Documented management system information under first review
  1. Home
  2. Certification
  3. Services
  4. Initial certification.

Initial certification.

Two stages, not one. The first decides whether the second can usefully happen — and the certification decision is taken by people who did not audit you.

What it involves

What actually happens.

  • Application and contract review, checking the requested scope against what we are accredited to certify
  • Audit programme for the full three-year cycle, and audit time determined against documented criteria
  • Stage 1 — documented information, site conditions, and whether internal audit and management review have actually been performed
  • Documented Stage 1 conclusions, including any area of concern that would be raised as a nonconformity at Stage 2
  • Stage 2, on site, covering conformity to every requirement of the standard
  • Performance against your own objectives and targets, and against statutory, regulatory and contractual requirements
  • Operational control, internal auditing, management review and management responsibility for the policy
  • Correction and corrective action on findings, with verification of effectiveness
  • Independent review, then a certification decision taken by personnel who did not carry out the audit
The normative basis

The rules this runs under.

The ruleWhat it requiresReference
Two stages are mandatoryThe initial certification audit is conducted in two stages. There is no provision to waive Stage 1 for a first certification.ISO/IEC 17021-1:2015, 9.3.1.1
Stage 1 is a readiness gate, not a partial auditIt determines preparedness for Stage 2, establishes the scope and site conditions, and evaluates whether internal audit and management review have been planned and performed.ISO/IEC 17021-1:2015, 9.3.1.2.2
The interval between stages is decided, not fixedNo maximum is set. It is determined by your need to resolve Stage 1 areas of concern and by any need to revise the Stage 2 arrangements.ISO/IEC 17021-1:2015, 9.3.1.2.4
Stage 2 is on siteIt evaluates implementation and effectiveness, and covers conformity to all requirements of the standard.ISO/IEC 17021-1:2015, 9.3.1.3
Major and minor findings close differentlyMajor nonconformities must be corrected and the correction verified before the decision. Minor nonconformities require a reviewed and accepted plan.ISO/IEC 17021-1:2015, 9.5.2
The decision is separated from the auditThe persons taking the certification decision are competent and are not the persons who carried out the audit.ISO/IEC 17021-1:2015, 9.5.1.1
The cycle starts at the decisionThe three-year certification cycle begins with the certification decision — not with the audit and not with the certificate print date.ISO/IEC 17021-1:2015, 9.1.3.2
Clause content is paraphrased rather than reproduced — ISO text is copyright. The clause numbers are given so you can check the wording in your own copy.
On your side

What you will be asked to produce.

  • The documented management system information, in the language of the audit or with agreed interpretation
  • Evidence that at least one full internal audit cycle has been completed against the standard
  • A completed management review with inputs, outputs and decisions recorded
  • The list of sites, processes, shifts and outsourced processes inside the requested scope
  • The applicable statutory and regulatory requirements you have identified, and how you monitor compliance with them
  • Effective number of personnel including permanent, temporary, part-time and shift staff — this drives audit time
  • Your own objectives and targets, and the performance data against them
The common failure

Where this goes wrong.

The most common failure is arriving at Stage 1 with a documented system but no completed internal audit and no management review. Clause 9.3.1.2.2(g) makes that an explicit Stage 1 objective, so it is not something that can be deferred to Stage 2. Where Stage 1 areas of concern are not resolved, all or part of Stage 1 may have to be repeated and Stage 2 postponed — clause 9.3.1.2.4. The second most common failure is a requested scope that describes what the organisation wants to sell rather than what it operates and controls; that surfaces at Stage 1 as a scope problem and delays everything behind it.

Audit time

How the audit time is determined.

Audit time is determined against documented criteria and includes time on site plus off-site planning, document review and reporting. Travel and breaks are not counted in it. The principal drivers are the effective number of personnel, the complexity of the management system, the technological and regulatory context, outsourced processes, and the number and geography of sites. Duration should typically not fall below 80% of the calculated time.

Reference: ISO/IEC 17021-1:2015, 9.1.4 · IAF MD 5:2023, Issue 4 Version 3, clauses 2.1.1–2.1.3

The rest of the certification route

OverviewAll certification servicesThe cycleCertification processProgrammesStandards

Describe the claim — not the service.

Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.

Start a pre-engagement reviewContact the right entity