Evidence that withstands scrutiny
Evidence that withstands scrutiny
An extension is always a review of the application plus a determination of what audit activity is needed. Combining it with surveillance is a permission, not a default.
| The rule | What it requires | Reference |
|---|---|---|
| It is a review plus a determination | In response to an application to extend a certification already granted, the certification body reviews the application and determines the audit activities necessary to decide whether the extension may be granted. | ISO/IEC 17021-1:2015, 9.6.4.1 |
| Combining with surveillance is permitted, not automatic | The extension audit activity may be conducted in conjunction with a surveillance audit. That is a permission conditional on the determination above — not the default route. | ISO/IEC 17021-1:2015, 9.6.4.1 |
| Audit time is recalculated | An extension that adds effective personnel, sites, processes or risk category requires the audit time to be recalculated. Where the planned surveillance duration cannot absorb the addition, separate audit activity is required. | IAF MD 5:2023, Issue 4 Version 3 |
| New process families need Stage 2 equivalent coverage | Where the extension introduces activities never previously audited, the coverage required of a Stage 2 audit must be achieved for those elements. | ISO/IEC 17021-1:2015, 9.3.1.3 |
| Multi-site sampling changes with the sites | Where sites are added, the sampling basis is recalculated rather than carried over. | IAF MD 1:2023 |
| The decision follows the normal route | The certification decision on an extension follows the standard process, including the separation between the persons who audited and the persons who decide. | ISO/IEC 17021-1:2015, 9.5 · 9.5.1.1 |
| Our accreditation is the first gate | If the requested addition falls outside the accredited scope of the certification body, no amount of audit activity makes it grantable as accredited certification. | ISO/IEC 17021-1:2015, 9.6.4.1 |
The usual assumption is that an extension can always be picked up at the next surveillance visit. Clause 9.6.4.1 permits that, but only after the determination it requires — and three things routinely defeat it. The addition falls outside the certification body's own accredited scope, in which case it cannot be granted as accredited certification at all. The recalculated audit time does not fit inside the planned surveillance duration. Or the added activity is a process family never audited before, which needs Stage 2 equivalent coverage rather than a surveillance sample. Ask the scope question before you contract for the new work, not after.
Audit time is not extended by a fixed increment. The calculation is redone with the new effective number of personnel, the added sites, the added processes and any change in risk category, and the result is compared with the time already planned for surveillance. The difference determines whether the extension rides on that visit or requires separate audit activity.
Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.
