to significant operational processes.

A common management error is to regard stage one as a documentation inspection. A polished manual cannot compensate for absent implementation, ineffective process controls or unreliable performance data.

5. Stage-Two Audit: Determining Conformity

Stage two is the principal certification audit. The audit team evaluates whether the QMS is implemented and effective against the applicable criteria. It follows evidence through processes, people, records, facilities and results. Interviews alone are insufficient; auditors normally triangulate information using interviews, observation, documented information, data and sampling.

The audit may examine:

• leadership commitment and accountability;
• customer requirements and communication;
• operational planning and control;
• design and development, where applicable;
• purchasing and control of external providers;
• production or service provision;
• monitoring, measurement and analysis;
• control of nonconforming outputs;
• competence and awareness;
• internal audit and management review; and
• corrective action and continual improvement.

The audit team conducts an opening meeting, gathers and verifies evidence, records audit trails, conducts periodic communication with the organization, and holds a closing meeting. Audit conclusions should be based on objective evidence and traceable to criteria.

5.1 Audit evidence and sampling

Auditing is a sampling activity. Because auditors cannot examine every transaction, they select samples using professional judgment, risk considerations, prior findings, process complexity and the certification body’s rules. Sampling creates uncertainty; it does not authorize arbitrary conclusions. A finding should be supported by sufficient reliable evidence and expressed clearly enough for the organization to understand the requirement, evidence and gap.

5.2 Nonconformities

A nonconformity is the non-fulfilment of a requirement. Certification bodies commonly classify findings as major or minor according to applicable rules. A major nonconformity may indicate a significant failure of the management system, absence or breakdown of a required process, or a situation that raises substantial doubt about the system’s ability to achieve intended results. A minor nonconformity is a limited failure that does not amount to a major breakdown, although the exact classification rules belong to the certification scheme and body.

Organizations should not debate classification merely to reduce the apparent seriousness of a finding. The productive response is to establish containment, identify the systemic cause, implement correction and corrective action, and provide objective evidence within the required time.

The distinction is useful:

• Correction deals with the detected problem.
• Corrective action deals with the cause of the nonconformity and prevents recurrence.
• Containment limits immediate consequences while a permanent response is developed.

A certificate decision may be delayed when major nonconformities remain unresolved or when evidence is insufficient. Minor findings may be accepted with a documented corrective-action plan, subject to the certification body’s procedures.

6. Certification Decision, Surveillance and Recertification

The audit team normally does not make the final certification decision. An independent competent person or function reviews the audit information and makes the decision, helping protect impartiality. Possible outcomes include granting certification, continuing certification, refusing certification, suspending certification, withdrawing certification or reducing the scope.

6.1 Surveillance audits

Surveillance audits occur during the certification period. They are not complete repetitions of stage two, but they must provide meaningful confidence that the QMS continues to meet requirements. Surveillance commonly examines selected operational processes, internal audits, management review, customer feedback, objectives, complaints, corrective actions, changes and previously identified risk areas.

An organization should not treat surveillance as a predictable checklist. The audit programme should vary attention according to performance and risk. Significant organizational changes—such as acquisitions, new sites, major technology changes, outsourcing, restructuring or changes in regulated activities—should be communicated to the certification body because they may require special review.

6.2 Recertification

Recertification is a more comprehensive evaluation conducted before the certificate expires. It assesses continued conformity and effectiveness over the certification cycle, including changes in context, scope, performance trends, internal audit, management review, complaints, corrective actions and continual improvement. If recertification is not completed in time, continuity of certification may be affected under the certification body’s rules.

The organization should begin preparation well before the final audit. Waiting until expiry encourages superficial document updating rather than evaluation of trends and system effectiveness.

6.3 Suspension, withdrawal and scope changes

Certification may be suspended when requirements are not met, audits are not permitted, corrective actions are ineffective, or the organization misuses certification claims. Withdrawal is more serious and ends the certification relationship. Scope may be reduced when activities are discontinued or no longer adequately controlled. Organizations must represent certification accurately and must not imply that a certification mark applies to products, sites or activities outside the certified scope.

7. Roles and Responsibilities

Certification body

The certification body plans and conducts audits, appoints competent auditors, controls impartiality, reports findings, makes or enables an independent certification decision, maintains records, protects confidentiality and manages complaints and appeals. It should communicate rules consistently and avoid consultancy conflicts.

Accreditation body

The accreditation body evaluates certification bodies through office assessments, witness assessments, competence reviews and examination of impartiality and management arrangements. It grants, maintains, suspends or withdraws accreditation within defined scopes. Accreditation bodies also investigate concerns about accredited bodies, although they do not normally re-audit the organization as a substitute for the certification body.

Certified organization

The organization defines an honest scope, maintains the QMS, provides access and accurate information, implements corrective action, informs the certification body of significant changes and uses certification claims correctly. Management remains responsible for performance; auditors do not manage the system.

Customer and supplier

Customers may audit suppliers to verify contractual requirements, critical-process controls, business continuity or product conformity. A supplier audit may be deeper than an ISO audit in a specific technical area, while an ISO audit evaluates the management system against its standard. Suppliers should provide access, protect confidential information appropriately and distinguish customer requirements from certification criteria.

8. Preparing for External and Supply-Chain Audits

Effective preparation is continuous readiness rather than an annual cleaning exercise. A practical readiness review includes:

1. Confirm the audit scope, criteria, sites, dates, language and methods.
2. Review previous findings and verify that corrective actions are effective.
3. Map evidence to processes rather than merely arranging clauses in folders.
4. Check that objectives, risks, complaints, nonconformities and performance data are current.
5. Verify competence records and ensure employees can explain their responsibilities.
6. Test traceability from customer requirement to delivery and feedback.
7. Confirm control of external providers and outsourced processes.
8. Prepare facilities, systems access, escorts, meeting rooms and secure records.
9. Brief employees on honesty, cooperation and evidence-based responses.
10. Nominate an audit coordinator and define escalation routes.

Employees should answer the question asked, explain what they actually do, and retrieve evidence. Coaching people to recite idealized answers is counterproductive: contradictions between interviews, records and observation damage confidence.

Supplier and customer audits

For supplier audits, the organization should distinguish requirements that are contractual, regulatory, technical or management-system based. A customer may legitimately examine confidential information, but access should be governed by agreements, need-to-know principles and information-security controls. When auditing a supplier, auditors should avoid imposing undocumented expectations or using the audit to obtain proprietary information unrelated to the stated purpose.

The auditee should record customer findings in a controlled system, assign owners, analyse systemic causes and communicate realistic commitments. Repeated customer findings often indicate that the organization’s internal audit programme is too detached from operational risk.

9. Remote and Hybrid Auditing

Remote auditing uses information and communication technology to conduct interviews, review records, observe activities or examine evidence when physical presence is limited. Hybrid auditing combines remote and on-site methods. These approaches can reduce travel and improve access to geographically dispersed personnel, but they introduce risks involving connectivity, identity, confidentiality, data integrity and reduced visibility of physical conditions.

A remote-audit protocol should address:

• approved platforms and backup communication channels;
• identity verification and participant control;
• secure screen sharing and document transfer;
• recording rules and consent;
• confidentiality and data retention;
• time-zone and accessibility arrangements;
• methods for observing physical work, where feasible;
• treatment of interrupted or unavailable evidence; and
• criteria for converting remote activities to on-site activities.

Remote observation must not become a staged demonstration. Auditors should be able to select records, follow trails and ask unplanned questions. If a process cannot be adequately evaluated remotely—for example, because physical conditions, material identification or operator practices are essential—the audit plan should include on-site verification or clearly record the limitation.

Hybrid audits require particularly careful coordination. The organization should avoid creating unequal access to information between on-site and remote auditors. A single evidence-control point, shared agenda and documented handovers reduce duplication and inconsistency.

10. Technology, Data and Artificial Intelligence

Digital QMS platforms can improve version control, workflow visibility, audit trails and corrective-action monitoring. Analytics can identify overdue actions, complaint patterns and process deterioration. However, technology does not automatically establish conformity. Poorly configured permissions, uncontrolled spreadsheets and copied electronic records can create new risks.

Artificial intelligence may assist with document classification, trend detection, audit scheduling and retrieval of evidence. It should not independently decide conformity or generate unsupported audit conclusions. Human auditors remain responsible for professional judgment, evidence evaluation, confidentiality and impartiality. Organizations using AI should control data provenance, model access, validation, bias, explainability and retention. Sensitive customer or personal data should not be transferred to unapproved tools.

11. Illustrative Case: Recertification of Meridian Medical Components

Background

Meridian Medical Components, an illustrative organization, manufactures precision polymer components for medical-device customers. It operates two sites and has an ISO 9001 certificate covering design, production and distribution. During its certification cycle, Meridian introduced a cloud-based production system, outsourced sterilization coordination and acquired a small design company.

Problem

Three months before recertification, Meridian discovered that customer complaints were logged in the quality system, while engineering complaints were tracked separately. Internal audits focused heavily on document control and did not test design-change effectiveness. A previous minor nonconformity concerning supplier evaluation had been closed administratively, but performance data showed recurring late deliveries from a critical supplier.

Analysis

The issues were not simply documentation gaps. They indicated weaknesses in process integration, risk-based internal auditing, change control and corrective-action effectiveness. The acquisition also changed the organization’s context and scope. If the certification body were not informed, the recertification audit might not adequately address the new design activity and outsourced process.

Approach

Senior management appointed a cross-functional team. It consolidated complaint data, classified customer and engineering complaints using common criteria, and analysed trends. The team re-evaluated the QMS scope and notified the certification body of the acquisition, system change and outsourced sterilization coordination. It conducted a process-based internal audit that traced a design change from customer requirement through validation, purchasing, production and complaint feedback. Supplier controls were strengthened using defined performance indicators, escalation criteria and contingency arrangements.

The team distinguished correction from corrective action. It corrected incomplete complaint records immediately, then addressed systemic causes by revising interfaces, responsibilities, training and review controls. Management review examined the effectiveness of these actions rather than merely noting that procedures had been revised.

Outcome

At recertification, auditors identified evidence of improved integration and effective management review. They raised a minor nonconformity because one acquired-site design record lacked a complete approval trail. Meridian submitted correction and corrective-action evidence within the required period. Certification continued with the scope appropriately reflecting the acquired activity.

Learning points

1. Recertification is an evaluation of the whole cycle, not a ceremonial renewal.
2. Organizational change must be communicated to the certification body.
3. Trends and interfaces reveal weaknesses that document reviews may miss.
4. A closed action is not necessarily an effective action.
5. Honest scope definition protects both the organization and users of the certificate.

12. Critical Evaluation and Governance Issues

Third-party certification can improve discipline, customer confidence, market access and organizational learning. It may also create dysfunctional behaviour when managers treat the certificate as the objective. Common risks include audit preparation theatre, excessive documentation, selecting auditors for lenient interpretations, suppressing complaints before audits and measuring success by the number of findings rather than by improved performance.

Independence is therefore a governance issue. Certification bodies need impartiality safeguards, competent personnel and transparent appeals. Organizations need protected channels for reporting inaccurate records, unsafe practices or pressure to mislead auditors. Auditors must respect confidentiality, declare conflicts and avoid using client information for personal or commercial advantage.

Regulatory compliance remains distinct from ISO certification. A QMS can support legal compliance, but certification to ISO 9001 does not certify that every legal obligation has been satisfied. In highly regulated sectors, the organization must understand the relationship among certification, licensing, product approval, inspection and enforcement.

Best-Practice Framework

A mature organization adopts the following principles:

• select an appropriately accredited and technically competent certification body;
• maintain an accurate, neither inflated nor misleading, certification scope;
• use process performance and risk to prepare for audits;
• preserve evidence integrity and never fabricate or retrospectively alter records;
• treat findings as signals for systemic learning;
• verify corrective-action effectiveness;
• communicate significant changes promptly;
• protect confidentiality in customer, supplier and remote audits;
• maintain continuity plans for technology-enabled auditing; and
• use certification as external assurance within a broader governance system.

Chapter Summary

Certification is third-party conformity assessment of an organization or other defined object, whereas accreditation is recognition of the competence and impartiality of a conformity-assessment body. ISO 9001 certification normally follows application and planning, stage one, stage two, an independent certification decision, surveillance audits and recertification. Stage one evaluates readiness and supports audit planning; stage two determines implemented conformity and effectiveness through sampled, evidence-based evaluation.

Surveillance maintains confidence during the certificate period, while recertification provides a comprehensive review before expiry. Nonconformities require appropriate correction, causal analysis and corrective action. Certification bodies audit and decide within their competence; accreditation bodies assess certification bodies; customers, suppliers and regulators perform related but different assurance activities.

Successful preparation is continuous and process-based. Organizations should maintain reliable records, competent personnel, effective internal audits, clear scope control and timely communication of changes. Remote and hybrid audits can be effective when information security, evidence access, physical verification and technology risks are controlled. Ultimately, certification supports confidence but does not replace management responsibility, legal compliance or operational excellence.

Key Terms

Certification: Third-party attestation that specified conformity has been demonstrated.

Accreditation: Formal recognition of a conformity-assessment body’s competence for defined activities.

Certification body: Organization that audits and certifies management systems or other objects.

Accreditation body: Organization that evaluates and accredits conformity-assessment bodies.

Conformity assessment: Process demonstrating whether specified requirements are fulfilled.

Audit criteria: Policies, procedures, standards or requirements used as a reference.

Audit scope: Extent and boundaries of an audit.

Stage-one audit: Readiness and planning evaluation before the principal certification audit.

Stage-two audit: Audit that determines implementation and conformity for certification.

Surveillance audit: Periodic audit during the certification period.

Recertification: Comprehensive audit conducted to renew certification.

Nonconformity: Non-fulfilment of a requirement.

Correction: Action to eliminate a detected nonconformity.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Impartiality: Presence of objectivity and absence of conflicts of interest.

Audit evidence: Verifiable records, statements of fact or other information relevant to criteria.

Remote audit: Audit activity performed using information and communication technology.

Hybrid audit: Audit combining remote and on-site methods.

Certification scope: Defined activities, sites and processes covered by certification.

External assurance: Confidence provided by an independent external evaluation.

Review Questions

Short Answer Questions

1. Distinguish certification from accreditation.
2. What is the primary purpose of a stage-one audit?
3. Why is stage two more than a document review?
4. Differentiate correction and corrective action.
5. State two risks associated with remote auditing.

Long Answer Questions

1. Explain the complete ISO 9001 certification cycle and the responsibilities of the principal parties.
2. Compare stage-one, stage-two, surveillance and recertification audits.
3. Discuss how an organization should select and contract a certification body.
4. Explain how nonconformities should be managed from detection through effectiveness verification.
5. Evaluate the benefits and limitations of third-party certification as a governance mechanism.

Analytical / Application Questions

1. A certified organization acquires a new site and changes its production software but does not inform its certification body. Analyse the risks and recommend actions.
2. A remote audit confirms that procedures are available electronically, but the auditor cannot observe physical identification controls. Determine whether the audit evidence is sufficient and design an appropriate follow-up approach.
3. A supplier repeatedly meets documented procedures but misses delivery and generates increasing customer complaints. Analyse what the customer audit should examine and propose a corrective-action strategy.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes accreditation from certification?

A. Accreditation evaluates an organization’s products, while certification evaluates auditors.

B. Accreditation recognizes the competence of conformity-assessment bodies, while certification attests conformity of a defined object.

C. Accreditation is performed by customers, while certification is performed by regulators.

D. Accreditation replaces internal auditing, while certification replaces management review.

Correct Answer: B. Accreditation recognizes the competence of conformity-assessment bodies, while certification attests conformity of a defined object.

Question 2

What is the principal purpose of an ISO management-system stage-one audit?

A. To issue the final certificate without further auditing

B. To determine every operational nonconformity in the organization

C. To evaluate readiness, scope and planning for the stage-two audit

D. To conduct the organization’s management review

Correct Answer: C. To evaluate readiness, scope and planning for the stage-two audit

Question 3

Which activity is most characteristic of a stage-two audit?

A. Evaluating whether the QMS is implemented and effective through objective evidence

B. Selecting the organization’s quality objectives

C. Writing procedures for the organization

D. Granting accreditation to the certification body

Correct Answer: A. Evaluating whether the QMS is implemented and effective through objective evidence

Question 4

Which statement about a certification decision is generally correct?

A. The organization’s quality manager must make the decision.

B. The lead auditor must always make the final decision alone.

C. The final decision should be made through an independent competent review process.

D. The customer makes the certification decision.

Correct Answer: C. The final decision should be made through an independent competent review process.

Question 5

What is the correct distinction between correction and corrective action?

A. Correction addresses the detected problem; corrective action addresses its cause and recurrence.

B. Correction is preventive; corrective action is only administrative.

C. Correction is performed by the certification body; corrective action by the regulator.

D. They are identical terms with no practical distinction.

Correct Answer: A. Correction addresses the detected problem; corrective action addresses its cause and recurrence.

Question 6

Which audit normally provides the most comprehensive review before a certificate expires?

A. A routine supplier audit

B. A surveillance audit

C. A recertification audit

D. An informal management meeting

Correct Answer: C. A recertification audit

Question 7

A certification body is accredited for environmental management certification but not quality-management certification. What is the key implication?

A. It is automatically accredited for all ISO standards.

B. Its accreditation scope does not demonstrate accreditation for ISO 9001 certification.

C. It may certify ISO 9001 only if the customer agrees.

D. Accreditation scope is irrelevant to certification competence.

Correct Answer: B. Its accreditation scope does not demonstrate accreditation for ISO 9001 certification.

Question 8

Which practice best supports reliable remote auditing?

A. Allowing the auditee to select all records in advance

B. Avoiding identity verification to save time

C. Using secure access, evidence trails and a plan for unavailable physical evidence

D. Recording every meeting without consent

Correct Answer: C. Using secure access, evidence trails and a plan for unavailable physical evidence

Question 9

What should an organization do when a major organizational change affects its certified scope?

A. Hide the change until the next recertification audit

B. Inform the certification body and assess whether special review is needed

C. Delete affected records

D. Transfer certification automatically to the new activity

Correct Answer: B. Inform the certification body and assess whether special review is needed

Question 10

Which statement best describes the limitation of ISO certification?

A. It proves that every transaction is conforming.

B. It transfers legal responsibility to the certification body.

C. It provides bounded assurance based on sampled evidence and does not replace management responsibility.

D. It guarantees customer satisfaction.

Correct Answer: C. It provides bounded assurance based on sampled evidence and does not replace management responsibility.