Glossary · ISO and management systems
Only a certification body can put its name on your ISO certificate.
An independent organization that audits a management system against a standard such as ISO/IEC 27001 and, if it conforms, issues and maintains the certificate.
Back to the glossary01 · In plain words
In plain words
An independent organization that audits a management system against a standard such as ISO/IEC 27001 and, if it conforms, issues and maintains the certificate.
A certification body is the auditor whose name appears on an ISO certificate. It runs the certification audits, decides whether to certify, and returns each year to check you still conform. It cannot also be the firm that built your system, because that would mean auditing its own work.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A certificate is only as credible as the body behind it. Buyers increasingly check whether the certification body is accredited, meaning a national accreditation body has assessed it against ISO/IEC 17021-1 and, for information security, ISO/IEC 27006. A certificate from an unaccredited issuer may be rejected in a tender. The choice also shapes your experience: audit scheduling, sector knowledge and how findings are written all come from this one relationship, which lasts for the full certification cycle.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The certificate itself
- Names the certification body, often with the accreditation mark and a certificate number buyers can look up.
- Tender and vendor forms
- Ask who issued your certificate and whether that body is accredited for the standard.
- The audit programme
- The body's plan for Stage 1, Stage 2, surveillance visits and recertification across the cycle.
- Accreditation registers
- National accreditation bodies publish which certification bodies they accredit and for which standards.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payments start-up comparing two quotes
A Bengaluru payments company receives two quotes for its ISO/IEC 27001 audit. One is noticeably cheaper but the issuer cannot name an accreditation body, and its certificates do not appear on any public register. The other is accredited by a recognised national body. The compliance lead checks with the bank that will rely on the certificate, which confirms it only accepts accredited certificates. The decision makes itself. The lead also confirms that the consultancy helping with readiness is a separate firm from the auditor.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Accreditation body
- The accreditation body checks certification bodies. It does not certify companies directly.
- Consultant
- A consultant, such as Auditify, helps you prepare. It cannot issue the certificate and should not audit work it designed.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Ask each shortlisted body which accreditation body accredits it, for which standard.
- Check the certificate format and whether it appears on a public register.
- Ask your key customers or regulators if they require a particular accreditation.
- Keep your readiness consultant and your certification body as separate firms.
- GuideISO 27001 certification guideThe roadmap, Stage 1 and Stage 2, and the three-year cycle.
- GuideHow long an ISO 27001 certificate lastsThe cycle of audits, and what keeps a certificate valid.
- GuideAccredited certification & ISO 42006Why the certifier matters, and five checks for any certificate.
Sources: public summaries of ISO/IEC 17021-1 (requirements for bodies certifying management systems), ISO/IEC 27006 and International Accreditation Forum (IAF) material on accredited certification.
Questions about Certification body
Can our consultant also be our certification body?
No, that would break impartiality.
Accreditation rules require a certification body to stay impartial. Auditing a system it helped design would be a conflict. Auditify prepares and advises; an accredited certification body audits and issues the certificate.
Can we change certification body mid-cycle?
Usually yes, through a transfer.
Accredited bodies commonly accept a transfer of a valid certificate after reviewing your audit history and open findings. Check the new body's transfer rules before switching.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.