6 Questions to Ask an ISO Certification Body Before You Sign

Every month I meet a founder who paid for an ISO certificate that no serious buyer will accept. The paper looked fine. The price looked even better. Then a tender desk or an export customer ran one check, found nothing behind the certificate, and the whole exercise had to be done again — this time at full cost, under time pressure, with the failed attempt sitting in the file. The painful part is that none of this needed detective work. Six questions, asked before signing, would have exposed every weak offer I have seen.

Short answer: Ask who accredits the body, whether that accreditation covers your standard, who will audit you and what they know about your sector, how surveillance audits are scheduled and charged, what the quoted price leaves out, and where anyone can verify your certificate. A good certification body answers all six in writing, without hesitation. A weak one goes vague on the first question — and that tells you everything.

Ask them by email, not on a sales call. Written answers can be checked, filed and held against the contract later; spoken answers evaporate the moment money changes hands. Take the replies in order, because the questions build on each other — accreditation means little without the right scope, a fair price means little if surveillance ambushes you in year two, and none of it means anything if nobody can verify the result. Half an hour with this list, before you sign, is the cheapest diligence in the whole certification process. Here is how each question earns its place.

1. Who accredits you — and can I check that today?

This is the only question that decides whether the certificate has value at all. ISO writes the standards. It certifies nobody. Your certificate comes from a certification body, and a certification body earns its standing from an accreditation body that audits it. In India that body is NABCB, under the Quality Council of India. Internationally, accreditation bodies recognise each other through the IAF Multilateral Recognition Arrangement — so ask for the accreditation body's name, then find the certification body on that body's public list yourself. It takes ten minutes. If the name is not there, stop. No discount repairs a certificate nobody can trace.

2. Does your accreditation cover my standard, in writing?

Accreditation is not a blanket licence. It is granted standard by standard, and often sector by sector. A body accredited for ISO 9001 may hold no accreditation at all for ISO 27001, and a certificate issued outside the accredited scope carries no more weight than an unaccredited one — the paper just looks better. So ask for the accreditation certificate and read its scope annexure. Your standard should be named there, plainly. Think of it like a driving licence: holding one for a car says nothing about riding a motorcycle. The categories are the point. Get the scope page attached to your contract file, not a verbal assurance that it will all be fine.

3. Who will actually audit us — and what do they know about our work?

You are not buying a logo. You are buying two or three days of a stranger walking your floor, reading your records and judging your system. That person's background decides whether the audit sharpens your business or turns into a paperwork ritual. Ask who the lead auditor is likely to be, whether auditors are employed by the body or brought in as freelancers, and what experience the team has in your sector. A food plant, a software firm and a fabrication unit fail in very different places. An auditor who has lived in your industry spots the real gaps fast — and their findings are the part of this purchase you will still be using a year later.

4. How do surveillance audits run — and what do they cost?

Certification is a three-year cycle, not a one-day event. Under the rules every accredited body follows, a surveillance audit falls due at least once each calendar year — the first within twelve months of your certification decision — and a fuller recertification audit closes the cycle before the certificate expires. Miss a surveillance audit and the certificate can be suspended. So pin the body down now: how many surveillance visits sit inside your cycle, when are they scheduled, how much notice do you get, and what does each one cost? Our guide to ISO 9001 surveillance and renewal shows how the cycle plays out year by year. A body that will not state surveillance fees in writing is telling you where its margin hides.

5. What does your quoted price leave out?

Compare three-year totals, never the first invoice. A quote can look low because whole lines sit outside it: the Stage 1 and Stage 2 audits priced apart, auditor travel charged later, certificate issue fees, fees for closing non-conformities, re-audit charges if a major finding needs a return visit, and the surveillance and recertification fees from the question above. Consultancy — the work of building your system — is a separate cost again, and an honest body keeps it separate, because the same firm should not build your system and then certify it. Ask for one sheet that lists every charge across all three years, with the exclusions named. Whoever refuses that sheet has answered your question.

6. Where will a buyer verify our certificate?

Assume your toughest customer will check. Accredited certificates can be traced on IAF CertSearch, the global database for accredited management-system certificates, and a proper body will also confirm its own certificates in writing and list them on its own register. Ask exactly that: will our certificate appear on IAF CertSearch, under what name and scope, and how soon after issue? Then test the route yourself with any certificate number the body gives you as a sample. Our walkthrough of how to check if an ISO certificate is genuine shows the full sequence. If verification depends on phoning the same office that sold you the certificate, you do not have verification. You have a promise.

None of these questions is hostile. Good certification bodies welcome them, because the answers are their sales pitch — accreditation they can point to, auditors they are proud of, fees they print without flinching. The hesitation is the signal. A body that rushes you past accreditation, scope and surveillance is not selling certification. It is selling paper with a seal on it, and your buyers will work that out at the worst possible moment: when the order is on the table.

If you want these six questions asked on your behalf before you commit, that diligence sits inside how we handle ISO certification at ComplyKart — we shortlist accredited bodies for your standard, compare their full three-year quotes line by line, and stay with you through the audits and the surveillance cycle that follows.