How certification works
Certification takes two audits to a certificate, then three years of follow-up. This page takes the steps in order: what we ask, what the auditor does, what happens when something is found, and what affects the time an audit takes.
01Overview
The whole path at a glance
- BeforeStage 1 and stage 2 audits
- Year 0Decision and certificate
- Year 1Surveillance audit
- Year 2Surveillance audit
- Year 3Recertification audit, and the cycle starts again
A certificate is valid for three years. Before it is issued there are two audits, stage 1 and stage 2, and a decision. After it is issued there is a surveillance audit at least once a year, and a recertification audit in the third year, after which the cycle starts again. The diagram shows one surveillance audit in each of the first two years, which is the minimum. The sections below take each step in turn.
02Before you apply
Before you apply
Have the system running for long enough to show records.
An auditor can only assess a system that has been in use. At stage 1 the auditor checks that you have held an internal audit and a management review. At stage 2 the auditor samples records of the system running. Without records, there is nothing to sample.
Long enough to show records is not a fixed number of months. A process that runs every day builds up records quickly, and one that runs once a quarter takes longer. The test is whether an auditor could pick any record and follow it back to the work it describes.
Before you apply you should have:
- a scope you can state: what you do, and at which sites
- the documents and records the standard asks for, and people using them
- at least one internal audit of the system
- at least one management review, with its decisions recorded
You should also know which standard and edition your client or tender names. If you are not there yet, you can build the system on your own, with another consultant, or with our implementation and documentation support. If you are not sure whether to apply now or to wait, tell us where you are and we will say.
03Application
Application and quotation
We ask a few things, and use the answers to work out the audit time.
What we ask
- What you do, and the scope you want on the certificate
- Where you do it: your sites, and what each one does
- How many people work within the scope, including people on shifts and regular contractors
- Which certificates you already hold, if any
- Which standards you want, and whether you want them audited together
Why we ask
Audit time is set by rules that certification bodies must follow. The main input is the number of people working within the scope. The time is then adjusted for the complexity of the work, the level of risk, the number of sites, and whether several standards are audited together.
We apply those rules to your answers and quote the result.
We do not publish prices, because they follow from your answers. A quotation should cover the whole three-year cycle rather than the first audits alone, so ask what yours includes: the stage 1 and stage 2 audits, the surveillance audits and the recertification audit. Where a standard has a new edition, we confirm at this point which edition your audit will use.
04Stage 1
Stage 1: a review of readiness
The auditor looks at your system on paper, and at how ready it is for the main audit.
Scope
The auditor checks that your scope matches what you do and where you do it, and that it says what you want the certificate to say. A wrong scope is easier to correct now than after the certificate is issued.
Documented information
The documents and records the standard asks for, and any others you rely on. The auditor reads them against the standard and against how you say the work is done.
Internal audit and management review
The auditor checks that both have been held, that they covered the system, and that decisions and actions were recorded. They are part of the system and must be in place before stage 2.
Readiness
The auditor judges whether the system is in use and whether people know their parts in it. The answer shapes the plan for stage 2: which sites, which processes and how much time.
Site and sector specifics
Anything particular to your work: shifts, temporary sites, outsourced processes and any requirements specific to your sector.
Part of stage 1 is often done remotely, where the rules allow, from documents and records you send. Where the auditor needs to see the place of work, such as a plant or a kitchen, a visit may be needed.
The outcome is a list of points to settle before stage 2. Points left open could be raised as nonconformities at stage 2. If something serious is found, stage 2 should wait until it is settled. The time between the two stages depends on what has to be settled.
05Stage 2
Stage 2: the main audit
The auditor checks whether the system is in use and whether it works. It takes place at your sites or, where it is allowed, remotely.
Opening meeting
The audit team meets your management at the start. They confirm the scope and the plan, the sites and processes to be seen, the people to be spoken to, and how the findings will be reported.
Following the work
The auditor follows processes as they are carried out, from beginning to end: for example an order from its receipt to its delivery, and any complaint after it. They go to the places where the work is done, because a document describes work and does not prove it.
Interviews at every level
The auditor talks to people at every level, including top management. They ask what people do, why they do it that way and what they would do if something went wrong. Top management is interviewed as well as the quality manager.
Sampling records
The auditor cannot read everything, so they sample. They choose records themselves and trace them back to the work they describe: a training record to the person, a calibration record to the instrument, an incident record to the action that followed.
Closing meeting
At the end the team presents what it found, including any nonconformities, and explains what happens next. You can ask about any finding. Each nonconformity is written down with the evidence behind it, and you receive the findings in writing.
06Findings
Findings, and what you do about them
An audit records what it found as one of three kinds. For a nonconformity, you then find the cause, correct it and show the evidence.
Major nonconformity
A requirement is not met in a way that puts the intended results of the system at risk, or a failure casts doubt on what the system delivers. A major nonconformity must be closed before a certificate can be issued.
Minor nonconformity
A lapse that does not put the intended results at risk, such as one record missing from an otherwise complete set. You send a plan for correcting it, and the correction is checked later.
Opportunity for improvement
Something that meets the requirement but could work better. It is not a nonconformity, and you decide whether to act on it.
Find the cause
Ask why it happened as well as what happened. If a record is missing, ask why it was missed, and where else the same cause could be at work.
Correct it
Deal with the problem found, and act on the cause so that it does not come back. Send the certification body your plan, and it will tell you how long you have.
Show the evidence
Send evidence that the action was carried out, such as records, revised documents or photographs. For a minor nonconformity a plan may be enough at first, with the evidence checked later. For a major one, the correction has to be verified before a certificate can be issued, sometimes by a further visit.
It is common for an audit to find some nonconformities. That is not the same as failing. No one can promise the result of an audit in advance, because the audit finds what it finds and the decision is made independently.
07Decision
The decision and the certificate
When the audit is complete and any major nonconformities are closed, the audit file is reviewed by someone who was not on the audit team. The file holds the audit report, the findings and the evidence that they were dealt with. This keeps the decision independent of the people who spent time at your site.
AQC Group makes the certification decision. It can be to grant certification, to ask for more evidence first, or to decline. Only after a positive decision is the certificate issued.
The certificate is valid for three years. What a certificate covers is explained on the certification page. If you disagree with a finding or a decision, the complaints and appeals page explains what you can do.
08Surveillance
Surveillance audits
The certificate stays valid only while the system keeps working.
Surveillance audits take place at least once a year while the certificate is valid. The first one is held within 12 months of the certification decision.
They are usually shorter than the first audit, and they do not repeat the whole standard. The auditor samples parts of the system, and across the three years the audits are planned to cover all of it. Each one looks at:
- nonconformities from the last audit, and whether the action on them held
- complaints, and how they were handled
- changes since the last audit, such as new sites, new activities or new people in senior roles
- internal audits and management reviews held since then
- how the system is performing against your objectives, and what has been done to improve it
- how the certificate and the certification mark are being used
Tell us about major changes when they happen, not at the next audit. A new site, a change of activities, a change of ownership or a change of senior people can all affect what the certificate covers.
09Recertification
Recertification in the third year
Before the certificate expires, a recertification audit looks at the whole system again. It also looks at how the system performed over the full cycle, including the results of the surveillance audits, complaints and internal audits. If the result is positive, a new certificate is issued for a further three years.
Plan the audit ahead of the expiry date, so that there is time to deal with any findings before the date comes. If a new edition of your standard has been published, a recertification audit is a common point at which to move to it. The pages for ISO 9001 and ISO 14001 explain the move to their 2026 editions.
10Suspension
Suspension and withdrawal
A certificate is not permanent. It can be suspended or withdrawn, but a nonconformity on its own does not lead to that.
A certificate stays valid only while the conditions of certification are met. A nonconformity is normally closed by finding the cause and correcting it, as described above. A certification body can suspend or withdraw a certificate when, for example:
- a surveillance or recertification audit is not allowed to take place when it is due
- a serious nonconformity is not resolved, or the system persistently fails to meet the requirements
- the certificate or the certification mark is misused, for example to suggest that it covers more than its scope
A suspension means the certificate is not valid for the time being, and you must not use it or the mark to claim certification while it lasts. Its purpose is to give you time to put the problem right. If you do, the certificate is restored. If you do not, it can be withdrawn.
A withdrawal ends the certificate. To be certified again you would start with a new application and new audits.
How long a suspension can last, and what is needed to lift it, is set by AQC Group's procedures. A suspended certificate cannot be transferred to another certification body.
11Time and cost
What drives time and cost
We do not publish prices or fixed timelines, because they follow from these six things.
People
The number of people working within the scope is the starting point for audit time. Count people on every shift and regular contractors working under your control, as well as employees.
Sites
Each site in the scope adds audit time. Temporary sites, such as construction sites, are part of the audit, and the auditor will normally want to see work in progress.
Scope and complexity
A wider scope, more processes, design work and a higher level of risk in the work all add time. A chemical plant needs more audit time than an office of the same size.
Standards audited together
Standards that share a structure can be audited in one visit, which can save time on the shared parts. Each standard is still audited against its own requirements. We say how much is saved when we quote.
How ready you are
A system that is in place and working shortens the preparation. One that is still being built needs time before you can apply.
Remote or on site
Part of an audit can be done remotely, where the rules allow, which can reduce travel. The audit still has to gather enough evidence, so a remote audit is not automatically shorter.
Each standard's page lists the factors that matter most for it. If you have a deadline, tell us early. We cannot promise a date or an outcome, but we can describe the steps and what could change them.
12Special cases
Several sites, and remote auditing
Both depend on the rules that apply to your standard and to the certification body.
Organizations with several sites
An organization with several sites may be covered by one certificate. Where the rules allow, the auditor visits a sample of the sites instead of all of them, and the central office is audited as well. Sampling depends on the sites working under one centrally managed system and doing the same or similar work. Some sectors and schemes set stricter rules. Tell us at the start how many sites you have and what each one does.
Remote auditing
Part or all of an audit can be done by video call, with documents and records shared on screen, where the standard, the activity and the certification body's rules allow it. It suits offices, software teams and document-based systems better than a production line, a kitchen or a ward, where the auditor needs to see work being done. It can reduce travel, but the audit must still gather enough evidence, so it is not automatically shorter. Whether it is right for you is decided when the audit is planned.
Ask about your own case.
Tell us your size, your sites and the standards you want. We will tell you what the audit would involve and what affects its length.