The call usually goes like this. ISO 9001 in a fortnight, no disruption, one fixed fee. A few weeks later a smart certificate arrives. Then a main contractor's portal, or a council tender, rejects it. The business has paid for a certificate that the customer it was bought for will not accept.
The difference is almost always one word: accredited. This article explains what that word means, how accredited and non-accredited certification differ, and where businesses get caught out.
It is not a criticism of non-accredited providers. Some do careful, honest work, and accreditation is a choice, not a legal requirement. The point is simpler: accreditation is the only independent evidence that a certification body is doing the job properly, and it is often what your customers are looking for.
First, ISO does not certify anyone
ISO, the International Organization for Standardization, writes the standards. It does not carry out certification and it does not issue certificates. Its logo cannot be used by anyone outside ISO without its permission. So if a certificate says you are "certified by ISO", or carries the ISO logo, the provider has not followed ISO's own rules, and it is worth asking why.
Certificates are issued by certification bodies: independent companies that audit your business against the standard. Anyone can set up as one. That is where accreditation comes in.
The chain of trust
Accredited certification works as a chain, and every link is checked.
1. The standard. ISO 9001, ISO 14001, ISO 45001 and the rest set out what a management system must do.
2. The certification body. It audits your business and decides whether to certify you. To be accredited, it must work to its own international standard, ISO/IEC 17021-1, which covers competence, impartiality and how audits are run.
3. The accreditation body. It checks the certification body. In the UK that is UKAS, the United Kingdom Accreditation Service, which the government appoints as the UK's only national accreditation body under the Accreditation Regulations 2009. UKAS assesses each certification body every year and fully reassesses it every fourth year, including watching its auditors at work.
4. International recognition. UKAS has signed international agreements with accreditation bodies around the world, so a UKAS-accredited certificate is recognised by buyers in other countries, and theirs are recognised here.
A non-accredited certificate has link 2 but not the links above it. The certification body may well do good work. The difference is that nobody independent has checked.
Side by side
| Accredited (for example UKAS) | Non-accredited | |
|---|---|---|
| Who checks the certification body | UKAS, or another national accreditation body that has signed the international agreements. Every year, with a full reassessment every fourth year. | No independent assessment. |
| The rules for your audit | ISO/IEC 17021-1 and the International Accreditation Forum's mandatory documents. | Set by the provider. |
| How long the audit takes | Set by published rules based on your headcount, activities and risk. | Set by the provider. |
| Independence | The certification body must not certify a system it helped to build. | Depends on the provider's own policy, with no independent check. |
| Accepted by buyers and tenders | Widely accepted, and often required. | Accepted by some buyers. Often not accepted where a buyer or tender asks for accredited certification. |
| Recognised in other countries | Yes, through the international recognition agreements. | No formal international recognition. |
| Moving to another certification body | Can be transferred under international rules. | Cannot be transferred. You start again as a new client. |
| If something goes wrong | Complain to the certification body, then to UKAS. | Complain to the provider. There is no independent body above it. |
Not UKAS does not always mean not accredited
A certification body can be accredited by another country's national accreditation body, such as DAkkS in Germany or ANAB in the United States. If that body has signed the same international agreements, the certificate is accredited and internationally recognised.
Some UK buyers and public sector tenders ask for UKAS specifically, though. Read the requirement word for word before you choose. And check that any "accreditation" quoted comes from an organisation listed among the signatories of the International Accreditation Forum. If it does not, the certificate is not accredited in the internationally recognised sense, however it is described.
ISO itself says a non-accredited certification body is not necessarily disreputable. The issue is not honesty. It is that you have no independent way of knowing, and neither does your customer.
Where businesses get caught out
1. The wrong certificate for the customer. If a portal, main contractor or tender asks for accredited certification, a non-accredited certificate may be turned down, sometimes at the last moment. Check what your customers require before you buy.
2. Paying twice. A non-accredited certificate cannot be transferred to an accredited certification body. Under international rules you are treated as a new client, with a full Stage 1 and Stage 2 audit and a new fee. The work you did for the first certificate still helps, but the certificate itself does not carry over.
3. The right body, the wrong scope. Accreditation covers named standards and named business sectors. A certification body accredited for ISO 9001 in manufacturing may not be accredited for construction or healthcare. Check its schedule of accreditation covers your sector. Then check the scope printed on your own certificate covers the services your customer is actually buying, and every site that delivers them.
4. Reading the certificate, not the logos. A certificate's design tells you nothing about its standing. The UKAS mark may only be used by an accredited certification body, alongside its accreditation number, and the ISO logo should not appear at all. Check the accreditation, not the artwork.
5. Write it and certify it. Some packages build your management system and certify it in one go. Accredited certification bodies are not allowed to do this, because it would mean judging their own work. If you want an accredited certificate, keep the advice and the certification separate.
6. Certificates that quietly lapse. Accredited certification runs on a three-year cycle, with surveillance audits every year. Miss a visit or ignore a major nonconformity and the certificate can be suspended or withdrawn. Customers can check its status online, so they may know before you do.
7. A certificate without a system. If the system was bought off the shelf and never used, the certificate will not survive a customer audit, an insurer's questions or an investigation after an incident. Regulators and courts look at what actually happens on the ground, not the certificate on the wall.
Is non-accredited ever enough?
If no customer, tender or insurer will ever ask for your certificate, and you simply want a better-run business, you may not need certification at all. A gap assessment, an internal audit and a system your team actually uses will give you the improvement without the fee. If anyone outside your business is going to rely on the certificate, choose accredited.
Seven questions to ask before you sign
1. Who accredits you, and what is your accreditation number?
2. Does your schedule of accreditation cover this standard and my business sector?
3. How have you worked out the number of audit days?
4. Who will audit us, and what experience do they have in our sector?
5. What is the total cost over the full three-year cycle, including surveillance visits, recertification, travel and any extra fees?
6. Do you, or anyone linked to you, offer consultancy to the businesses you certify?
7. How do I raise a complaint or appeal a decision?
A good certification body, accredited or not, will answer every one of these openly.
How to check in five minutes
1. Check the certification body. Look up its accreditation number using the search on the UKAS website. The schedule of accreditation must be current and cover the standard and sector you need.
2. Check a certificate. UKAS runs CertCheck, a free database for checking management system certificates. Internationally, there is IAF CertSearch. Certification bodies are not obliged to upload to IAF CertSearch, so a missing entry is a prompt to ask questions, not proof of a fake.
3. Confirm the certificate is real. Contact the certification body directly, using details from its own website, and ask it to confirm the certificate number, scope and expiry date.
The view from inside
I have worked inside a UKAS-accredited certification body, rebuilt its management system and made certification decisions. Accreditation is not a badge on a letterhead. It means every audit and every decision can be examined by someone whose job is to find the weaknesses. That scrutiny is exactly what your customers are paying attention to when they ask for an accredited certificate.
Where PMSCS helps
PMSCS does not issue certificates. It prepares your business for certification, helps you choose and check a certification body using the questions above, and supports you through Stage 1, Stage 2 and the visits that follow, so the certificate you pay for is one your customers will accept.
This article is general guidance, not legal advice.