ISO/IEC 17021-1 – Part 2: how to choose your certification body and prepare your teams
Choosing a certifier is not just about comparing rates. The criteria that make the difference, how to prepare your teams beyond documentation, the distinction between major and minor nonconformity, and the most common mistakes.
Read Part 1: what the standard governs, and what it changes for the audited company
ISO/IEC 17021-1 addresses certification bodies, but its requirements have direct consequences for companies. This second part covers the practical side: choosing your certifier with the right criteria, preparing your teams beyond documentation, and understanding the two levels of nonconformity.
Choosing your certifier: beyond price
Choosing a certifier is often treated as an ordinary purchasing decision, comparing rates across several accredited bodies. That is a common and, over time, costly mistake.
What determines the quality of an audit is, first and foremost, the sector competence of the assigned auditor. The standard requires it, but not every body meets it with the same rigour. Before signing, these questions are legitimate:
- Does the proposed auditor have concrete experience in your industry?
- How does the body handle a conflict of interest if your auditor has had past ties with your company?
- What is the decision-making process after the audit, and who takes part in it?
- What timelines apply to handling identified nonconformities?
A body that cannot clearly answer these questions deserves further questioning before any commitment.
Preparing your teams: beyond documentation
Effective preparation is not limited to updating procedures and records. The auditor will meet operators, workshop supervisors, and field coordinators. These people must be able to explain their role in the management system, not just produce documents.
Three points to check before an audit:
- Do operational staff understand the procedures that concern them? The auditor will ask direct questions to people on the ground. An answer that contradicts the written documentation is a strong signal for the body.
- Are records up to date and accessible? An effective system is a demonstrable system. Evidence must exist at the time of the audit, not be reconstructed afterwards.
- Are known issues documented and addressed? Trying to hide a gap is counterproductive. A rigorous body will eventually find it. A documented gap with a corrective action under way is a sign of system maturity, not grounds for refusing certification.
Nonconformities: understanding the two levels
The standard distinguishes between major and minor nonconformities. This distinction has concrete consequences for the rest of the audit.
A major nonconformity calls into question whether certification is granted or maintained. It points to a structural failure of the system: a missing required process, a systematic gap between what is written and what is done, or an unaddressed confirmed risk. It requires a verified corrective action before any favourable decision.
A minor nonconformity identifies an isolated gap or a one-off weakness. It does not prevent certification but must be addressed within a timeframe agreed with the body, and may be followed up at the next surveillance audit.
Knowing this distinction makes it possible to read the auditor's findings accurately, rather than reacting disproportionately to every observation.
The most common mistakes
Choosing on price alone. A cheaper audit is not necessarily a quality audit. Auditor competence and process rigour come at a cost.
Treating the audit as an isolated event. Certification runs on a three-year cycle. Surveillance audits are not formalities. Neglecting them, or failing to build on their findings, gradually weakens the value of the system.
Confusing the auditor's role. The auditor is neither a consultant nor an inspector. They assess the conformity and effectiveness of the system. Asking them for solutions falls outside the scope of their mission.
Preparing documentation only. A management system that exists on paper but not in practice will be exposed during discussions with operational teams. Preparation must be as operational as it is documentary.
Read Part 1: what the standard governs, and what it changes for the audited company