Compliance / ISO/IEC 17021-1
Accreditation readiness for certification bodies.
ISO/IEC 17021-1 sets the requirements for organizations that audit and certify management systems such as ISO 9001 and ISO/IEC 27001. Accreditation bodies assess certification bodies against it before those bodies can issue accredited certificates.
We help new and established certification bodies build the processes, records and impartiality safeguards the standard requires, prepare for accreditation assessments and witness audits, and stay ready for surveillance.
At a glance
- Applies to
- Organizations that audit and certify other organizations' management systems
- Current version
- ISO/IEC 17021-1:2015
- In the United States
- Accreditation is granted by accreditation bodies such as ANAB and IAS
- For ISMS schemes
- ISO/IEC 27006-1 adds requirements for bodies certifying ISO/IEC 27001
ISO/IEC 17021-1
What accreditation looks for
Accreditation bodies want evidence that a certification body is impartial, competent and consistent. That means a documented management system, a working process for identifying and managing threats to impartiality, defined competence criteria for auditors and reviewers, and audit programs that follow the rules on audit time, sampling and certification decisions.
Bodies that certify information security management systems also have to meet ISO/IEC 27006-1, which adds requirements specific to ISO/IEC 27001 audits, including auditor competence in information security.
How we help
Gap assessment
See how far you are from an accreditation-ready system.
- Assessment against every clause of ISO/IEC 17021-1
- ISO/IEC 27006-1 review for ISMS certification schemes
- Review of procedures, records, contracts and certification documents
- Prioritized remediation plan
Impartiality and governance
The area accreditation assessors examine most closely.
- Impartiality risk assessment
- Mechanism for safeguarding impartiality
- Conflict of interest rules, including limits on consulting
- Legal status, liability and financial arrangements
Competence and the audit process
Consistent audits, carried out by people who are qualified to do them.
- Competence criteria for auditors, technical experts and reviewers
- Auditor evaluation and ongoing monitoring
- Audit time calculation and multi-site sampling
- Audit programs, reports and certification decisions
- Complaints and appeals handling
Accreditation readiness
Prepared for the office assessment and the witness audits.
- Internal audits of the certification body
- Management review support
- Preparation for office assessments and witness audits
- Corrective action support after findings
Who grants accreditation
Accreditation decisions are made by the accreditation body, such as ANAB in the United States. We help certification bodies prepare for assessment and keep their systems in good shape; the decision itself belongs to the accreditation body.
FAQ
Frequently asked questions
Does ISO/IEC 17021-1 apply to my company?
Only if your organization audits and certifies other organizations' management systems. Companies that want to be certified to ISO 9001 or ISO/IEC 27001 do not need ISO/IEC 17021-1 themselves. Their certification body does.
How long does accreditation take?
It depends on how much of the management system already exists and on the accreditation body's schedule, including witness audits that require real client audits to observe. Most certification bodies should plan for several months at least.
Find out where you stand on ISO/IEC 17021-1.
A readiness review shows what an assessor would find today and what it will take to close the gaps.