Independent certification your market trusts

It depends on the standard, the size of your organisation and how much is already in place. Where a system is largely documented and operating, the route from scoping to certification audit is typically eight to twelve weeks. Where a system is being built from the beginning, four to six months is a more realistic expectation. Standards such as ISO 27001 and ISO 13485 generally take longer because of the evidence required. We give an indicative timeline once the scope is agreed.

Fees are quoted against your agreed scope. The main factors are the number of sites, total headcount, the complexity of your activities, the standards involved and whether audits can be integrated. Audit duration is calculated using recognised methods rather than set arbitrarily. We complete scoping before quoting so the figure reflects the actual audit days required. Published price lists are unreliable for this work because two organisations of the same size can need very different programmes.

Consultancy means building or improving your management system: writing procedures, designing controls, training staff. Certification means independently assessing that system against a standard and issuing a decision. The two must be kept apart. An assessment body cannot design a system and then certify its own work, because the audit would no longer be impartial. Where UKCert provides readiness support, it is delivered under separate arrangements from the certification decision, and the separation is documented.

A management system certificate normally runs for three years, provided the system continues to meet the standard throughout. It is not a single event. The certificate remains valid only while surveillance audits are completed on schedule and any findings are closed within the agreed timescales. Before the three years end, a full recertification audit is carried out to confirm the system is still effective. Certificates can be suspended or withdrawn if the requirements stop being met.

Surveillance audits take place at planned intervals during the certificate cycle, usually annually. They are shorter than the original assessment and focus on specific areas: internal audits, management review, corrective actions, complaints, changes to your scope or operations, and a sample of core processes. Over the cycle, the whole standard is covered. The purpose is to confirm the system is still being used and still works, not to repeat the full Stage 2 audit each time.

Yes. Standards such as ISO 9001, ISO 14001 and ISO 45001 share a common structure, so requirements for leadership, planning, competence, internal audit and management review can be assessed once rather than repeatedly. This is called an integrated audit. It reduces total audit days, avoids interviewing the same people about the same clauses and gives you a single coordinated programme. The scope and any exclusions are agreed for each standard separately.

Findings are normal and are not a failure. Each one is recorded against the relevant clause with the evidence that supports it. Minor nonconformities require you to submit a corrective action plan, usually within an agreed period, and are verified at the next visit. Major nonconformities indicate a significant gap and must be closed and verified before a certificate is issued or maintained. In both cases you receive a clear written statement of what was seen and what is required.