ISO Management System (MS) Certification FAQs
There is quite a bit of terminology in the ISO world, but these are the ones you'll hear most often:
ISO - International Organization for Standardization
ISO develops international standards covering a wide range of industries and activities.
ISO develops international standards covering a wide range of industries and activities.
ISO develops the standards, but it does not certify companies.
Management System (MS)
Simply put, this is the structured way your company manages its activities and processes.
Simply put, this is the structured way your company manages its activities and processes.
It includes things like policies, procedures, responsibilities, controls, records, dealing with nonconforming products or services, client feedback actions and how you deal with problems and improvements.
Some of the management system standards you may come across are:
- ISO 9001 - Quality Management System
- ISO 14001 - Environmental Management System
- ISO 45001 - Occupational Health and Safety Management System
- ISO 27001 – Information Security Management System
Nonconformity (NC)
An area where your management system does not fully meet a requirement or where your own process is not being followed as intended. A nonconformity is not simply a negative finding. It highlights an opportunity to understand what went wrong, correct it and prevent it from happening again, supporting continual improvement in your business.
An area where your management system does not fully meet a requirement or where your own process is not being followed as intended. A nonconformity is not simply a negative finding. It highlights an opportunity to understand what went wrong, correct it and prevent it from happening again, supporting continual improvement in your business.
Certification Body (CB)
This is the independent company that audits your management system and, if you meet the requirements, issues your ISO certificate. DEKRA Certification is a Certification Body.
This is the independent company that audits your management system and, if you meet the requirements, issues your ISO certificate. DEKRA Certification is a Certification Body.
Accreditation Body (AB)
An Accreditation Body checks that Certification Bodies are competent and are following the international rules for certification. In other words, while we audit you, an Accreditation Body also checks us.
An Accreditation Body checks that Certification Bodies are competent and are following the international rules for certification. In other words, while we audit you, an Accreditation Body also checks us.
Certification
Certification is an independent assessment of your organisation's management system against the requirements of an ISO standard. A Certification Body, such as DEKRA Certification, conducts the audit and, if the requirements are met, issues your certificate. So, when talking about your company, the correct term is "certified".
Certification is an independent assessment of your organisation's management system against the requirements of an ISO standard. A Certification Body, such as DEKRA Certification, conducts the audit and, if the requirements are met, issues your certificate. So, when talking about your company, the correct term is "certified".
Accreditation
Accreditation is the independent assessment of the Certification Body. An Accreditation Body checks that the Certification Body is competent, impartial and follows the international rules for carrying out audits and issuing accredited certificates. Put simply, we audit your management system, and the Accreditation Body checks that we are doing our job properly.
Accreditation is the independent assessment of the Certification Body. An Accreditation Body checks that the Certification Body is competent, impartial and follows the international rules for carrying out audits and issuing accredited certificates. Put simply, we audit your management system, and the Accreditation Body checks that we are doing our job properly.
This is why the words aren't interchangeable: your company is certified, while the Certification Body is accredited. So you can proudly say "We are ISO 9001 certified", but leave "accredited" to the Certification Bodies.
There isn't one standard price for ISO certification because the amount of time we need to audit your company depends on your business.
The number of employees is an important starting point, but we also look at what your company does, the standard you want, the complexity and risk of your activities and whether you operate from more than one site.
| Standard | Audit type | ISO 9001 | ISO 14001 or 45001 | Company Size | Avg cost over 3 years |
| 9001 | Initial | X | Sml | R82 000 | |
| 9001 | Initial | X | Med | R120 000 | |
| 14001/45001 | Initial | X | Sml | R115 000 | |
| 14001/45001 | Initial | X | Med | R147 000 | |
| 9001+14001/45001 | Initial | X | X | Sml | R180 000 |
| 9001+14001/45001 | Initial | X | X | Med | R256 000 |
| 14001+45001 | Initial | XX | Sml | R200 000 | |
| 14001+45001 | Initial | XX | Med | R285 000 | |
| 9001+14001+45001 | Initial | X | XX | Sml | R254 000 |
| 9001+14001+45001 | Initial | X | XX | Med | R365 000 |
| 9001 | Transfer | X | Sml | R75 000 | |
| 9001 | Transfer | X | Med | R108 000 | |
| 14001/45001 | Transfer | X | Sml | R90 000 | |
| 14001/45001 | Transfer | X | Med | R118 000 |
*Sml <50 Employees; Med >50 employees
The figures above will give you an idea of what to expect but remember that they exclude travel and accommodation.
They also don't include additional follow-up audits that may be necessary if we need to return to your premises to close out nonconformities.
If you have several branches or sites that need to be included on your certification, please contact us for a quotation rather than using the table above.
Certification runs over a three-year cycle, including the initial audit and annual surveillance audits. We quote the full three-year cycle upfront for transparency and budgeting purposes, but you pay annually before each audit.
Certification is much more than the audit itself. It involves qualified and experienced auditors and highly experienced and trained staff performing audit activities and working around ongoing controls required by accreditation rules.
Most importantly, accredited certification is internationally recognised. Whether you are a small business or a multinational company, your certificate is issued against the same international standard and carries the same credibility.
You are therefore not simply paying for a certificate, but for an independent and internationally recognised assessment of your management system
If you have not implemented any system, start by obtaining the relevant standard you would like to be certified to. You can purchase the standard from the SABS’s webstore at https://www.sabs.co.za/purchase-standard.
Once you have an overview of what the requirements are, you can decide if you need an outside firm to assist you or whether you feel confident to implement the system on your own. You could also start by training core staff on the standard requirements.
Please note, we do not perform consulting. Once you have implemented your system it is time to enquire about certification costs and timelines.
Certification works in a three-year cycle.
If you're being certified for the first time, you'll start with an Initial Certification Audit, which has two stages.
Stage 1 is essentially our opportunity to look at your management system and determine whether you're ready to move on to the main certification audit. We look at your premises t see if your scope (what you do) is correct and your documented information (polices, procedures etc).
Stage 2 is the main audit. This is where we look at how your management system is actually working in your business and whether it meets the requirements of the ISO standard.
Stage 1 and Stage 2 are normally between two weeks and six months apart.
If we identify any nonconformities during the audit, you'll be given an opportunity to correct them. Once the audit process has been successfully completed and certification has been approved, your certificate is issued.
Your certificate is valid for three years, but that doesn't mean there are no audits for three years.
You'll have a surveillance audit every year to make sure the management system is still working and that you continue to meet the requirements of the standard.
Before the three-year certificate expires, you'll have a recertification audit. Once that is successfully completed, a new three-year cycle begins.
Not quite yet.
Registering a company and having a management system in place are two different things.
Before we can certify you, you need to have implemented the management system and actually be using it. An auditor needs evidence that your processes aren't just written down, but are being followed in the day-to-day running of the business.
Generally, you should allow around three to six months to operate your management system and build up the records and evidence needed for an audit.
If the business isn't operating yet, there usually won't be enough evidence for us to audit.
Definitely. A tender requirement is often what first introduces a company to ISO certification, but certification isn't intended to be something you get just to tick a tender box.
It tells potential customers that an independent Certification Body has audited your management system against an internationally recognised standard.
Depending on the standard, it demonstrates that you have structured processes in place to manage areas such as quality, environmental impacts or occupational health and safety.
There are also benefits inside your own business. A well-implemented management system can help you create more consistent processes, clarify responsibilities, manage risks, reduce mistakes and rework, identify problems and prevent them from happening again.
For companies looking beyond South Africa, certification to an internationally recognised standard can also make it easier for customers in other countries to understand and have confidence in how your business operates. In other words, it facilitates trade.
We wouldn't recommend approaching certification as a once-off requirement for a particular tender.
ISO certification is a three-year certification cycle with annual audits, so you should consider whether you're prepared to maintain the certification before starting the process.
Not winning one tender also doesn't mean the certification has lost its value. You may need it for the next tender, another customer may require it, and the management system should continue adding value to the way you run your business.
If you do decide that you no longer want certification, speak to your Certification Body about your options and any contractual requirements that may apply.
You have the right to question a nonconformity and ask the auditor to explain the specific requirement and evidence on which it is based.
If you still disagree, you may formally appeal the decision through our independent appeals process. Your concern will be reviewed by competent personnel who were not involved in the original decision.
Raising a legitimate concern or appeal will not prejudice your certification. Our responsibility is to ensure that every nonconformity is fair, evidence-based and supported by the applicable standard. Check our website for the complaints and appeal section.
For a first certification, we generally advise clients to allow approximately six to eight weeks after successfully completing the audit and closing any major nonconformities.
Why isn't the certificate issued immediately after the auditor leaves?
The auditor doesn't make the final certification decision. The audit results must first go through an independent review and certification decision process.
The actual timeframe can therefore vary depending on the size and complexity of your company, the number of standards involved, whether nonconformities need to be closed and the certification review process.
Yes. You don't necessarily need to start your certification from the beginning.
Moving an existing accredited certification from one Certification Body to another is called a transfer.
The first thing we need to establish is whether your existing certification is accredited. Don't be afraid to ask your current Certification Body for evidence of their accreditation.
We'll then ask you to complete some questions and provide information about your existing certification, including your three most recent audit reports.
If your certification meets the requirements for transfer, we take over the existing certification cycle rather than starting a new one. So, if your next audit was due to be a surveillance audit, we'll generally continue with that surveillance audit.
The important point is that the certification you're transferring must meet the applicable transfer requirements and we need enough information to verify its status.
Your scope of certification is simply a clear and factual description of the activities your company performs that are covered by the management system.
Think of it as answering the question:
"What does your company actually do that you want us to certify?"
For example, rather than telling us that you're "a leading provider of world-class engineering solutions across Southern Africa", tell us what you actually do:
"Manufacture and supply of precision-engineered components."
The second version tells us something we can actually audit.
Your scope should describe your core activities clearly and factually. It shouldn't be an advertisement for the company.
So, leave out:
- marketing words such as leading, superior, best-in-class, largest or value for money
- the geographic areas where you operate
- brand names and trademarks
- references to other standards
- general corporate or support functions that don't describe the product or service you're providing.
A useful test is to ask: Would someone who knows nothing about my company understand what we actually do from this sentence?
If the answer is yes, you're probably on the right track.
Yes, and it's worth checking before you sign on the dotted line.
An accredited Certification Body has itself been independently assessed to make sure it is competent and follows internationally recognised certification requirements.
Accredited Certification Bodies don't simply decide for themselves how long an audit should take or how certification should work. There are rules covering matters such as audit duration, auditor competence, certification decisions, transfers and the activities that can be certified.
An unaccredited certificate may look like an ISO certificate, but it doesn't carry the same independent assurance behind it and may not be accepted by your customer or tender authority.
This is particularly important if someone is offering certification unusually quickly or cheaply.
Ask them.
A legitimate accredited Certification Body should be able to tell you who they are accredited by and what they are accredited to certify.
You can ask to see their accreditation certificate and, where possible, verify the information with the Accreditation Body itself.
Some Accreditation Bodies you may come across include SANAS, DAkkS, ANAB, UKAS, RvA and JAS-ANZ.
Also remember that simply displaying an Accreditation Body's logo isn't enough. Accreditation has a defined scope, so it's worth checking that the Certification Body is accredited for the certification you're looking for.
This is where you need to be a little careful.
You can absolutely market the fact that your management system is certified, but there are rules about how certification and certification marks may be used.
For example, you could state:
Our Quality Management System is certified to ISO 9001.
You can also mention your certification in company profiles, tender documents, email signatures, proposals, social media and other marketing material.
However, you mustn't present the certification in a way that suggests that ISO itself certified your company (which they cannot), or that your product or service has been certified when it is actually your management system that has been certified.
The ISO logo itself isn't a certification logo and MAY NOT be used to advertise your management system certification.
Your Certification Body may provide you with an approved certification mark or seal and rules explaining exactly how and where it can be used.
When in doubt, ask your Certification Body before publishing it. It's much easier to check first than to change all your marketing material afterwards.