ISO Certification, Accreditation and Audits: Who Does What

"ISO audit", "ISO accreditation" and "ISO certification" are three different things, done by different organisations. This guide separates them using pages opened on 17 October 2026 from ISO, Global ACI, UKAS, ANAB and the ISO/TC 176 committee site. It is general information, not advice.

The short answer

ISO publishes standards such as ISO 9001 and does not certify anyone. A certification body audits an organisation against a standard and, when the requirements are met, issues a certificate. An accreditation body assesses the certification body and recognises it as competent and impartial for a stated scope. Audits come in three kinds by who performs them: internal (first-party), supplier (second-party) and certification (third-party). ISO describes certification to ISO 9001 and ISO 45001 as voluntary, although a customer or contract can ask for it.

Three different things

A standard is a published document. ISO lists ISO 9001:2026 as edition 6, published in September 2026, and ISO says an organisation cannot be certified by ISO. See ISO 9001 and ISO 45001. ISO also publishes the standards certification bodies follow, such as ISO/IEC 17021-1, which its record describes as requirements for the competence, consistency and impartiality of bodies that audit and certify management systems.

Certification is the result of an audit. ISO describes it as written assurance from an independent body that a product, service or system meets specific requirements. UKAS says organisations hold certification, while certification bodies are the ones described as accredited.

Accreditation is the recognition of the certification body. Global ACI defines it as independent evaluation of conformity assessment bodies against recognised standards, to confirm their impartiality and competence, and says it is voluntary in most countries. ISO adds that an unaccredited body is not necessarily disreputable.

So the chain has three links: the organisation, the certification body that audits it, and the accreditation body that assesses the certification body, which Global ACI says is done against ISO/IEC 17021-1 for management systems.

Who is who

ISO/TC 176. ISO's committee for ISO 9001 has a question and answer page saying ISO only creates standards and does not govern certification bodies; accreditation bodies do. Its site states that a third party manages its content, that it is not under ISO's control, and that ISO does not guarantee its accuracy, completeness or timeliness, so we say where a statement rests on it alone.

National accreditation bodies. UKAS says it is the sole national accreditation body for the United Kingdom. ANAB, the ANSI National Accreditation Board, says it accredits organisations that test, inspect, certify and train, lists ISO/IEC 17021-1 management systems accreditation among its programmes, and calls itself the largest accreditation body in North America.

The umbrella body. Global ACI does not accredit or certify anyone. It is the international organisation of accreditation bodies, with 129 full members on its home page on 17 October 2026, and says it became fully operational on 1 January 2026, taking over the roles of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC). The IAF's legacy site carries a notice that IAF ceased operations on 1 January 2026 and points to Global ACI, and ISO's certification page says Global ACI assumed the IAF's and ILAC's former roles. Some pages have not caught up: the ISO/TC 176 Q&A and a UKAS guidance page still point to the IAF. Global ACI's Q&A also says its own mark is not yet authorised, and that full members may keep using the IAF and ILAC marks under a temporary process.

The audit types

ISO's conformity assessment committee (CASCO) says first-party assessment is made by the supplier, second-party by the purchaser or user, and third-party by an organisation unrelated to both, such as a certification body. The ISO 9001 Auditing Practices Group (papers carrying ISO and IAF copyright notices) says ISO 19011 gives guidelines for first-, second- and third-party audits and calls supplier auditing second-party auditing. Its paper covers the 2018 edition; ISO now lists ISO 19011:2026. The papers sit on the committee site, so the same caveat applies, and each says it was not endorsed by ISO, ISO/TC 176 or the IAF.

Stage 1 and stage 2. Global ACI's audit time document, which reissues IAF MD 5:2023 without substantive change to the text, calls an initial certification audit stage 1 plus stage 2 and says normal practice is that stage 2 takes longer. The Auditing Practices Group paper on two-stage audits, dated 13 January 2016 and written for the 2015 edition, describes stage 1 as mainly scoping and planning stage 2 and judging readiness, including whether internal audits and management reviews are planned and performed. It expects no formal audit plan or report for stage 1, but says the organisation should be told formally of any shortfall.

Surveillance and recertification. Global ACI's document describes an initial three-year certification cycle. Surveillance audits add up to about one third of the initial audit time each year; a recertification audit is normally about two thirds of the time an initial audit would need at that point.

"ISO compliant", "ISO certified" and "conforms to"

The ISO/TC 176 site (that site alone) says an organisation can proclaim that it has met a standard's requirements, but this is not validated by an independent third party and does not lead to certification. CASCO calls such a statement first-party and says a declaration should name the standard, say what it covers and carry a date, a signature and any limits. ISO does not permit anyone to use its logo in connection with certification.

Our reading, as editors: write what you can show. "Conforms to ISO 9001 in our own assessment" is a first-party statement. "Certified to ISO 9001:2015 by a named body, for a stated scope" is a third-party result. "ISO certified" is loose because ISO does not certify, and "compliant" is better kept for law, as our QMS glossary page does.

How to check a certificate

1. Find the certification body. ISO says you can identify it from the statement of certification, the certification mark or a copy of the certificate.
2. Read the standard and edition. ISO 9001:2015 and ISO 9001:2026 are different editions; Global ACI says accredited certifications to the earlier one are no longer valid after 30 September 2029.
3. Read the scope. UKAS says accreditation is specific to the activities it covers and a body may be accredited without covering the system in question. The certificate states its own scope too: compare it with what the organisation does.
4. Read the dates. Our suggestion: look for issue and expiry dates and ask where the organisation is in its cycle.
5. Look for the accreditation mark. Global ACI says the accreditation body's mark should be on an accredited certificate, and UKAS says only certificates it has accredited carry its symbol. ISO says accreditation is not compulsory, so a missing mark is a question, not proof of a fake.
6. Verify. UKAS advises checking the accreditation body is a signatory to a recognised arrangement, checking the certification body's accreditation scope on its site, then confirming the certificate with the certification body. UKAS runs a free database, CertCheck, for management system certification it has accredited. ISO and Global ACI point to IAF CertSearch for certification accredited by IAF signatories; a UKAS page from around 2022 says certification bodies need not upload certificates to it, so a missing entry is not conclusive.

UKAS says counterfeit certificates and false claims of its accreditation exist, and lists the organisations; we do not repeat the names.

What changes in an edition transition

For ISO 9001:2026 Global ACI sets three years. Certified organisations move at a surveillance audit, a recertification audit or a separate transition audit, which reviews the changed requirements and changes to the organisation's context. New accredited certifications may only be to the 2026 edition from 31 March 2028. UKAS adds that certification to the 2026 edition must not be presented as accredited until UKAS has decided on the certification body's transition, so check accreditation scope as well as the certificate. Dates differ by standard: Global ACI's ISO 14001:2026 document ends on 30 April 2029, and ISO plans a revision of ISO 45001:2018 as ISO 45001:2027. Our ISO 9001:2026 page sets out the dates.

The records an audit looks at

At stage 1 the auditors look at documented management system information, objectives and processes, and at internal audits and management reviews. Our ISO 9001, QMS and ISO 19011 glossary pages list the records such a system keeps: documents, nonconformities, corrective actions, supplier evaluations, audit findings and management review decisions.

Software can hold those records. It does not establish certification: a certification body audits the organisation's system, including how it uses its tools, and no source we read says a product makes anyone certified. See internal audit software, compliance management software, QMS document control and the quality management software guide, or the library.

What 212 vendor profiles record about certifications

We checked the records of 212 QHSE, EHS and ESG software profiles through 14 October 2026. In the 212 profiles researched, a missing statement means we found none, not that the vendor lacks the certificate. No product is named, and the methodology describes the profile set.

In the 212 profiles researched, 130 (61%) name at least one certification of any kind; for the other 82 we found no such statement. Of the 130, 87 (41%) name at least one ISO management-system certificate: ISO 9001, 14001, 45001, 13485, 22301 or ISO/IEC 27001. The largest group is ISO/IEC 27001, an information security standard, in 79 profiles (37%). Leaving it aside, 27 profiles name at least one of the other standards. The other 43 name only other kinds, such as SOC 2.

A profile can name more than one, so the rows do not add up to 87. Of the 25 naming ISO 9001, nine name the 2015 edition, 16 name no edition and none names ISO 9001:2026.

The 130 profiles hold 266 certification entries. 236 (89%) carry a note that the certificate or report was not reviewed; the other 30 carry no note, and none of the 266 says it was reviewed. Of the 113 entries for an ISO management-system certificate, 95 carry the note. "Not reviewed" means we did not review the certificate documents: we recorded what the vendor states, so we cannot say who issued it, for what scope or for which dates. None of the 266 entries records an accreditation statement, so the profiles cannot tell you whether a certificate is accredited, and none of this ranks a product. For the security reports see our attestations study and the SOC 2 and ISO 27001 article.

Disclosure. One of the 212 profiles belongs to a vendor that pays for sponsored placement on this site, and the editor works at that vendor. Its record was read by the same rules as every other and is counted in every figure above like any other profile. It is not named in this article.

FAQ

Does ISO certify companies?

No. ISO's certification page says ISO does not perform certification or issue certificates; external certification bodies do.

What is the difference between certification and accreditation?

Certification is the result of an audit of an organisation, issued by a certification body. Accreditation is the recognition of the certification body by an accreditation body such as UKAS, for a stated scope.

What are stage 1, stage 2, surveillance and recertification audits?

Stage 1 mainly scopes and plans stage 2 and checks readiness; stage 2 is the longer audit. Surveillance audits follow during the three-year cycle, and a recertification audit closes it.

Is ISO 45001 certified the same way as ISO 9001?

The route is the same: a certification body audits against the standard, and ISO describes certification to ISO 45001 as optional. Global ACI's audit time document covers quality, environmental and OH&S systems and says OH&S process control and risk control cannot be audited remotely. ISO lists ISO 45001:2018 as current, with a revision planned. See our ISO 45001 cost and timeline guide.

Sources

All pages were opened on 17 October 2026. ISO/TC 176 pages (committee.iso.org) are managed by a third party outside ISO's control, and ISO does not guarantee their accuracy, completeness or timeliness. The paid texts of ISO/IEC 17021-1, ISO 9001 and ISO 45001 were not used.

• ISO: Certification, Conformity assessment, Management system standards
• ISO: standard records for ISO 9001:2026, ISO 45001:2018 and ISO/IEC 17021-1:2015
• ISO/CASCO: Attestations of conformity
• ISO/TC 176 (third-party managed): Questions and answers
• ISO 9001 Auditing Practices Group (third-party managed site): Two stage initial certification audit, 2016 and Effective use of ISO 19011, 2020
• Global ACI: Q&As and home page
• Global ACI: TECH-3-004, audit time, 10 July 2026, TECH-3-TR, ISO 9001:2026 transition and ISO 14001:2026 transition
• IAF (legacy site, notice of 1 January 2026): home page
• UKAS: About UKAS, Accreditation vs certification, Validating certificates, CertCheck, Counterfeit certificates, QMS ISO 9001:2026 transition bulletin, revision 1, 7 October 2026
• ANAB: home page
• The QHSE Standard: methodology and the profile evidence files behind the vendor counts