Questions about certification

It depends on what your customers, tenders or markets ask for, and on which risks you want to control. ISO 9001 is about quality and customer requirements, ISO 14001 about environmental effects, ISO 45001 about health and safety, ISO/IEC 27001 about information security, ISO/IEC 20000-1 about IT services, ISO 22000 about food safety, ISO 50001 about energy and ISO 13485 about medical devices.

If a client or a tender names a standard, start there and ask which edition is wanted. If nothing is named, our standard finder asks a few questions about your sector and your reasons and suggests where to start. You can also write to us and describe your situation.

Yes. Several standards can be audited in one visit, which is called an integrated audit. ISO 9001, ISO 14001 and ISO 45001 share the same structure, so one set of arrangements for context, leadership, planning, support, operation, performance evaluation and improvement can serve all of them.

Each standard is still audited against its own requirements. A combined audit can save time on the shared parts, such as document control, internal audit and management review. How much it saves depends on how closely your system is joined up, and we confirm it when we quote.

Read the requirement closely before you apply. Look for the standard, the edition, and whether the certificate must come from a certification body accredited for that standard. Some buyers also want the scope of the certificate to name a particular product, service or site.

Send us the wording of the tender or the client's request. We will tell you which standard it points to and what the steps are. We cannot promise a date or an outcome, so tell us early if a deadline is close.

Yes. The standards do not set a minimum size. They describe what a system must do and leave the method to the organization, so a small team can run a short, simple system and a large plant a bigger one.

Fewer people, fewer sites and a narrower scope usually mean a shorter audit. The evidence an auditor wants is the same in kind: that you decided how you work, that you follow it, and that you check and correct it.

ISO is the International Organization for Standardization, an independent, non-governmental organization that brings experts from many countries together to write international standards. It publishes the standards. It does not audit organizations or issue certificates.

Certification is done by independent certification bodies, such as AQC Group, which audit an organization against a standard and issue the certificate. This is why a certificate should name the standard the organization is certified to and the certification body that issued it.

Certification is an audit of an organization against a standard by a certification body, ending in a certificate. Accreditation is a separate step: an accreditation body checks that the certification body itself is competent and impartial to carry out those audits.

So your certificate is issued by the certification body, and its standing depends in part on the accreditation behind it. Ask any certification body which accreditation covers the standard you want. AQC Group's is described on our accreditation page.

You send an enquiry and an application, and you receive a quotation based on your size, sites and scope. Then come two audits. The stage 1 audit checks that your system is ready, and the stage 2 audit checks that it works in practice. Any nonconformities are corrected, and then the certification decision is made.

The certificate runs for three years. Surveillance audits take place in the first and second years, and a recertification audit in the third. Our page on how certification works sets out each step in order.

Stage 1 is a readiness review. The auditor looks at your scope, your documented system and your plans, and tells you what to put right before the main audit.

Stage 2 takes place at your site or, where it is allowed, remotely. The audit team samples records, watches work being done and talks to staff, to see whether the system is carried out and whether it works. At the end the team reports its findings, including any nonconformities.

A nonconformity is a requirement that is not met. The requirement can come from the standard, or from your own procedures when they are not followed. The auditor records it with the evidence they found, so you can see exactly what was seen.

Certification bodies usually grade nonconformities as major or minor. A major one is a serious failure that puts the intended results of the system at risk. A minor one is a lapse that does not.

You receive it in writing at the end of the audit. You then look for the cause, correct the problem and send the certification body your plan and your evidence. For a minor nonconformity a plan may be enough at first, with checking later. For a major one, the correction usually has to be verified before certification is decided, sometimes by a further visit.

It is common for an audit to find some. That is not the same as failing, but certification cannot be promised in advance, because the audit finds what it finds and the decision is made independently.

The audit team reports what it found. The decision is made by the certification body, by a person or committee that did not carry out the audit. This keeps the decision independent of the people who spent time at your site.

The decision can be to grant certification, to ask for more evidence first or to decline. Only after a positive decision is the certificate issued by AQC Group.

We do not publish a fixed time, because it differs between organizations. The biggest influence is how much of the system you already have. A company with procedures, records and internal audits in use needs less preparation than one starting from nothing.

The audit schedule, the time you need to correct any nonconformities and the certification decision also take time. Tell us your size, your sites and whether you have a deadline, and we will describe the steps and what could change them in your case.

We do not publish prices, because a quotation depends on facts that differ for every client: the standards, the number of employees, the number of sites, the scope and whether the audits are on site or remote. The more people, sites and activities in scope, the more audit time is needed.

Ask for a quotation and ask what it covers over the whole three-year cycle, not only the first audit. The cycle includes surveillance audits each year and a recertification audit in the third.

The main factors are the number of employees, the number of sites, the scope and complexity of your activities, and the level of risk in your sector. A system that is already in place and working shortens the preparation, and so does a clear scope.

The number of standards audited together matters too, as does whether the audit is on site or remote. A combined audit can save time on shared parts of the system. We give you the effect of each factor when we quote.

Sometimes. Part or all of an audit can be done by video call, with documents and records shared on screen, when the standard, the activity and the certification body's rules allow it. Remote audits suit offices, software teams and document-based systems better than a production line, a kitchen or a ward, where the auditor needs to see work being done. Some schemes limit remote auditing.

Whether remote auditing is right for you is decided when the audit is planned. It can reduce travel, but the audit still has to gather enough evidence, so a remote audit is not automatically shorter.

Surveillance audits take place in the first and second years after certification. They are usually shorter than the first audit. Their purpose is to check that the system is still working and still improving. The auditor does not repeat the whole standard each time. They sample parts of it and follow up earlier nonconformities, complaints and changes.

A certificate is not a permanent award. If a surveillance audit finds serious problems, or if the audits cannot take place, the certification body can suspend or withdraw the certificate.

A recertification audit looks at the whole system again, and at how it performed over the full cycle, including the results of surveillance audits, complaints and internal audits. If the result is positive, a new certificate is issued for a further three years.

Plan the recertification audit ahead of the expiry date of your certificate, so that there is time to deal with any findings before the date comes.

A revised edition does not cancel your certificate on the day it is published. There is a transition period, set for each revision, in which certificates to the previous edition stay valid. During it the organization updates its system and is audited to the new edition, often at a surveillance or recertification audit.

ISO published a 2026 edition of ISO 9001 on 16 September 2026, and of ISO 14001 on 15 April 2026. AQC Group certifies to the 2015 editions, and certificates to them stay valid during a three-year transition. The dates and what to do are on each standard's own page, and we confirm which edition an audit will use when we quote.

Often, but it is not automatic. We review your current certificate, the latest audit reports, any open nonconformities and complaints, and the scope. After that the transfer can be accepted, or a new audit may be needed. Whether we can accept it depends on the accreditation of the body that issued the certificate and on the status of the certificate.

Contact us before you end your agreement with your current body, and do not let the certificate expire while a transfer is being arranged. Send us a copy of the certificate and the last audit report.

Use the verify a certificate page. It asks for the certificate number, the name of the certified company and the email address of the person asking. We check the details against the certification body's records and reply.

You can also check the certificate itself. It should show the name of the certified company, the standard and edition, the scope, the certification body that issued it and the dates. If any of these is missing, ask.

Northwind Management Systems is the regional partner of AQC Group and is based in Iraq. AQC Group is the certification body: it issues the certificates, and the certification decision is made by AQC Group.

You deal with Northwind for enquiries and quotations. We also offer implementation and documentation support and training. These are separate services from the audit, and the next two answers explain how.

Yes, if you want it. Implementation and documentation support helps an organization put a management system in place and document it so that it fits how the organization really works. It is optional. You can prepare on your own, with another consultant or with us.

The support is a separate service from certification and is described on its own page.

No. The rules that govern certification bodies do not allow a body to consult for a client in a way that compromises the audit. Northwind keeps support separate from audit decisions. Taking support gives you no advantage in the audit and no guarantee of certification.

The audit finds what it finds, and the certification decision is made independently by AQC Group. Our impartiality page sets out how this is kept apart.

In general terms, two kinds. Awareness training explains what a standard asks of an organization and why, for managers and staff who will work within the system. Internal auditor training is for the people who will audit the system from the inside.

Content, length and dates are agreed when you ask, and are not listed here. Our training page says more.

Use the form on the complaints and appeals page. Say what happened, when, and how we can reach you. A complaint is about service or conduct. An appeal asks for a decision, such as a certification decision, to be reviewed.

Complaints and appeals are not handled by the people they concern.