The process of certification, including certification audits, of management systems is described in ISO 17021. You should allow sufficient time for preparation up to a certification audit. Organizations that are already close to standard requirements obviously do not need as much time as organizations that are still far from standard requirements.
Note that it is not sufficient for successful certification simply to document your processes in accordance with the standard documents prescribed. You must be able to show in the certification audit that your organization works according to its own specifications. To be able to show this, you need evidence from your operational practice (verification documents). Certification auditors will ask to see examples from implemented customer orders. For example, if one of your customers has made changes to their order, you need to be able to show how you ensure that these changes are incorporated into the implementation.
Don’t underestimate the effort required to develop your organization into a standards-compliant operation. Conduct internal review audits to identify the extent to which your organization is already compliant. Do not see internal audits as a dress rehearsal before scheduled external audits, but conduct them regularly to really benefit from them. During the preparation phase for a system certification, it is best to seek competent external support.
Select a certifying body that fits your company. Knowledgeable certification consultants can assist you in the selection and initiation process. Get an auditor assigned who understands your industry and the scale and complexity of your business. Careful selection is important because this certification body and auditor will not only perform the initial certification audit, but will be with your organization for the long term.
Coordinate the certification audit date with your auditor well in advance. If possible, enter into a dialog with your auditor long before the certification audit. Describe your situation to them. You can also send documents to your auditor in advance of the certification audit. Auditors often provide useful recommendations even before the certification audit.
Your auditor will prepare a detailed audit plan for the certification audit, from which you can see when audits are to be carried out in which departments. If you see scheduling conflicts internally, don’t be afraid to talk to your auditor to find solutions. Auditors are usually cooperative.
The certification audit usually takes place on site at your company. During the exchange, the auditor gets a picture of how your organization works. The cost of the certification audit depends on the size of your organization and the complexity of your business processes. Certification bodies use a cost schedule to estimate the costs of the auditand this takes these two criteria into account. For more complex certification audits, multiple auditors can be used to form judgments in coordination with each other. Do not regard the certification audit as a mere compulsory exercise. Good auditors will give you many pointers that you can use to take your organization to a higher level.
Following the certification audit, your auditor will prepare an audit report in which he or she will record conformities and deviations (major deviations, minor deviations, potential for improvement). Major deviations from the standard requirements may result in your organization being denied certification. As a rule, however, your auditor will give you a chance to rework and will check in a post-audit that the non-conformities have been corrected in a timely manner. Then the certificate will be issued.
After the initial certification, your auditor will carry out follow-up audits at your company on a regular basis, usually annually. In doing so, a good auditor will not only check whether your system is still effective, but will also try to further improve your system. Note that follow-up audits will result in loss of certificate if major non-conformances are found and not shown to have been corrected.
Unlike the German driver’s license, management system certificates have an expiration date. They are valid for three years. Then a recertification must be carried out, which is about 2/3 as extensive as an initial certification.