From first scope to certification

PRACTICAL GUIDANCE

The starting point

A practical route through scope, implementation, internal assurance, the initial certification stages and ongoing review. The sequence helps you plan the work; the certification body sets the assessment programme and makes the certification decision.

1. Start with the purpose and scope

Write down why certification is being considered. A tender requirement, customer assurance request or internal improvement objective can lead to different priorities. Confirm the standard and edition, the activities to be covered and whether the customer requires accredited certification.

Our suggested first deliverable is a one-page scope brief: legal entity, services, locations, people, significant outsourced activities and intended certificate wording. Identify difficult boundaries early. A proposed scope can be discussed with certification bodies before the organisation commits to an implementation plan.

2. Implement and collect operating evidence

Obtain the licensed requirements standard and assess the existing arrangements. Keep useful processes, resolve gaps and identify owners. A purchased template can help structure a document, but it cannot demonstrate that the described process happens.

Allow the system to operate long enough to produce evidence appropriate to its activities. Rather than choosing a generic number of weeks, identify what must be observed: for example, a supplier review, a completed delivery, an access change or an emergency exercise. The necessary evidence and scheduling depend on the scope and risk.

3. Test the system before the certification audit

Use internal audit to compare actual practice with the relevant criteria. Use management review to make decisions about the results, performance, resources and changes. Address findings and check whether the action worked.

Our readiness question is simple: can someone follow an important process from the requirement through the decision, operation and review? If the evidence is missing or contradictory, resolve that gap before relying on a polished presentation.

4. Complete Stage 1

In the usual two-stage initial management system certification process, Stage 1 develops the certification body’s understanding of the organisation and its readiness for Stage 2. It informs scope, planning and the evaluation of relevant management system arrangements.

Confirm the agenda, participants, access arrangements and expected outputs. After the visit, ask which issues need action before Stage 2 and how the body will judge readiness. Stage 1 is not the final certification decision. Do not announce certification on the strength of a successful first visit.

5. Complete Stage 2 and respond to findings

Stage 2 evaluates the implementation and effectiveness of the management system within the agreed scope. The certification body’s process then determines the review and certification decision, including how findings must be addressed.

Prepare people to explain their own work and locate evidence. Avoid rehearsed answers that obscure uncertainty. For any nonconformity, clarify the requirement and evidence, investigate the cause and follow the body’s response process. An audit team’s positive comment is not a substitute for the formal decision.

6. Maintain the system and certification

After certification, follow the agreed surveillance and recertification programme and the rules for reporting relevant changes. Keep the management system active between visits.

Our recommendation is to maintain a calendar of audits, reviews, significant control checks and certificate milestones, with owners and dependencies. Before making a public certification claim, verify the approved scope, edition and current status. ISO develops standards; it does not perform certification or issue certificates to organisations.

Related guidance and practical next steps