Certification, Accreditation and Conformity Assessment

Introduction and context

Organizations increasingly use conformity assessment to demonstrate that products, services, processes, laboratories and management systems satisfy specified requirements. Such demonstrations support procurement, regulation, market access, public confidence and continual improvement. However, the terms certification, accreditation, inspection, testing and conformity assessment are not interchangeable. Confusing them can lead to misleading claims, weak supplier controls and inappropriate reliance on certificates.

Conformity assessment is the systematic process of demonstrating whether specified requirements are fulfilled. The requirements may be contained in an ISO standard, legislation, a customer specification, a technical regulation or a certification scheme. The activity may involve testing, inspection, auditing, validation, verification, certification or combinations of these activities.

Certification is a third-party attestation that a product, process, service, person or management system conforms to specified requirements. Accreditation is a formal recognition by an authoritative accreditation body that a conformity assessment body (CAB) is competent to perform specified conformity assessment activities. Thus, a certification body certifies organizations, while an accreditation body assesses the competence and impartiality of certification bodies.

This chapter examines the certification cycle, audit stages, surveillance, recertification, scope changes and certification decisions. It also distinguishes ISO/IEC 17021-1, ISO/IEC 17025 and ISO/IEC 17065, and evaluates accreditation and impartiality controls.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the structure and purpose of a management-system certification cycle.
2. Distinguish Stage 1 and Stage 2 audits and identify appropriate audit evidence.
3. Explain surveillance, recertification, special audits and scope changes.
4. Analyse how certification decisions are made and controlled.
5. Distinguish the roles of ISO/IEC 17021-1, ISO/IEC 17025 and ISO/IEC 17065.
6. Evaluate accreditation arrangements and threats to impartiality.
7. Apply conformity-assessment principles to an organizational case.

1. The conformity-assessment architecture

A typical conformity-assessment relationship contains four levels:

• Standard or requirement owner: develops or establishes requirements, such as an ISO committee, regulator, customer or scheme owner.
• Conformity assessment body: performs auditing, testing, inspection, validation, verification or certification.
• Accreditation body: evaluates whether the CAB is competent, impartial and consistently operated for defined activities.
• Customer and interested parties: use the resulting report, certificate or test result to make decisions.

Accreditation is generally voluntary unless legislation, regulators or customers require it. Certification may also be voluntary, but a market or regulator may make it a practical condition of doing business. Accreditation does not mean that every result produced by a CAB is automatically correct; it means that the CAB has demonstrated competence for a defined scope under specified accreditation criteria.

The central principle is competence matched to scope. A laboratory accredited for chemical analysis of drinking water is not thereby accredited for medical diagnosis. A certification body accredited for quality management systems is not automatically accredited for every product-certification scheme. The scope of accreditation must be examined carefully.

2. Certification of management systems

Management-system certification evaluates whether an organization has established and implemented a system that conforms to a specified standard, such as ISO 9001, ISO 14001 or ISO 45001. Certification does not normally guarantee that every product is defect-free or that every environmental impact is eliminated. It provides evidence that the audited management system meets the certification requirements within the stated scope and at the time of assessment.

A certification body must determine audit time and competence according to factors such as organizational size, number and complexity of processes, locations, shifts, technological intensity, regulatory risk and the certification scheme. Audit duration must not be reduced merely because an organization wants a cheaper or faster audit.

The certification cycle

A conventional management-system certification cycle consists of:

1. application and contract review;
2. audit programme planning;
3. Stage 1 audit;
4. Stage 2 audit;
5. independent certification decision;
6. surveillance audits during the certification period;
7. recertification before expiry;
8. exceptional or special audits when necessary.

The exact duration and timing are governed by the applicable standard, ISO/IEC 17021-1, accreditation requirements and scheme rules. A three-year cycle with periodic surveillance is common, but it should not be treated as a universal legal rule.

Figure: A simplified management-system certification cycle.

3. Stage 1 and Stage 2 audits

Stage 1: readiness and planning

Stage 1 is primarily a readiness assessment. The audit team examines documented information and organizational context sufficiently to plan Stage 2. Typical activities include:

• reviewing the management system’s documented information;
• understanding the organization, its sites, processes and activities;
• evaluating whether the scope is appropriately defined;
• examining significant aspects, hazards, risks or compliance obligations, as relevant;
• assessing internal-audit and management-review planning;
• determining whether resources and operational arrangements appear adequate for Stage 2;
• identifying areas requiring particular attention.

Stage 1 is not a superficial document check. It should establish whether the organization is sufficiently prepared for an effective evaluation of implementation. The auditor may identify concerns, but the organization should not assume that a successful Stage 1 guarantees certification.

Stage 1 may be conducted partly or wholly on site, remotely or through a combination of methods when permitted by applicable rules. The decision should consider complexity, location, risk, technology and the reliability of remote evidence.

Stage 2: implementation and effectiveness

Stage 2 evaluates implementation and effectiveness of the management system against the certification requirements. Auditors follow process trails and sample objective evidence, including records, observations, interviews, performance data, operational controls, corrective actions and compliance evaluations where relevant.

A Stage 2 audit should answer questions such as:

• Are required processes established and controlled?
• Are responsibilities understood and implemented?
• Does the organization produce planned outputs?
• Are risks and opportunities addressed in practice?
• Are objectives monitored and evaluated?
• Are nonconformities corrected and their causes addressed?
• Is the system capable of achieving intended results?

Auditors do not certify isolated documents. They evaluate conformity through sampling. Consequently, an audit conclusion is evidence-based but not an absolute inspection of every transaction, employee or product.

Findings and nonconformities

A nonconformity is the non-fulfilment of a requirement. Findings should be traceable to an identifiable requirement and supported by objective evidence. A major nonconformity generally indicates a failure that affects the capability of the management system to achieve intended results, or a substantial doubt about effective control. A minor nonconformity is a limited lapse that does not indicate such a systemic failure. The exact classification must follow applicable certification rules and the certification body’s documented process.

The organization should analyse causes, correct the immediate problem, implement corrective action and provide evidence. The certification body reviews the response and, where required, verifies implementation before certification or continued certification. A corrective-action promise without credible evidence is not equivalent to correction and effectiveness.

4. Surveillance and recertification

Surveillance audits

Surveillance audits are periodic audits conducted during the certification period. They are less extensive than initial certification audits but must provide sufficient evidence that the system continues to meet requirements. Surveillance normally includes selected processes, internal audits, management review, complaints, performance results, changes, corrective actions and relevant operational controls. Sampling should vary over time so that the entire system is not repeatedly reduced to a narrow set of convenient processes.

Surveillance is not a maintenance formality. Significant changes, serious complaints, incidents, regulatory action, poor performance or ineffective corrective action may justify additional audit activity. Failure to permit required surveillance can lead to suspension or withdrawal under the certification body’s rules.

Recertification

Recertification is a comprehensive assessment performed before the certificate expires. It evaluates continuing conformity and effectiveness over the certification cycle, including performance trends, internal-audit results, management reviews, complaints, changes and previous nonconformities. Recertification is not merely an automatic extension of the existing certificate.

If the recertification decision is delayed beyond expiry, the organization cannot normally represent the certificate as continuously valid unless the applicable rules explicitly permit it. A certification body may have defined conditions for restoring or renewing certification, but these must be transparent and controlled.

5. Scope, transfer and special audits

The certification scope identifies the activities, products or services, locations and organizational boundaries covered. A certificate must not imply certification of activities excluded from the scope. Scope wording should be clear enough for customers and regulators to understand what has actually been assessed.

A scope extension adds activities, sites, products or processes. It may require document review, a special audit, additional audit time or evaluation during a scheduled audit. The certification body should assess whether the existing audit team has suitable competence.

A scope reduction removes activities or locations. It may be initiated by the organization or required when parts of the system no longer conform. The reduction must not be used to conceal unresolved nonconformities in the remaining system.

A transfer occurs when a certified organization changes certification body. The receiving body should review the certificate, audit reports, complaints, open nonconformities, legal status and reasons for transfer. Transfer is not a mechanism for escaping valid adverse findings.

Special audits may be required for significant changes, serious incidents, complaints, suspension conditions or urgent scope modifications. The audit plan should be proportionate to risk and should preserve impartiality.

6. Certification decisions and governance

Auditors collect evidence and recommend an outcome, but the final certification decision must be made by authorized personnel who were not members of the audit team and who have sufficient competence. This separation reduces confirmation bias and commercial pressure. The decision-maker should review the audit report, findings, corrective-action evidence, audit objectives, scope, competence arrangements and any unresolved issues.

Possible outcomes include:

• granting certification;
• refusing certification;
• maintaining certification;
• renewing certification;
• expanding or reducing scope;
• suspending certification temporarily;
• restoring certification after conditions are met;
• withdrawing or cancelling certification.

A certification decision should be supported by documented evidence and communicated clearly. The organization must have access to a complaints and appeals process. Complaints about certified clients, auditors or decisions should be investigated by competent personnel who are independent of the subject of the complaint as far as practicable.

7. Three important conformity-assessment standards

ISO/IEC 17021-1

ISO/IEC 17021-1 specifies principles and requirements for bodies that audit and certify management systems. Its emphasis includes competence, consistent audit processes, impartiality, responsibility for decisions, confidentiality, public information, management of appeals and complaints, and control of the certification process.

It applies to management-system certification bodies, not directly to testing laboratories or product-certification bodies. A certification body may use additional sector-specific competence requirements where the management system concerns specialized activities.

ISO/IEC 17025

ISO/IEC 17025 specifies general requirements for the competence, impartiality and consistent operation of testing and calibration laboratories. It addresses structural and resource requirements, equipment, metrological traceability, process controls, reporting, management-system arrangements and validity of results.

A laboratory’s competence is demonstrated through technically valid results, suitable methods, competent personnel, controlled equipment and appropriate quality assurance. Accreditation is scope-specific: it may identify particular methods, measurands, ranges, matrices and locations. A laboratory certificate is not the same as a management-system certificate.

ISO/IEC 17065

ISO/IEC 17065 specifies requirements for bodies certifying products, processes and services. It addresses competence, impartiality, consistent certification processes, evaluation, review, decision-making, licensing or certification marks, surveillance where applicable, complaints and appeals.

Product certification normally involves defined evaluation requirements and a certification scheme. Depending on the scheme, evaluation may include testing, inspection, factory assessment, sampling and surveillance. Certification of a product does not automatically certify the manufacturer’s entire management system, although a scheme may require management-system controls.

8. Accreditation and impartiality

Accreditation process

An accreditation body typically performs application review, scope review, document assessment, witness assessment, on-site assessment, findings, corrective-action review, accreditation decision and continuing surveillance. Assessors evaluate both the CAB’s documented system and its actual performance. Witnessing an audit, test or inspection is particularly important because competence cannot be established solely from procedures.

Accreditation decisions should be made by personnel or committees independent of the assessment activity and free from conflicts of interest. Accreditation is maintained only while the CAB continues to meet requirements.

Impartiality threats

Impartiality means the presence of objectivity. It can be threatened by:

• self-interest, such as financial dependence on one client;
• self-review, such as auditing consultancy work performed by the same organization;
• familiarity, friendship or excessive long-term association;
• intimidation, including threats of lost business;
• advocacy, such as promoting a client’s interests;
• competition between related business units;
• pressure to issue certificates for commercial reasons.

Controls should be risk-based rather than merely declarative. Useful controls include conflict-of-interest declarations, impartiality committees or mechanisms, separation of consultancy and certification, rotation or review arrangements, competence authorization, independent certification decisions, protection for whistleblowers, transparent fee policies and analysis of complaints and appeals.

A certification body should not offer management-system consultancy to an organization it certifies. Training may also create risks if it is presented as necessary preparation for certification or if the provider later audits the same implementation. The appearance of impartiality matters as well as actual independence, because confidence can be damaged even when no improper decision is proven.

9. Technology, remote assessment and data governance

Remote auditing technologies can improve access to distributed sites, reduce travel and support document review. Video interviews, secure records access, virtual tours, digital sampling and data analytics may supplement conventional methods. Nevertheless, remote methods can weaken observation, restrict access to evidence, create identity concerns and increase cybersecurity risks.

The audit method should therefore be justified by risk and evidence quality. The CAB should control confidentiality, access rights, recording, data retention and cyber protection. Artificial intelligence may assist with document search, anomaly detection or sampling, but it should not replace professional judgement, evidence evaluation or the authorized certification decision. AI-generated summaries require verification because omissions, hallucinations and embedded bias can affect audit conclusions.

10. Applied case: illustrative manufacturing certification decision

Background

A fictional company, Meridian Components, manufactures precision valves at two sites. It holds an ISO 9001 certificate for design, production and servicing at Site A. It plans to add Site B and include a new medical-device customer segment in its scope.

Problem

During surveillance, auditors find that internal audits at Site B were incomplete, calibration records for two measuring devices were missing, and a customer complaint had not been evaluated for systemic causes. Management argues that the products passed final inspection and asks the certification body to add Site B immediately.

Analysis

Passing final inspection does not demonstrate that the management system is effective. The missing calibration evidence creates uncertainty about measurement validity. The incomplete internal audit reduces confidence in the organization’s ability to evaluate its own processes. The unresolved complaint indicates a weakness in corrective action. Because the proposed scope extension includes a higher-risk customer sector, the certification body must also confirm auditor competence and any applicable scheme or regulatory requirements.

Approach and solution

The certification body records the findings against relevant requirements, classifies them according to its rules and requires correction and corrective action. Meridian quarantines potentially affected measurement results, recalibrates or replaces equipment, reviews product impact, completes a competent internal audit and performs a root-cause analysis of the complaint. The certification body conducts a special or extension audit, reviews objective evidence and uses an independent decision-maker. Site B is added only if the evidence supports conformity and the certificate scope is rewritten accurately.

Outcome

The scope extension is initially deferred. After effective corrective action is verified, Site B is added with the medical-device activity precisely defined. The certification body increases attention to measurement control and complaint analysis at the next surveillance audit.

Learning points

1. Certification is based on system evidence, not only final-product results.
2. Scope changes require competence, planning and a defensible decision.
3. Corrective action must address causes and effectiveness, not only immediate correction.
4. Independent decision-making protects credibility.
5. Accreditation scope and auditor competence must match the activity being assessed.

11. Challenges, limitations and best practices

Certification has limitations. Audits use sampling and occur at defined times; poor performance may exist between audits. A certificate can be misunderstood as a guarantee of product quality, legal compliance or business success. Accreditation also cannot eliminate all human error. Its value depends on competent assessors, credible evidence, effective oversight and transparent scope statements.

Best practice for organizations includes selecting a CAB with appropriate accreditation and sector competence, reading the scope carefully, preparing truthful information, treating audit findings as improvement opportunities and avoiding exaggerated certification claims. Best practice for CABs includes risk-based planning, competent teams, sufficient audit time, robust impartiality controls, independent decisions, secure records, effective complaint handling and public accuracy of certificates. Best practice for accreditation bodies includes competent assessment teams, witness assessment, consistent criteria, impartial decisions and proportionate ongoing surveillance.

Chapter Summary

Conformity assessment demonstrates whether specified requirements are fulfilled through activities such as testing, inspection, auditing and certification. Certification is a third-party conformity statement, whereas accreditation is recognition of a conformity assessment body’s competence and impartiality for a defined scope.

Management-system certification commonly proceeds through application review, Stage 1 readiness assessment, Stage 2 implementation assessment, an independent certification decision, surveillance and recertification. Stage 1 supports readiness and audit planning; Stage 2 evaluates implementation and effectiveness. Surveillance verifies continuing conformity, while recertification is a comprehensive renewal assessment. Scope extensions, reductions, transfers and special audits require controlled evaluation and accurate certificate wording.

ISO/IEC 17021-1 concerns management-system certification bodies, ISO/IEC 17025 concerns testing and calibration laboratory competence, and ISO/IEC 17065 concerns product, process and service certification bodies. Impartiality threats include self-interest, self-review, familiarity, intimidation and advocacy. Effective controls include separation of consultancy and certification, conflict management, independent decisions, competent personnel and transparent complaints and appeals processes. Technology and AI can support assessment but cannot replace competent professional judgement.

Key Terms

Conformity assessment: The process of demonstrating whether specified requirements are fulfilled.

Certification: Third-party attestation that a specified object conforms to requirements.

Accreditation: Formal recognition that a conformity assessment body is competent for a defined scope.

Conformity assessment body (CAB): An organization performing activities such as testing, inspection, auditing or certification.

Certification body: A body that audits and certifies conformity of specified objects.

Stage 1 audit: A readiness and planning assessment preceding the main certification assessment.

Stage 2 audit: An assessment of implementation and effectiveness against certification requirements.

Surveillance audit: A periodic audit conducted during a certification period.

Recertification: A comprehensive assessment intended to renew certification.

Certification scope: The defined activities, sites, products, services or processes covered by a certificate.

Scope extension: Addition of activities, sites, products or processes to certification.

Nonconformity: Non-fulfilment of a specified requirement.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Impartiality: Objectivity and freedom from conflicts that could influence a conformity decision.

Objective evidence: Verifiable information supporting an audit conclusion.

ISO/IEC 17021-1: Requirements for bodies providing audit and certification of management systems.

ISO/IEC 17025: Requirements for competence and consistent operation of testing and calibration laboratories.

ISO/IEC 17065: Requirements for bodies certifying products, processes and services.

Certification decision: Formal determination to grant, maintain, renew, change, suspend or withdraw certification.

Special audit: An additional assessment prompted by events such as major changes, complaints or scope modification.

Review Questions

Short Answer Questions

1. What is the principal difference between certification and accreditation?
2. What are the main purposes of a Stage 1 audit?
3. Why is Stage 2 more than a review of documented procedures?
4. What is meant by certification scope?
5. Identify two threats to impartiality.

Long Answer Questions

1. Explain the complete management-system certification cycle from application through recertification.
2. Compare ISO/IEC 17021-1, ISO/IEC 17025 and ISO/IEC 17065 in terms of purpose, body covered and typical output.
3. Discuss how a certification body should manage major and minor nonconformities.
4. Explain the accreditation process and the role of witness assessment.
5. Evaluate the benefits and limitations of remote auditing and AI-assisted audit activities.

Analytical / Application Questions

1. An organization requests a scope extension after a serious customer complaint. Design a defensible audit and certification-decision process.
2. A laboratory accredited for calibration seeks to issue reports for a new chemical-testing method. Analyse the competence and accreditation issues that must be resolved.
3. A certification body receives substantial revenue from one client and proposes that the same consultant who implemented the client’s system conduct its certification audit. Evaluate the impartiality risks and recommend controls.

Multiple Choice Questions with Answers

Question 1

Which activity is primarily covered by ISO/IEC 17021-1?

A. Certification of management systems

B. Calibration of laboratory equipment

C. Certification of products and services

D. Regulatory inspection of imported goods

Correct Answer: A. Certification of management systems

Question 2

What is the principal purpose of a Stage 1 audit?

A. To issue the final certificate

B. To assess readiness and support Stage 2 planning

C. To replace all surveillance audits

D. To investigate every customer complaint

Correct Answer: B. To assess readiness and support Stage 2 planning

Question 3

Which statement best describes accreditation?

A. A guarantee that every product made by a client is defect-free

B. Recognition that a conformity assessment body is competent for a defined scope

C. A certificate issued by a supplier to its customer

D. An internal audit performed by top management

Correct Answer: B. Recognition that a conformity assessment body is competent for a defined scope

Question 4

Which standard addresses competence and consistent operation of testing and calibration laboratories?

A. ISO/IEC 17021-1

B. ISO/IEC 17025

C. ISO/IEC 17065

D. ISO 9001

Correct Answer: B. ISO/IEC 17025

Question 5

Which event normally requires a comprehensive assessment before renewal of management-system certification?

A. Routine document filing

B. Recertification

C. An internal toolbox talk

D. A supplier quotation

Correct Answer: B. Recertification

Question 6

Which is an example of a self-review threat to impartiality?

A. An auditor reviews work previously performed as consultancy by the same organization

B. An auditor uses a sampling plan

C. A client submits an appeal

D. An accreditation body conducts witness assessment

Correct Answer: A. An auditor reviews work previously performed as consultancy by the same organization

Question 7

What is the most appropriate basis for a certification decision?

A. The client’s marketing reputation alone

B. Objective audit evidence and verified corrective-action information

C. The lowest available audit price

D. A verbal promise to improve later

Correct Answer: B. Objective audit evidence and verified corrective-action information

Question 8

What does a scope extension involve?

A. Removing an activity from a certificate

B. Adding activities, sites, products or processes to certification

C. Transferring a certificate to another client

D. Automatically renewing an expired certificate

Correct Answer: B. Adding activities, sites, products or processes to certification

Question 9

Which standard is principally associated with product, process and service certification bodies?

A. ISO/IEC 17065

B. ISO/IEC 17025

C. ISO/IEC 17021-1

D. ISO 19011 only

Correct Answer: A. ISO/IEC 17065

Question 10

Why should the final certification decision normally be separated from the audit team?

A. To eliminate the need for audit evidence

B. To reduce conflicts of interest and confirmation bias

C. To ensure the client writes the decision

D. To avoid defining the certification scope

Correct Answer: B. To reduce conflicts of interest and confirmation bias