ISO & Compliance

ISO certification can help organisations demonstrate that their management systems follow an internationally recognised framework for quality, information security, environmental management, occupational health and safety, or other areas. For businesses operating in European and US markets, certification may also form part of customer, supplier, tender, or contractual requirements. However, achieving certification involves more than preparing documents and booking an audit. Organisations need to understand the selected ISO standard, assess their current processes, address identified gaps, implement the management system, conduct internal audits, complete a management review, and prepare for the external certification audit. The certification process generally moves from preparation and gap assessment through implementation, internal verification, Stage 1 and Stage 2 audits, corrective actions, and the certification decision. The exact requirements and audit arrangements can vary according to the standard, organisation size, scope, industry, and certification scheme. Key Takeaways A gap assessment identifies differences between current practices and the requirements of the selected ISO standard. Certification preparation involves implementation, documented information, employee awareness, monitoring, internal auditing, and management review. Stage 1 focuses on readiness, scope, documentation, and planning for Stage 2. Stage 2 evaluates whether the management system is actually implemented and working in practice. Nonconformities may require corrective action and evidence before certification can be completed. Businesses targeting European and US customers should consider customer, contractual, industry, and market-specific expectations alongside ISO requirements. Certification is not the end of the process because certified organisations normally undergo continuing surveillance and later recertification. Table of Contents Understand the ISO Certification Process Select the Right ISO Standard Conduct a Gap Assessment Develop an ISO Implementation Plan Prepare Required Documentation Implement the Management System Train Employees and Build Awareness Conduct Internal Audits Complete the Management Review Select a Certification Body Prepare for the Stage 1 Audit Understand the Stage 2 Certification Audit Handle Nonconformities and Corrective Actions Complete the Certification Decision Prepare for Surveillance Audits ISO Certification Considerations for European and US Markets Common ISO Certification Mistakes to Avoid Practical ISO Certification Checklist Conclusion FAQs Understand the ISO Certification Process The ISO certification journey usually involves several connected stages. A simplified process looks like this: Gap assessment → Implementation → Internal audit → Management review → Stage 1 → Stage 2 → Corrective actions → Certification decision → Surveillance The exact process can differ depending on the ISO standard and certification scheme. ISO 9001, ISO 14001, ISO 45001, and ISO/IEC 27001, for example, address different management-system subjects, so the evidence and controls assessed will vary. The initial certification audit itself is generally conducted in two stages. ISO and IAF auditing guidance describes Stage 1 as a readiness and planning assessment, while Stage 2 evaluates implementation and effectiveness. Select the Right ISO Standard The first step is identifying which standard is relevant to the organisation’s objectives. Common examples include: ISO 9001 for quality management ISO 14001 for environmental management ISO 45001 for occupational health and safety ISO/IEC 27001 for information security ISO 22000 for food safety management ISO 13485 for medical devices ISO 50001 for energy management The choice should be connected to the organisation’s actual business requirements. For example, a software company serving enterprise customers may investigate information security requirements, while a manufacturing business may have quality, environmental, and occupational health and safety objectives. Conduct a Gap Assessment A gap assessment compares the organisation’s existing processes against the requirements of the selected ISO standard. This is an important preparation stage because businesses may already have many relevant processes in place. The assessment can identify: Existing controls Missing procedures Weak processes Documentation gaps Training requirements Monitoring gaps Compliance issues Risk management weaknesses Internal audit requirements Management review requirements Create a Gap Action Plan Once gaps have been identified, convert the findings into an action plan. Gap Required Action Responsible Person Target Date Status Missing procedure Develop and approve procedure Process owner Planned date Open Incomplete records Establish record-keeping process Department manager Planned date In progress Training gap Conduct employee training HR/Management Planned date Open Internal audit gap Develop audit programme QMS/Management representative Planned date Open A practical action plan helps management track progress rather than treating the gap assessment as a one-time report. Develop an ISO Implementation Plan After identifying the gaps, the organisation needs a structured implementation plan. The plan may include: Management responsibilities Process owners Policies Objectives Risk assessment Operational controls Documentation Employee training Monitoring Internal audits Management review Corrective actions Implementation should focus on making the management system part of normal business operations. Creating documents without actually changing or controlling relevant processes is unlikely to provide sufficient evidence during the certification audit. Prepare Required Documentation The documentation required depends on the ISO standard and the organisation’s processes. Depending on the standard, documented information may include: Policies Objectives Procedures Process information Risk assessments Registers Work instructions Records Monitoring results Training records Internal audit results Management review records Corrective action records The objective should be useful and controlled documentation rather than creating unnecessary paperwork. Implement the Management System The next stage is putting the planned processes into practice. Employees should understand: What their responsibilities are Which processes they need to follow Which records they need to maintain What risks apply to their activities How problems are reported How corrective actions are handled How performance is monitored The organisation should also collect objective evidence that the system is operating. For example, this may include completed records, monitoring results, training evidence, audit reports, customer feedback, incident records, risk assessments, or corrective actions. Train Employees and Build Awareness ISO certification is not only a management responsibility. Employees who perform activities within the certification scope should understand the relevant requirements and their responsibilities. Training and awareness activities may cover: ISO requirements Company policies Operational procedures Quality or security responsibilities Risk controls Health and safety requirements Environmental responsibilities Reporting procedures Corrective actions Training records should be maintained where required by the organisation’s management system. Conduct Internal Audits Before the certification body conducts its external audit, the organisation should assess its own management system through internal audits. […]