ISO certification means an independent body has audited your management system against an ISO standard and issued a certificate. In the UK, certification bodies are assessed by UKAS, the national accreditation body. The standard itself is published by ISO; neither ISO nor UKAS certifies organisations.
The four standards covered here
| Standard | Covers | Cost | Time | Bodies |
|---|---|---|---|---|
| ISO 9001 | Quality management | Cost | Time | 14 listed |
| ISO 27001 | Information security | Cost | Time | 14 listed |
| ISO 14001 | Environmental management | Cost | Time | 14 listed |
| ISO 45001 | Health and safety | Cost | Time | 15 listed |
What happens, in order
- Decide scope and standard. What part of the organisation, which sites, which edition.
- Build or tidy the system. Policies, risk assessment, procedures, records. You can do this yourself or buy consultancy; the certification body must not design your system and then certify it.
- Get quotes. Ask for audit days and the three-year fee schedule. See how to choose.
- Stage 1 and Stage 2 audits. Documents and readiness first, then evidence that the system works.
- Certificate, valid three years, with annual surveillance audits and a recertification audit at the end.
Is accreditation compulsory?
GOV.UK describes accreditation as "the government’s recommended means of demonstrating an organisation’s competence" and says government only recognises UKAS accreditation of organisations operating in the UK. Its guidance does not say that ISO 9001 or the other standards here are a legal requirement. Whether you need certification is usually set by customers or tenders, so check the exact wording they use.
Beware of look-alikes. Some providers issue certificates under an accreditor other than UKAS. That may suit some buyers, but a tender that asks for UKAS-accredited certification will not accept it. Ask which accreditor stands behind the certificate.