ISO certification through accredited certification bodies

Standards by

International Organization for Standardization

Accreditation

NABCB (QCI) or IAF member bodies

Audit

Stage 1 and Stage 2, then annual surveillance

Validity

3 years, then recertification

Which ISO standard do you need

Start from why you want certification. If a tender or a customer requires a specific standard, check the exact wording, including the version and whether the certificate must be accredited, before you begin. Many businesses combine two or three standards in an integrated management system to reduce audit days.

Accreditation: why it decides whether a certificate is worth having

Anyone can print a certificate. What gives an ISO certificate value is accreditation of the certification body that issued it. In India, the National Accreditation Board for Certification Bodies (NABCB), part of the Quality Council of India, accredits certification bodies. NABCB is a signatory to the International Accreditation Forum (IAF) multilateral recognition arrangement, so certificates from bodies accredited by NABCB or other IAF members are recognised internationally.

Before choosing a certification body, check that:

• it is accredited for the specific standard and for your industry scope;
• the certificate will carry the accreditation mark; and
• the certificate will be listed on the IAF CertSearch database or the accreditation body's directory, so customers can verify it.

Offers of a certificate within a day, without an on-site or remote audit, almost always come from unaccredited bodies. Government departments and large buyers increasingly verify certificates and reject these.

What ProudLegal does, and what the certification body does

We do not issue ISO certificates. Our role is to prepare your organisation for certification and to coordinate the process with an accredited certification body you select. The certification body conducts the audits independently and decides whether to certify. Keeping these roles separate is a requirement of the accreditation rules: a body that consults for you cannot also certify you.

Our work covers the gap analysis, drafting of policies, procedures and records, training of your team, an internal audit and management review, and support during the external audits, including responses to any nonconformities raised.

How certification works, step by step

1. Gap analysis: your current practices are compared with the clauses of the standard to identify what is missing.
2. Documentation and implementation: the required policies, objectives, procedures, risk assessments and records are put in place and actually used for a period, typically a few weeks to a few months.
3. Internal audit and management review: both are mandatory requirements of the standards and must be completed before the certification audit.
4. Stage 1 audit: the certification body reviews your documentation and readiness, and identifies any areas of concern.
5. Stage 2 audit: auditors assess whether the system is implemented and effective, by interviewing staff and examining records on site or remotely where permitted.
6. Certification decision: once any nonconformities are closed, the body issues the certificate for a defined scope and sites.

What auditors actually look for

Management system standards share a common structure, so certification audits test the same core themes whichever standard you choose:

• Context and scope: a clear statement of what the system covers and the issues, interested parties and legal requirements that affect it.
• Leadership: a policy approved by top management, defined roles and evidence that management reviews performance.
• Risk-based planning: documented risks and opportunities, and measurable objectives with owners and deadlines.
• Competence and awareness: training records and evidence that staff understand the policy and their role.
• Operational control: procedures that are actually followed, with records such as inspection reports, calibration certificates, access logs or incident registers depending on the standard.
• Improvement: internal audits, customer feedback, complaints and corrective actions that show the system learns from problems.

Auditors sample real records and talk to staff on the shop floor or at their desks. A system that exists only in a binder will not survive a Stage 2 audit, which is why we focus on practices your team can maintain after certification.

Cost, timeline and validity

The certification body's fee depends mainly on the number of audit days, which accreditation rules link to the number of employees, the number of sites, the complexity of the activities and the standards covered. A small single-site service business needs far fewer audit days than a multi-site manufacturer. Our professional fee is quoted separately, based on the work needed to close the gaps.

For a small business with reasonable existing practices, the process from gap analysis to certificate commonly takes two to four months. The certificate is valid for three years. Surveillance audits take place in the first and second years after certification, and a recertification audit before expiry starts a new three-year cycle. Missing a surveillance audit can lead to suspension or withdrawal of the certificate.

Practical benefits for Indian businesses

• Tenders and vendor registration: many public sector and corporate tenders ask for ISO 9001 or a sector standard as an eligibility condition.
• Export buyers often require ISO 9001, ISO 22000 or ISO 27001 as part of supplier qualification.
• Process discipline: written procedures, defined responsibilities and corrective action reduce errors and dependence on individuals.
• Support schemes: some central and state schemes for MSMEs have reimbursed part of certification costs; check whether one is open for your enterprise and whether Udyam registration is a precondition.

ISO certification does not replace legal licences. A food unit still needs its FSSAI licence, and a data business still has to comply with data protection law even with ISO 27001.

Common mistakes

• Buying a certificate from an unaccredited body that a tender committee later rejects.
• Copying template manuals that do not describe how your business works; auditors test practice, not paperwork.
• Choosing too narrow a scope to save cost, so that the certificate does not cover the activity the customer asked about.
• Forgetting surveillance audits and losing the certificate mid-cycle.

Documents you need

To scope the work and obtain quotations from certification bodies, we need the following.

• Certificate of incorporation, partnership deed or other constitution document
• GST registration and address proof of all sites to be covered
• Organisation chart and number of employees at each site
• Description of products, services and processes to be certified
• Existing policies, SOPs, quality or safety records, if any
• List of relevant legal licences and approvals already held
• Tender or customer requirement specifying the standard, if applicable

How we handle it for you

1. Define scope

   We confirm the standard, version, sites and activities your customer or tender needs.

2. Gap analysis

   We assess your current practices against the standard and list what must change.

3. Build the system

   We draft documents, train your team and run the internal audit and management review.

4. Coordinate the audit

   We help you engage an accredited certification body and support you through Stage 1 and Stage 2.

5. Stay certified

   We support corrective actions, surveillance audits and recertification over the three-year cycle.

Why clients choose ProudLegal

Frequently asked questions