8. Certification, Accreditation, and Conformity Assessment

Introduction and Context

Quality management depends not only on what an organization claims about its processes, products, or services, but also on the credibility of those claims. A supplier may state that its management system conforms to ISO 9001, a laboratory may report that a test was performed accurately, and a certification body may issue a certificate asserting conformity. The reliability of each claim depends on the competence, independence, and recognized authority of the organization making it.

Certification, accreditation, and conformity assessment provide the institutional framework for creating this confidence. They are particularly important where customers cannot directly observe quality, where regulatory requirements apply, or where supply chains cross national and technical boundaries. In such circumstances, an independent and competent assessment reduces information asymmetry and supports informed decisions.

This chapter examines third-party certification and accreditation with particular reference to ISO/IEC 17021-1, ISO/IEC 17025, certification cycles, surveillance, impartiality, competence, and international recognition arrangements. The discussion is relevant to quality managers, auditors, laboratory managers, procurement professionals, regulators, and executives who use conformity-assessment results in organizational decision-making.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Distinguish conformity assessment, certification, accreditation, inspection, and verification.

2. Explain the roles of certification bodies, accreditation bodies, laboratories, regulators, and scheme owners.

3. Interpret the principal requirements of ISO/IEC 17021-1 for management-system certification bodies.

4. Explain how ISO/IEC 17025 establishes competence and impartiality in testing and calibration laboratories.

5. Describe certification stages, surveillance, recertification, suspension, withdrawal, and transfer.

6. Evaluate impartiality, competence, confidentiality, and risk in third-party assessment.

7. Explain the importance of international recognition arrangements and peer evaluation.

8. Apply these concepts to the selection and evaluation of certification and laboratory services.

The Architecture of Conformity Assessment

Conformity assessment is the systematic process used to determine whether specified requirements relating to a product, process, service, system, person, or body have been fulfilled. The requirements may come from legislation, standards, contracts, technical specifications, or an organization’s own documented criteria. Conformity assessment therefore includes several activities rather than one single type of audit.

First-party assessment is performed by an organization on itself, usually through internal audits, management reviews, inspections, or product testing. Second-party assessment is performed by a customer or another party with a contractual interest, such as a purchaser auditing a supplier. Third-party assessment is performed by an independent body that is not the supplier or customer. Third-party certification is valuable because its independence can give assurance to many interested parties simultaneously.

Certification is a third-party attestation that a product, service, process, person, or management system conforms to specified requirements. Management-system certification, such as certification to ISO 9001, ISO 14001, or ISO 45001, evaluates whether an organization’s management system meets the relevant standard and is effectively implemented. It does not mean that every product is perfect, nor does it guarantee the absence of all failures.

Accreditation is a formal recognition by an authoritative body that a conformity-assessment body is competent to perform specified activities. An accreditation body does not normally certify an organization’s management system or calibrate its instruments. Instead, it evaluates certification bodies, laboratories, inspection bodies, or other assessment organizations against applicable international requirements and defined scopes.

This distinction is fundamental. A company may be certified; a certification body is accredited. A laboratory may be accredited to ISO/IEC 17025; it does not become “ISO 17025 certified” in the same sense as a management-system certificate. Accreditation is concerned with the competence and consistent operation of the conformity-assessment body.

Principal Actors and Their Relationships

The client organization seeks an assessment and provides access, information, personnel, and facilities. The certification body (CB) conducts an audit and makes an independent certification decision. The accreditation body (AB) evaluates whether the CB is competent, impartial, and consistently applying its certification processes. A scheme owner may establish sector-specific rules, such as additional requirements for medical devices, automotive suppliers, or information security. Regulators may recognize particular certificates or accreditation arrangements for legal or public-policy purposes.

The relationship can be represented as a chain of confidence:

Client organization → Certification body → Accreditation body → Recognition arrangement.

For laboratories, the structure is slightly different:

Laboratory → Accreditation body → Peer-recognized accreditation system.

Customers and regulators use the resulting certificate or report, but they must still examine its scope, validity, conditions, and limitations. A certificate is not meaningful in isolation from the activities and locations it covers.

ISO/IEC 17021-1 and Management-System Certification

ISO/IEC 17021-1 specifies requirements for bodies that audit and certify management systems. Its central purpose is to ensure that certification bodies operate competently, consistently, and impartially. The standard applies to the certification body’s organizational structure, resources, competence, processes, and management system.

Impartiality

Impartiality means the presence of objectivity and freedom from conflicts of interest. Certification decisions must not be influenced by commercial, financial, personal, or other pressures. A certification body must identify, analyze, document, and manage threats to impartiality. Examples include ownership relationships, financial dependence on one client, auditor incentives linked to audit outcomes, and provision of consultancy to an audit client.

A certification body must not audit a management system that it has designed or implemented through consultancy. The same principle applies to situations in which an auditor has recently provided consultancy to the organization. The purpose is to prevent self-review: a person should not evaluate the adequacy of work for which that person was responsible.

Impartiality is broader than simply being independent in appearance. A body may have no obvious conflict yet still face pressure if a client represents a large proportion of its revenue. Effective governance therefore includes conflict-of-interest controls, independent certification decisions, impartiality committees or equivalent mechanisms, auditor rotation where appropriate, and transparent complaint and appeal processes.

Competence

Certification competence includes knowledge of the relevant management-system standard, audit techniques, sector technologies, legal requirements, organizational processes, and certification procedures. Competence is required at several levels: auditors, technical experts, audit-team leaders, reviewers, and personnel responsible for certification decisions.

Auditor competence is not established merely by attending a training course. It must be supported by education, experience, observed auditing, evaluation, continuing professional development, and evidence that the individual can apply knowledge in a specific sector. ISO/IEC 17021-1 emphasizes the need for competence criteria related to technical areas and the ability to evaluate management-system effectiveness.

A technical expert may support an audit team with specialized knowledge but normally does not replace the auditor’s responsibility to evaluate the management system. The certification body must determine the competence needed for each assignment and select an audit team capable of covering the organization’s scope, complexity, locations, and risks.

Responsibility and Transparency

The certification body retains responsibility for certification decisions, even when it uses external auditors or technical experts. Audit activities may be outsourced, but decision-making authority and control cannot simply be transferred without governance.

The certification body also needs controlled procedures for applications, audit planning, audit reporting, review of evidence, certification decisions, complaints, appeals, use of marks, and control of records. Certification information should be sufficiently transparent to allow interested parties to understand the certified scope and status, while respecting confidentiality.

The Certification Cycle

Management-system certification is normally organized as a cycle rather than a single event. The exact duration and audit effort depend on the applicable rules, the organization’s size and complexity, the number of sites, risk, scope, and changes in the management system.

Application and Contract Review

The certification body first reviews the application to determine whether it can undertake the work competently and impartially. It considers the organization’s activities, locations, processes, language, applicable standard, requested scope, and any sector-specific requirements. It should not accept work when it lacks the necessary competence or when conflicts of interest cannot be controlled.

Stage 1 Audit

Stage 1 is primarily a readiness and planning assessment. The audit team reviews documented information, evaluates the organization’s understanding of requirements, examines site conditions and operational context, and determines whether the organization is prepared for Stage 2. Stage 1 also helps establish the audit plan and identify areas requiring attention.

Stage 1 is not a superficial document check. It provides evidence about the maturity and practical readiness of the management system. Findings may require correction before Stage 2, depending on their significance and the certification body’s procedures.

Stage 2 Audit

Stage 2 evaluates implementation and effectiveness. Auditors gather evidence through interviews, observation, examination of records, sampling of operational activities, and tracing processes from inputs to outputs. They assess whether the system meets the standard and whether the organization achieves intended results.

Audit conclusions must be based on objective evidence. A nonconformity is a failure to fulfill a requirement. Findings should be clearly stated, linked to a requirement, supported by evidence, and classified according to the certification body’s rules. The client normally analyzes causes, implements correction and corrective action, and provides evidence for review.

Certification Decision

The audit team should not make the final certification decision where the process requires independent review. A competent person or function examines the audit evidence, findings, responses, and other relevant information. Certification is granted only when the requirements for certification have been met. The decision-maker must be free from conflicts and sufficiently independent from the audit team.

Surveillance Audits

Surveillance maintains confidence between initial certification and recertification. Surveillance audits are less extensive than the initial certification audit but must cover meaningful portions of the management system over the cycle. They commonly examine internal audits, management review, corrective actions, complaints, significant changes, performance results, and selected operational processes.

Surveillance is not a routine courtesy visit. If surveillance evidence indicates that the management system no longer conforms or is ineffective, the certification body must require appropriate action. Depending on severity, the result may include additional assessment, suspension, reduction of scope, or withdrawal.

Recertification

Recertification is a more comprehensive review at the end of the certification cycle. It evaluates continued conformity, effectiveness, performance over time, changes in the organization and its context, and the treatment of previous findings. The purpose is not merely to renew paperwork but to determine whether continued certification remains justified.

Suspension, Withdrawal, and Scope Changes

A certificate may be suspended when the organization fails to maintain conformity, does not permit required audits, misuses the certification mark, or fails to meet financial or procedural obligations where those obligations affect certification control. Suspension temporarily removes the right to claim certified status. Withdrawal terminates the certification. A scope may be reduced when only part of the certified activities remains conforming.

Organizations must notify the certification body of significant changes, such as ownership changes, relocation, new products, major process changes, serious incidents, or regulatory enforcement. The certification body determines whether additional assessment is necessary.

ISO/IEC 17025: Competence of Testing and Calibration Laboratories

ISO/IEC 17025 establishes general requirements for the competence, impartiality, and consistent operation of testing and calibration laboratories. It is important because laboratory results influence product release, regulatory decisions, safety judgments, research conclusions, and process control.

The standard combines management-system requirements with technical requirements. A laboratory must control documents and records, address risks and opportunities, manage complaints and nonconforming work, conduct internal audits and management reviews, and pursue continual improvement. At the same time, it must demonstrate technical competence in personnel, facilities, environmental conditions, equipment, methods, sampling, handling of test items, measurement traceability, and reporting.

Method Selection and Validation

Laboratories should use appropriate, current, and controlled methods. Standard methods may require verification under the laboratory’s conditions. Non-standard or laboratory-developed methods require validation to demonstrate fitness for purpose. Validation may address selectivity, accuracy, precision, detection capability, linearity, robustness, and measurement uncertainty, depending on the activity.

Measurement Traceability and Uncertainty

Calibration results should be traceable through an unbroken chain of calibrations to a stated reference, with each link contributing to measurement uncertainty. Traceability does not mean that a result is automatically correct; it means that the measurement relationship is documented and technically justified.

Measurement uncertainty expresses the dispersion reasonably associated with the measurand. Its evaluation is essential where decisions depend on whether a result meets a specification. Laboratories should communicate results and, where relevant, decision rules transparently.

Quality Assurance of Results

Laboratories monitor the validity of results through quality-control samples, replicate testing, reference materials, equipment checks, trend analysis, and participation in proficiency testing or interlaboratory comparisons when available and appropriate. A laboratory that produces technically precise but biased results is not competent merely because its records are well organized.

Reporting and Accreditation Scope

Reports must identify the laboratory, client, methods, items tested or calibrated, results, units, dates, authorized personnel, and any relevant limitations. Accreditation applies only to activities listed in the scope of accreditation. A laboratory must not imply that every activity it performs is accredited if only selected methods or locations are covered.

Accreditation and International Recognition

Accreditation bodies assess conformity-assessment bodies against standards such as ISO/IEC 17011. They evaluate competence, impartiality, consistent procedures, resources, technical activities, and decision-making. Assessment typically includes document review, office assessment, witnessing of audits or laboratory work, review of records, and follow-up of nonconformities.

International recognition arrangements enable results issued in one economy to be accepted in another, subject to the relevant scope and rules. Organizations such as the International Accreditation Forum and the International Laboratory Accreditation Cooperation support cooperation among accreditation bodies through peer evaluation and multilateral recognition arrangements. Recognition is not a universal guarantee that every certificate or report is acceptable for every purpose. Users must still confirm the accredited scope, applicable scheme, report status, and regulatory requirements.

The practical benefit of recognition is reduced duplication. A manufacturer exporting products may avoid repeated laboratory testing when a receiving authority accepts results from an appropriately accredited laboratory. Similarly, a buyer may place greater reliance on a certificate issued by a certification body accredited by a signatory within the relevant recognition arrangement.

Selecting and Using Conformity-Assessment Services

Managers should not select a certification body solely on price or speed. A sound evaluation considers:

• accreditation status and exact scope;
• competence in the organization’s sector and technology;
• auditor availability and language capability;
• impartiality safeguards and consultancy restrictions;
• audit planning and reporting practices;
• treatment of complaints and appeals;
• experience with multisite or complex operations; and
• clarity of fees, audit time, travel, and follow-up arrangements.

When using laboratory services, organizations should examine the laboratory’s accredited scope, method edition, measurement range, uncertainty, reporting conditions, turnaround time, proficiency-testing performance, and handling of subcontracted work. Procurement personnel should avoid treating accreditation as a general label detached from technical scope.

Certification marks and accreditation symbols must be used according to controlled rules. An organization should not imply that a product itself is certified when only its management system is certified. Marketing statements must accurately describe the certificate, scope, sites, and status.

An Illustrative Case: Certification Integrity in a Multisite Manufacturer

Background

Meridian Components, a fictional manufacturer of precision assemblies, operates three sites and supplies safety-related components to international customers. Its quality management system was certified by an accredited certification body. The certificate covered design, procurement, production, inspection, and dispatch at two locations; the third site was not included.

Situation and Problem

A major customer discovered that a supplier-change approval had not been completed for a batch produced at the excluded site. Meridian’s sales department had nevertheless used the corporate certificate in a tender response, creating the impression that all three sites and all products were covered. At the same time, the certification body’s surveillance audit had focused heavily on the head office and had sampled few production activities at the certified sites.

Analysis

Three different issues were present. First, Meridian had misunderstood the certificate scope and made a misleading claim. Second, the change-control failure indicated a weakness in the management system. Third, the certification body needed to consider whether its surveillance program adequately reflected the organization’s multisite risk and operational complexity.

The customer’s laboratory also reported dimensional results from an external laboratory. Review showed that the laboratory was accredited, but the particular measurement method used was outside its accredited scope. The result therefore required a different level of qualification than Meridian had assumed.

Approach and Solution

Meridian immediately corrected its tender language, separated certified and non-certified activities in its communications, and notified the certification body of the significant production-site issue. It contained the affected batch, performed a technical review, completed supplier-change approval retrospectively where justified, and strengthened authorization controls.

The certification body conducted additional assessment at the relevant site and reviewed the effectiveness of corrective action. It revised the surveillance plan to increase sampling of production and change-control processes. Meridian changed its procurement procedure so that laboratory reports were checked against the exact accredited scope, method, and measurement range before being used for product-release decisions.

Outcome

The certificate remained valid after the additional assessment, but the scope was clarified and internal controls were strengthened. The customer accepted the corrective-action evidence. Meridian also introduced a certificate register, controlled use of certification marks, and annual training for sales, procurement, and quality personnel.

Learning Points

The case illustrates that certification is scope-specific, not a blanket endorsement of an entire organization. It also shows that accredited status must be examined at the level of the actual activity. Finally, surveillance effectiveness depends on risk-based sampling and on the certification body’s understanding of the client’s operational structure.

Risks, Limitations, and Professional Judgment

Certification and accreditation reduce uncertainty but do not eliminate it. Audits rely on sampling, so not every transaction, employee, product, or laboratory result is examined. A certificate may remain valid while isolated failures occur. The critical question is whether the management system is capable of detecting, correcting, and preventing such failures and whether the conformity-assessment process is sufficiently rigorous.

Common mistakes include choosing a body solely because it offers the lowest fee, confusing certification with accreditation, assuming that an accredited laboratory is competent for every method, failing to update the certification body about significant changes, treating corrective action as document preparation rather than risk reduction, and using certificates after suspension or withdrawal.

Ethically, auditors must report evidence fairly, maintain confidentiality, avoid conflicts, and resist pressure from clients. Certification bodies must protect the public interest even when commercial relationships are involved. Laboratories must report valid results honestly, including unfavorable results, uncertainty, deviations, and limitations. Organizations using certificates must not make claims that exceed the certified or accredited scope.

Digital systems create additional governance issues. Certification bodies and laboratories increasingly use electronic records, remote auditing, laboratory information-management systems, automated data capture, and analytics. These tools can improve traceability and risk-based sampling, but they introduce risks involving cybersecurity, data integrity, access control, system validation, and remote observation limitations. Artificial intelligence may assist in anomaly detection or document review, but professional accountability for certification decisions, laboratory results, and conformity judgments remains with competent personnel.

Current Developments and Best Practice

Conformity assessment is moving toward greater integration of risk, supply-chain assurance, climate-related information, cybersecurity, sustainability claims, and digitally enabled evidence. Remote and hybrid assessment techniques are becoming more common, particularly for document review, interviews, and selected technical activities. They should supplement rather than automatically replace appropriate onsite observation.

Organizations can strengthen assurance by maintaining a current register of certificates and accreditation scopes, linking supplier approval to evidence of competence, verifying certificate status before contracts are awarded, monitoring complaints and external failures, and conducting periodic reviews of the value and reliability of third-party services.

A mature organization treats certification not as a marketing badge but as one element of governance. It uses audit results to understand risk, improve processes, and communicate accurately with customers and regulators. Likewise, a mature conformity-assessment body treats every certificate or report as a professional statement that must be supported by competence, evidence, impartiality, and controlled decision-making.

Chapter Summary

Conformity assessment establishes whether specified requirements have been fulfilled. Certification is a third-party attestation of conformity, while accreditation is formal recognition that a conformity-assessment body is competent to perform defined activities. ISO/IEC 17021-1 governs management-system certification bodies, emphasizing impartiality, competence, consistent processes, independent certification decisions, and control of certification throughout its cycle. The cycle commonly includes application review, Stage 1, Stage 2, certification decision, surveillance, and recertification.

ISO/IEC 17025 addresses the competence and impartiality of testing and calibration laboratories. Its requirements include technically valid methods, competent personnel, suitable equipment, measurement traceability, uncertainty evaluation, quality assurance of results, and accurate reporting. Accreditation and international recognition arrangements increase confidence across borders, but users must always examine the precise scope and conditions. Effective conformity assessment depends on evidence, professional ethics, risk-based planning, transparent claims, and continuing competence.

Key Terms

Conformity assessment: Process for determining whether specified requirements have been fulfilled.

Certification: Third-party attestation that a product, system, process, service, or person conforms to specified requirements.

Accreditation: Formal recognition that a conformity-assessment body is competent to perform specified activities.

Certification body: Organization that audits and certifies conformity.

Accreditation body: Organization that assesses and accredits conformity-assessment bodies.

Impartiality: Objectivity and freedom from conflicts of interest or undue influence.

Competence: Demonstrated ability to apply knowledge and skills to achieve intended results.

Management-system certification: Certification of conformity of an organization’s management system to a specified standard.

Stage 1 audit: Initial audit stage that evaluates readiness, documentation, context, and planning for Stage 2.

Stage 2 audit: Audit stage that evaluates implementation and effectiveness of the management system.

Surveillance audit: Periodic assessment conducted between initial certification and recertification.

Recertification: Comprehensive reassessment conducted at the end of a certification cycle.

Scope of certification: Defined activities, locations, products, services, or processes covered by a certificate.

ISO/IEC 17021-1: Standard specifying requirements for bodies providing management-system audit and certification.

ISO/IEC 17025: Standard specifying competence and impartiality requirements for testing and calibration laboratories.

Measurement traceability: Property of a measurement result relating it to a reference through a documented calibration chain.

Measurement uncertainty: Parameter describing the dispersion associated with a measurement result.

Proficiency testing: Evaluation of laboratory performance through comparison with other laboratories or assigned values.

Recognition arrangement: Agreement supporting acceptance of conformity-assessment results between participating accreditation systems.

Self-review threat: Risk that an assessor evaluates work previously performed by the assessor or its organization.

Review Questions

Short Answer Questions

1. Distinguish certification from accreditation.

2. What is the purpose of surveillance auditing?

3. Why is impartiality essential to a certification body?

4. State two technical requirements addressed by ISO/IEC 17025.

5. What is meant by the scope of accreditation?

Long Answer Questions

1. Explain the stages of a management-system certification cycle and the purpose of each stage.

2. Discuss how ISO/IEC 17021-1 addresses competence and impartiality.

3. Explain the relationship among a client organization, certification body, accreditation body, and recognition arrangement.

4. Discuss the importance of measurement traceability, uncertainty, and proficiency testing in laboratory competence.

5. Evaluate the benefits and limitations of international recognition arrangements.

Analytical / Application Questions

1. An organization’s certificate covers production at two sites, but its sales team claims that the entire corporation is certified. Analyze the risks and propose corrective actions.

2. A laboratory is accredited for a chemical test but reports results using a different method and measurement range. What should a purchasing manager verify before accepting the report?

3. A certification body receives a large proportion of its revenue from one client and is asked to reduce audit time to meet the client’s production schedule. Evaluate the impartiality threats and recommend safeguards.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes accreditation from certification?

A. Accreditation is an organization’s internal audit, while certification is a regulatory inspection.

B. Accreditation recognizes the competence of a conformity-assessment body, while certification attests conformity of a defined subject.

C. Accreditation applies only to products, while certification applies only to laboratories.

D. Accreditation and certification are interchangeable terms under ISO standards.

Correct Answer: B. Accreditation recognizes the competence of a conformity-assessment body, while certification attests conformity of a defined subject.

Question 2

What is the principal purpose of Stage 2 in management-system certification?

A. To negotiate the certification fee

B. To evaluate implementation and effectiveness using objective evidence

C. To select the accreditation body

D. To replace internal auditing

Correct Answer: B. To evaluate implementation and effectiveness using objective evidence

Question 3

Which situation represents a self-review threat to impartiality?

A. An auditor reviews records produced by another department

B. An auditor evaluates a management system that the auditor previously designed through consultancy

C. An auditor interviews process owners

D. An auditor observes production activities

Correct Answer: B. An auditor evaluates a management system that the auditor previously designed through consultancy

Question 4

A laboratory’s accreditation applies only to selected methods listed in its scope. What follows from this?

A. All results produced by the laboratory are automatically accredited

B. The laboratory may claim accreditation only for activities within the defined scope

C. The laboratory cannot perform any non-accredited work

D. The customer need not review the test method

Correct Answer: B. The laboratory may claim accreditation only for activities within the defined scope

Question 5

Which activity is most characteristic of surveillance auditing?

A. Evaluating whether continued certification remains justified at the end of the cycle only

B. Periodic sampling of system processes and performance between certification and recertification

C. Granting accreditation to the certification body

D. Writing the client’s corrective-action procedure

Correct Answer: B. Periodic sampling of system processes and performance between certification and recertification

Question 6

Why is measurement uncertainty important in laboratory reporting?

A. It proves that every measurement is correct

B. It describes dispersion associated with a result and can affect conformity decisions

C. It eliminates the need for calibration

D. It replaces method validation

Correct Answer: B. It describes dispersion associated with a result and can affect conformity decisions

Question 7

A certification body discovers that a client has relocated a major production process without notification. What is the most appropriate response?

A. Ignore the change until the next routine audit

B. Determine whether the change affects scope, risk, and the need for additional assessment

C. Automatically issue a larger certificate scope

D. Transfer the certificate to another body without review

Correct Answer: B. Determine whether the change affects scope, risk, and the need for additional assessment

Question 8

What is a major practical benefit of an international recognition arrangement?

A. It guarantees acceptance of every certificate for every purpose

B. It can reduce duplication by supporting acceptance of results from recognized assessment systems

C. It removes the need to define accreditation scope

D. It permits laboratories to avoid quality control

Correct Answer: B. It can reduce duplication by supporting acceptance of results from recognized assessment systems

Question 9

Which evidence most directly supports laboratory competence?

A. An attractive laboratory brochure

B. Participation in appropriate proficiency testing combined with method and equipment controls

C. A promise to repeat failed tests until a desired result appears

D. A certificate for an unrelated management standard

Correct Answer: B. Participation in appropriate proficiency testing combined with method and equipment controls

Question 10

A company uses its management-system certificate to imply that every product is certified. What is the central problem?

A. The company has used a claim exceeding the certificate’s defined scope

B. The company has performed too many internal audits

C. The certification body must certify every individual product

D. Management-system certification prohibits customer communication

Correct Answer: A. The company has used a claim exceeding the certificate’s defined scope