Certification Regulations

These regulations set out the general rules applicable to the certification of management systems by IQ Cert, in accordance with the requirements of ISO/IEC 17021-1 and of the reference standards for which IQ Cert provides certification services (ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 22000, ISO 50001).

The regulations apply to all organisations that apply for or hold a certificate issued by IQ Cert and form an integral part of the certification agreement. By signing the agreement, the organisation confirms that it has read and accepts these regulations.

The process starts with the submission of a certification application containing information about the organisation (name, sites, number of employees, field of activity), the standard or standards concerned and the requested scope of certification.

IQ Cert reviews the application to ensure that the information is sufficient for audit planning, that it has the competence and capability required for the requested scope and that no conflicts of interest exist. Based on this review, the audit duration is determined and a quotation is issued. The certification process starts only after the quotation has been accepted and the certification agreement has been signed.

The initial certification audit is conducted in two stages:

• The stage 1 audit evaluates the management system documentation, the site-specific conditions, the understanding of the requirements of the standard and the readiness of the organisation for stage 2. The conclusions of stage 1 are communicated in writing, including any areas of concern that could be classified as nonconformities during stage 2.
• The stage 2 audit takes place at the premises of the organisation and evaluates the implementation and effectiveness of the management system against all requirements of the standard and the requested scope of certification.

The interval between the two stages is set so that the organisation can resolve the areas of concern identified in stage 1. If major nonconformities identified in stage 2 are not closed within 6 months of the last day of the audit, stage 2 must be repeated before the certification decision can be taken.

IQ Cert appoints an audit team with the competence required for the standard and the sector of the organisation. The composition of the team and the audit plan are communicated to the organisation before the audit. The organisation may object, with reasons, to the appointment of an auditor or technical expert; IQ Cert reviews the objection and, if justified, replaces the person concerned.

The audit ends with a closing meeting in which the audit team presents its findings, including nonconformities, and its conclusions regarding the certification recommendation. The audit report is provided to the organisation.

Nonconformities identified during audits are classified as follows:

• Major nonconformity: failure to fulfil a requirement that affects the capability of the management system to achieve its intended results, the absence or failure of an essential element of the system, or a situation that raises significant doubt about conformity.
• Minor nonconformity: an isolated deviation from a requirement that does not affect the overall capability of the management system to achieve its intended results.

For each nonconformity, the organisation submits its root cause analysis, corrections and corrective actions within the time frame set by the audit team. IQ Cert verifies the effectiveness of the actions by reviewing the submitted documents or, for major nonconformities, through an additional audit.

The decision to grant, maintain, extend, reduce, suspend or withdraw certification is taken by persons who did not take part in the audit, based on the audit report, the corrective actions and all other relevant information. The recommendation of the audit team does not constitute the certification decision.

The certificate issued states the name and address of the certified organisation, the scope of certification, the reference standard, the certificate number, the date of the decision and the expiry date. The certificate is valid for 3 years from the date of the certification decision, provided that the conformity of the system is maintained and surveillance audits are carried out. The certificate remains the property of IQ Cert and is made available to the organisation for the period of validity.

Surveillance audits are conducted at least once a calendar year, except in years in which a recertification audit takes place. The first surveillance audit is conducted no later than 12 months from the date of the initial certification decision.

Surveillance audits verify that the management system continues to fulfil the requirements, including: internal audits and management review, the handling of complaints, the effectiveness of corrective actions, progress towards planned objectives, the use of the certificate and the certification mark, and changes within the organisation.

The recertification audit is planned and completed before the expiry date of the certificate, so that the recertification decision can be taken within the period of validity. The audit evaluates the continued effectiveness of the management system as a whole, across the entire scope of certification, taking into account the results of the surveillance audits of the previous cycle.

If recertification activities are not completed before the expiry date, certification expires and the organisation is no longer entitled to refer to certification. Certification may be restored within 6 months of expiry, under the conditions set by IQ Cert; otherwise a new initial certification process is required.

The organisation may request an extension of the scope of certification; IQ Cert reviews the request and determines the audit activities required, which may be carried out together with a surveillance audit. IQ Cert may decide to reduce the scope when the organisation no longer fulfils the requirements for part of the certified scope.

IQ Cert may conduct short-notice or unannounced audits to investigate complaints, in response to significant changes within the organisation, or to follow up on organisations whose certification has been suspended. In such cases the organisation may not object to the composition of the audit team.

IQ Cert suspends certification when:

• the certified management system persistently or seriously fails to meet certification requirements, including requirements for the effectiveness of the system;
• the organisation does not allow surveillance or recertification audits to be conducted at the required frequency;
• the organisation does not comply with the rules for using the certificate and the certification mark, or fails to fulfil its contractual obligations, including financial ones;
• the organisation voluntarily requests suspension.

During suspension, certification is temporarily invalid and the organisation must refrain from any reference to its certified status. If the causes of suspension are not resolved within the time frame set by IQ Cert (as a rule, no more than 6 months), certification is withdrawn or the scope is reduced. The status of suspended or withdrawn certificates is publicly available through the online verification service and on request.

The certified organisation undertakes:

• to continuously fulfil the certification requirements and maintain the conformity of its management system;
• to give the audit team access to all documents, records, sites and persons relevant to the certified scope, including for short-notice audits;
• to keep records of all complaints received relating to conformity with the requirements of the standard and of the actions taken, and to make them available to IQ Cert on request;
• to inform IQ Cert without delay of significant changes: legal, commercial or organisational status, ownership, top management, address and sites, field of activity, and major changes to the management system;
• to use the certificate and the certification mark only in accordance with the rules published by IQ Cert;
• to make no misleading or unauthorised statements regarding certification.

IQ Cert accepts the transfer of valid accredited certificates issued by other certification bodies. Before acceptance, a pre-transfer review is carried out, covering the validity of the certificate, the audit reports of the current cycle, open nonconformities and any complaints. Suspended or withdrawn certificates cannot be transferred.

IQ Cert treats all information obtained during the certification process as confidential, except for information that the organisation makes public or whose disclosure is required by law. Where disclosure is required by law, the organisation is informed in advance, unless this is prohibited.

IQ Cert makes publicly available, through the online verification service and on request, information on certificates granted, suspended or withdrawn: the name of the organisation, the standard, the scope of certification and the status of the certificate.

The fees for application review, the initial certification audit, surveillance audits, recertification, extension of scope and additional audits are set out in the quotation, based on the audit duration resulting from the application review. Information on fees is provided on request.

Organisations and any other interested party may submit complaints regarding the activities of IQ Cert, or appeals against certification decisions, in accordance with the Complaints and Appeals Procedure published on this website.