ISO certification (eg ISO 9001: 2015) has a number of benefits. With us you can get the fastest, most complete and accurate information, including indicative prices and deadlines.
- Certification ensures improved efficiency, eliminates potential risks and contributes to the sustainable development of the organization.
- The certificate is a competitive advantage that builds the company image and creates more serious trust in your company.
- The presence of an internationally recognized certificate is a requirement in a number of tenders and public procurements.
Certification is the process of assessing an organization against international standards ISO (ISO is an abbreviation of the International Organization for Standardization) and specifications by an independent accredited body.
The point is to assess whether the company has a working management mechanism through which to achieve its goals and ensure to its customers, that it is a reliable partner.
The main principles of ISO certification are competence and impartiality.
Upon positive initial assessment (audit), the organization receives an internationally recognized ISO certificate valid for 3 years and is subject to surveillance for the period of validity of the certificate.
When your company achieves approval according to a standard, for example ISO 9001 or ISO 14001, you acquire the status of a Certified Organization and together with the certificate you receive the right to use our Certification Symbol.
Creation of the management system documentation, system implementation, internal audit and management review
You are sending an Order for Certification – Sending the request is not binding
After signing a contract, audit dates are planned and agreed
Review of the documentation of the relevant management system and verification of the level of readiness to conduct a Stage 2 audit. The report from this Stage may contain findings requiring the elimination of deficiencies before conducting an audit of Stage 2
Assessment of the introduction and the efficiency of the Management System. During the audit information and evidences must be collected in conformity with all requirements of the standard applicable to the Management System and the statutory and other external requirements related to the applied field of the System.
Based on the results of the audit, a certification decision is made Issuance and delivery of an ISO Certificate
Issuance and delivery of a Certificate with a validity period of three years
During the third year of validity of the certificate, a Request for renewal of the certification is sent and a contract for a new three-year period is signed.
Evaluation of the efficiency of the system in its entirety and continuous adequacy and implementation in the field of application for which it is certified, as well as its continuous improvement in order to increase the achievements of the organization
What is ISO Certification? (Basic concepts)
Hello,
If you are encountering ISO certification for the first time, it is easy to get confused.
What is ISO 9001? Standard, System, Certificate, or all three?
In this article, we will sort out the basic concepts and look at the entire process —
from choosing a standard and building a management system
to the audit, issuing a certificate, and what comes next.
ISO certification without complicated words. What is ISO Certification?
Standard. System. Certificate.
Three words that sound similar but mean three different things.
And this is where the confusion often begins: What is a company actually buying when it becomes ISO 9001 certified? What does the auditor check? What does the certificate certify? And why is certification necessary at all?
Let’s sort things out.
The three concepts you need to know
The easiest way to understand ISO certification is through the three basic concepts:
- Standard
- Management system
- Certificate
The connection between them is simple:
The standard contains the requirements.
The system shows how the company implements them.
The certificate certifies that this compliance has been verified.
There can be no certification if there is no system that meets the requirements of the relevant standard.
1. The Standard: “This is what it should be”
The first concept is the standard.
It sets requirements for the management system. For example, it says:
- the company must set goals;
- must allocate roles and responsibilities;
- must select its suppliers;
- must train its staff;
- must maintain its infrastructure;
- and so on.
But there is something very important:
The standard tells you what needs to be done, but it doesn’t tell you in detail how to do it.
The requirements in the standards are usually formed based on global best practices — repeated practices from successful organizations that have contributed to their successful functioning.
Among the most popular standards are:
- ISO 9001 – quality management;
- ISO 14001 – environment;
- ISO 45001 – occupational health and safety;
- ISO/IEC 27001 – information security;
- ISO 22000 – food safety;
- ISO 50001 – energy management;
- and others.
Thus, the standard provides the framework.
But the company itself must decide how this framework will be applied to its specific business.
2. The Management System: “This is how we do it”
Here comes the second concept – the management system.
A management system is a tool for achieving a company’s goals. It contains rules, policies, and documented results for the operation and implementation of these rules and policies.
Most importantly, the system is not just documentation.
It must work in the real activities of the organization.
For example, if the standard says you should select your suppliers, it doesn’t necessarily tell you exactly what criteria to use to do so.
That’s up to you.
You can define criteria related to quality, reliability, deadlines, price, or other factors that are important to your business and achieving your goals.
This is where the standard and the system meet:
The standard sets the requirement.
The company builds the way it will fulfill it through the management system.
How is the system built?
There are different approaches.
The company can:
- build the system independently with its own resources, training and participation of its staff;
- work with a consultant to help the team build and implement the system;
- fully outsource the creation of the documentation to an external organization.
The latter option often makes the process faster, but it also has a potential drawback: the outsider does not know the specifics of the company in detail and may create rules that are not sufficiently suitable for real processes.
Therefore, the system must be tailored to the specific organization, and not simply exist as a set of documents.
The system doesn’t have to be perfect. It has to evolve.
This is one of the most important ideas in management systems.
The system is a living thing.
It can be improved, and it is the constant pursuit of improvement that is one of the main goals of management systems.
They are based on the PDCA cycle:
Plan → Do → Check → Act.
Therefore, one should not expect everything to be perfect from the beginning.
More importantly, the organization must make constant and consistent efforts for improvement.
ISO 9001 should not stand alone
The ISO 9001 quality management system should not be some parallel system of corporate governance.
The idea is for the company management system to integrate the requirements of the standard and apply them in real work.
For example, in the commercial process it is necessary to:
- familiarize yourself with the client’s requirements;
- check whether you can fulfill them before making a commitment;
- do what is necessary to comply with them;
- if the requirements change, confirm that you can meet them again;
- if you can’t, negotiate with the client what you can provide.
The goal is to align the customer’s expectations and what the organization can provide.
Because a satisfied customer is one whose expectations are met by the supplier.
And quality is related to meeting customer requirements.
3. The Certificate: “Conformity established”
Here we come to the third concept – the certificate.
It is the result of the certification process.
But why is certification often required when selecting suppliers — for example, by other organizations or government agencies?
Because it gives confidence to the client that the contractor is capable of completing a given task with a view to certain goals.
For example:
- ISO 9001 – regarding quality;
- ISO 14001 – regarding the environment;
- ISO 45001 – regarding occupational health and safety;
- etc.
On the one hand, certification is a mechanism for checking whether things are happening as they should.
On the other hand, it gives confidence to people who are interested that the necessary things have been done and that a competent and impartial party has verified it.
Who issues the certificate?
This is the role of the certification organization – Accredited Certification Body.
The two main characteristics that are important here are competence and independence, which in turn are proven through the mechanism of accreditation.
That’s why there is talk of a third independent party.
We have:
Contractor (company requesting certification) → Independent third party (certification body) → Contracting Authority (specific client)
The third party inspects the contractor and declares what it has found — including whether compliance with the requirements of the standard has been established.
This creates trust not only among the specific client, but also among other stakeholders.
What does an auditor actually do?
The certification body sends an auditor who checks the management system.
The inspection usually includes:
- review of documentation;
- checking whether the system meets the requirements of the standard;
- verification of evidence that the system actually functions;
- review of personnel files;
- review of customer orders;
- production orders;
- design orders;
- interviews with staff;
- monitoring of activity.
That is, the auditor does not only check what is written on paper.
It also checks what is actually happening.
Certification is not a one-time event
And here is another important detail.
Certification does not end with the issuance of the certificate.
The process begins when a company decides to become certified.
It:
- selects the standard;
- familiarizes itself with its requirements;
- creates the management system documentation;
- begins to implement it;
- contacts a certification body for an audit.
The initial certification audit is in two stages:
Stage 1 – The main attributes of the management system documentation are checked.
Stage 2 – A substantive audit of the activity is performed.
Audits are followed by reports that are subject to independent review.
If everything is in order, a certificate is issued with a conditional validity of three years.
But the checks continue.
What is the certification cycle?
Surveillance audits are carried out every year.
Their purpose is to confirm that the management system continues to comply with the requirements.
And the reason is simple.
In many management initiatives, there is a risk of the familiar:
“Every miracle in three days.”
Something is introduced, used for a while, and then gradually forgotten.
Therefore, annual audits verify whether the system continues to be maintained and implemented.
This is how the so-called three-year certification cycle is formed:
Certification → Surveillance → Surveillance → Recertification → Surveillance → Surveillance → …
And this cycle continues as long as the company wishes to maintain its certification.
So — let’s remember the three “concepts”
If we had to summarize everything from this article in just three sentences:
The standard contains the requirements.
It specifies what needs to be accomplished, but does not detail exactly how to do it.
The management system shows how the company implements these requirements.
It defines what is done and how it is done and contains the evidence that it was done.
The certificate certifies the result of the independent verification.
It is issued by a certification body based on an audit and certifies to the public that a given company, for a specific activity and at specific sites, has been assessed and approved for compliance with the requirements of the relevant standard.
Standard. System. Certificate.
Three concepts that should no longer sound the same.
And now it’s your turn.
And if you still have questions about which standard is applicable, how the system is built, or how the certification itself takes place — don’t leave your questions for later.
Our colleagues are ready to answer all your questions.
