Answers to the questions organizations ask most about ISO certification, audits, accreditation and certificate verification.
ISO certification basics
What is ISO certification?
ISO certification is independent confirmation, by a certification body, that an organization’s management system meets the requirements of an ISO standard such as ISO 9001. The certification body audits the system and, if requirements are met, issues a certificate valid for three years, subject to annual surveillance.
Does ISO issue certificates?
No. ISO develops and publishes standards but does not certify organizations. Certificates are issued by independent certification bodies, such as US Global Standards Registrars, after an audit.
What does a certification body do?
A certification body plans and conducts audits against a standard, makes an independent certification decision, issues certificates and keeps them under surveillance. It does not write or implement the management system it certifies.
Is ISO certification mandatory?
Usually not. ISO certification is voluntary, but customers, tenders and supply chains often require it as a condition of doing business.
What are the benefits of ISO certification?
Certification gives customers independent evidence that your processes are controlled. It helps you meet tender requirements, reduce errors and repeat problems, and gives buyers a certificate they can check online.
Which ISO standard should my organization get certified to?
Start with what your customers and tenders ask for. ISO 9001 is the most common, followed by ISO 14001 and ISO 45001 in many sectors. Sector or risk needs may point to ISO/IEC 27001, ISO 22000 or ISO 13485.
What is a management system?
A management system is the set of policies, processes, roles and records an organization uses to achieve its objectives, for example on quality, safety or information security.
Can small businesses get ISO certified?
Yes. ISO management system standards apply to organizations of any size. Audit time is based on headcount and complexity, so audits for small businesses are shorter.
What is the difference between ISO certification and ISO compliance?
Compliance means an organization says it follows a standard. Certification means an independent certification body has audited the system and issued a certificate.
Can one organization hold several ISO certificates?
Yes. Many organizations hold ISO 9001, ISO 14001 and ISO 45001 together, and these can be audited in one integrated audit programme.
The certification process
What are the steps to get ISO certified?
Application, proposal and agreement, Stage 1 audit, Stage 2 audit, correction of any nonconformities, and an independent certification decision. The certificate is then maintained through annual surveillance and recertification every three years.
How do I apply for ISO certification?
Send us the standard, your scope, number of employees and number of sites through the Request a Quote form. We confirm audit time and send a written proposal.
What information is needed for a certification quote?
The standard(s), scope of activities, total headcount including contractors, number and locations of sites, shift patterns and outsourced processes.
Who makes the certification decision?
A competent person or committee at US Global Standards Registrars who did not take part in the audit.
What is a nonconformity?
A requirement of the standard, or of your own system, that is not fulfilled. Auditors grade it as major or minor and record the evidence.
What is the difference between a major and a minor nonconformity?
A major nonconformity affects the system’s ability to achieve its intended results and must be corrected and verified before certification. A minor nonconformity is a partial or isolated lapse handled through an accepted action plan.
What is an opportunity for improvement?
An observation where the auditor sees potential to do better but no requirement is breached. Acting on it is optional.
Can you fail an ISO audit?
There is no pass or fail score. Nonconformities are corrected and verified, and certification is granted once the evidence shows requirements are met.
What appears on an ISO certificate?
The organization’s name, certified sites, standard and edition, scope, certificate number, dates and the accreditation reference where applicable.
What is a certification scope?
The activities, products, services and sites covered by the certificate. Customers should check that the scope matches what they are buying.
Stage 1 and Stage 2 audits
What is a Stage 1 audit?
The first part of initial certification: a review of your documented information, scope, site conditions and readiness, used to plan Stage 2.
Is the Stage 1 audit done on site?
Often, yes. Part or all of Stage 1 is usually on site. Some document review may be remote.
What documents are reviewed at Stage 1?
Scope, policy, objectives, required documented information, risk or hazard assessments, legal requirements, internal audit results and management review records.
What happens if issues are found at Stage 1?
The auditor records areas of concern for you to address before Stage 2. If key elements are missing, Stage 2 may be postponed.
How long between Stage 1 and Stage 2?
Long enough to resolve Stage 1 concerns, typically a few weeks.
What is a Stage 2 audit?
The certification audit that evaluates whether your system is implemented and effective, through interviews, observation and record sampling.
What happens during a Stage 2 audit?
An opening meeting, the audit plan across processes and sites, and a closing meeting where findings and next steps are presented.
Who should be available during the Stage 2 audit?
Top management, process owners, the system coordinator and staff performing the work being audited.
How many days does a Stage 2 audit take?
It depends on headcount, sites, complexity and the standard. Your proposal states the exact audit days.
When will we receive our certificate after Stage 2?
After any nonconformities are closed and the independent decision is made, usually within a few weeks.
Surveillance and recertification
What is a surveillance audit?
A periodic audit during the three-year cycle that confirms your system continues to meet the standard.
How often are surveillance audits held?
At least once a year; the first within 12 months of the initial certification decision.
What do auditors check at surveillance?
Internal audits, management review, previous nonconformities, complaints, changes, use of marks and a sample of operational processes.
What happens if we miss a surveillance audit?
The certificate may be suspended and shows as Suspended in the verification system until the audit is completed.
Can certification be suspended or withdrawn?
Yes, for reasons such as overdue surveillance, unresolved major nonconformities or misuse of the certificate.
What is a recertification audit?
A full reassessment before the three-year certificate expires, leading to a new three-year certificate.
When should we schedule recertification?
A few months before expiry, so the audit and decision are completed before the expiry date.
What happens if our certificate expires before recertification?
It shows as Expired and can no longer be used. Restoration may be possible within a limited period.
Is a recertification audit shorter than the initial audit?
Usually yes, typically around two-thirds of initial audit time.
Can we add a standard or extend our scope mid-cycle?
Yes. An extension can be audited at a surveillance visit or a special audit, and the certificate is reissued.
Transfer certification
Can I transfer my ISO certificate to another certification body?
Yes, in most cases, without restarting the cycle, after a review of your certificate, reports and open nonconformities.
Which certificates can be transferred?
Valid certificates, within their cycle, for a standard and scope the new body can certify.
What documents are needed for a transfer?
Current certificate, last certification or recertification report, latest surveillance report and status of open nonconformities.
Does a transfer reset the certification cycle?
No. A transfer normally keeps your existing cycle.
Will my certificate have the same recognition after transfer?
The new certificate is issued under USGSR’s own accreditation status. Confirm your customers’ requirements with them and with us before transferring.
How long does a certificate transfer take?
The document review usually takes a few working days; a transfer visit is scheduled if needed.
Accreditation and certificate types
What is the difference between accreditation and certification?
Certification confirms an organization meets a standard. Accreditation confirms the certification body is competent and impartial.
Is US Global Standards Registrars accredited?
Yes. US Global Standards Registrars is accredited by USIAS (United State International Accreditation Services). Details are on our Accreditation page.
What is an accredited certificate?
A certificate issued within the certification body’s accreditation scope, showing the accreditation reference.
What is a compliance certificate?
A USGSR certificate confirming an audit against published requirements, for example FSSC 22000 or BRCGS. It is not a scheme-owner certificate and not GFSI-recognized.
How do I check a certification body’s accreditation?
Ask the certification body for its accreditation certificate. For USGSR, see our Accreditation page.
Will my customer accept a USGSR certificate?
It depends on your customer’s requirements. Ask what they accept, then confirm with us before applying.
Cost and timelines
How much does ISO certification cost?
Cost depends on audit time, set by headcount, sites, complexity and the standard. Request a written proposal.
What is included in the certification fee?
Audit days for each audit, the decision, the certificate and the verification listing; travel is stated separately.
Are there annual costs after certification?
Yes: annual surveillance audits and recertification every three years.
Why do quotes from certification bodies differ?
Audit days, travel, accreditation status and what is included. Compare audit days, not just price.
Does certifying several standards together cost less?
Often yes, because shared elements are audited once in an integrated audit.
How long does it take to get ISO certified?
Once your system is producing records, Stage 1 and Stage 2 usually take a few weeks to a few months.
How quickly can you schedule our audit?
It depends on auditor availability; tell us your target date when requesting a quote.
How long must our system operate before certification?
Long enough to produce records, with at least one internal audit and management review.
How long is an ISO certificate valid?
Three years from the certification decision, subject to surveillance.
Can audits be carried out remotely?
Some activities can be remote where our rules allow; most audits include on-site work.
Audit preparation
How do we prepare for an ISO certification audit?
Make sure the system is implemented and producing records, complete an internal audit and management review, and brief the people who will be interviewed.
What records do auditors usually ask for?
Scope, policy, objectives, risk assessments, training records, operational records, supplier evaluations, monitoring results, internal audits and management reviews.
Do we need a quality manual?
Not for ISO 9001:2015. Some standards, such as ISO 13485, still require one.
Should staff memorize our policy for the audit?
No. Auditors look for understanding of how the policy relates to their work.
Can the auditor help us fix problems during the audit?
No. Auditors report findings but cannot advise on specific solutions.
What happens at the opening meeting?
The auditor confirms scope, plan, timetable, confidentiality, safety and reporting.
What happens at the closing meeting?
The auditor presents findings, explains nonconformities and outlines next steps.
Can we disagree with an audit finding?
Yes. Raise it at the closing meeting with evidence, or use our formal appeals procedure.
Standards
What is ISO 9001?
The international standard for quality management systems.
What is ISO 14001?
The international standard for environmental management systems.
What is ISO 45001?
The international standard for occupational health and safety management systems; it replaced OHSAS 18001.
What is ISO 27001?
The international standard for information security management systems.
What is ISO 22000?
The international standard for food safety management systems.
What is ISO 13485?
The quality management standard for organizations involved with medical devices.
What is the difference between ISO 9001 and ISO 14001?
ISO 9001 manages quality; ISO 14001 manages environmental aspects. They share a structure and can be certified together.
What is an integrated management system?
One system covering two or more standards, audited in a single integrated programme.
Can ISO 31000 be certified?
Accredited certification is not available because ISO 31000 contains guidelines. We offer ISO 31000 compliance certification with a USGSR Certificate of Compliance.
What is the newest version of ISO 9001?
ISO 9001:2015, amended in 2024. A revised edition is in development.
Training
What is the difference between lead auditor and internal auditor training?
Internal auditor training prepares you to audit your own organization; lead auditor training prepares you to lead full and external audits.
Do your courses include a certificate?
Yes, a certificate of successful completion for participants who meet the requirements.
Can you deliver training at our premises?
Yes. All courses are delivered in-house at your premises or remotely as live, instructor-led online sessions.
Does attending your training affect our certification?
No. Training gives no advantage in any audit or certification decision.
Inspection, product and compliance certification
What is third-party inspection?
An examination of products, shipments or installations by an organization independent of buyer and seller. Our inspection services are accredited to ISO/IEC 17020 by USIAS.
What is the difference between inspection and certification?
Inspection checks a specific item at a point in time; certification confirms ongoing conformity with surveillance.
Is CE marking an ISO certification?
No. CE marking is the manufacturer’s declaration of conformity with EU legislation. We offer CE marking compliance certification; we are not a Notified Body.
What is Halal certification?
Confirmation that products and processes meet Islamic dietary and production requirements. Recognition depends on the importing country.
What is GMP certification?
Confirmation that premises, hygiene, personnel, documentation and production controls meet a GMP framework.
Can you certify FSSC 22000 or BRCGS?
We offer FSSC 22000 and BRCGS compliance certification. These are not scheme-owner certificates and are not GFSI-recognized.
Certificate verification
How do I verify an ISO certificate?
Use the issuing certification body’s online tool. For USGSR certificates, search by certificate number or company name on our Certificate Verification page.
Where is the certificate number?
It is printed on the certificate. Our search ignores case, spaces and dashes.
What does Valid mean in the verification result?
The certificate is in good standing at the date and time shown.
What does Suspended mean?
Certification is temporarily not valid while issues are resolved.
What does Withdrawn mean?
Certification has been permanently cancelled; the certificate must not be used.
What does Expired mean?
The validity period has ended; the organization may hold a newer certificate.
Why can’t I find a certificate?
Check for typing errors and try the company name. If you still cannot find it, contact us for written confirmation.
How do I report a suspected fake or misused certificate?
Use the Report it link on the verification page or our Complaints & Appeals procedure. We investigate every report.