This is an awkward article for a certification body to write, because several of the checks below are ones a prospective client could apply to us. We are publishing it anyway, on the straightforward basis that a market where buyers can tell the difference is a market we would rather compete in.
1. Is the certification accredited — and by whom?
This is the single most important question and the one least often asked. Accredited certification means the certification body has itself been assessed against ISO/IEC 17021-1 by a national accreditation body that is a signatory to the IAF Multilateral Recognition Arrangement. That MLA signature is what makes an Indian certificate recognised abroad.
Verify it directly with the accreditation body, not from the certification body’s website. Check the scope too: accreditation is granted for specific standards and specific technical sectors, and a body accredited for ISO 9001 is not automatically accredited for ISO 27001.
2. Do the audit days match the calculation?
Audit duration is set by IAF MD 5 from effective headcount and risk category. Ask for the calculation. A quotation with materially fewer days than the rule requires is not cheaper certification; it is certification that may not survive the accreditation body’s next witness audit.
3. Who audits you, and what is their sector background?
Ask what technical sector competence the assigned auditor holds and where it came from. An ISO 22000 audit conducted by someone who has never worked in food processing will find documentation gaps and miss the things that matter. You are entitled to know, and a body that treats the question as intrusive has answered it.
4. Does the body also sell you consultancy?
ISO/IEC 17021-1 prohibits a certification body from providing management system consultancy to an organisation it certifies. A provider offering to implement your system and then certify it is either not accredited or not complying. This one is worth being blunt about: it is the clearest available signal.
5. What does the three-year total actually cost?
Compare total cycle cost, not initial audit cost. Surveillance audits at twelve and twenty-four months and the recertification audit are all mandatory. A low initial price with surveillance quoted later is a common structure and it obscures the real number.
6. Can you verify their existing certificates?
An accredited certification body maintains a publicly accessible directory of certified clients, because a certificate that cannot be independently verified is not doing its job. If you cannot check an existing client’s certificate without going through the certification body, ask why.
A certificate is worth exactly what the audit behind it was worth. Buying the cheapest audit produces the cheapest certificate, and your customer is the one who eventually discovers that.