Certification process
Five stages, no surprises
Certification follows ISO/IEC 17021-1, so every stage is defined, documented and fair. Here is what happens, who is involved and what you need to have ready.
- Fixed three-year price
- Independent decision-making
- Clear findings at every stage
- Annual surveillance
- 1
Within 2 working days
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- Scope, sites, headcount and shift patterns
- Standards and any integration between them
- Audit duration calculated from accreditation rules
- Fixed quotation for the full three-year cycle
- 2
Readiness review
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- Review of scope and documented information
- Understanding of legal and regulatory requirements
- Evidence of internal audit and management review
- Agreement of the Stage 2 audit plan
- 3
On site
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- Interviews with leadership and staff
- Observation of activities and the workplace
- Sampling of records against every clause
- Closing meeting with findings explained
- 4
Independent review
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- Root-cause analysis and corrective action plans
- Evidence for closure of major nonconformities
- Technical review by an independent reviewer
- Certificate issued with scope and dates
- 5
Three-year cycle
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
- Surveillance at least once each calendar year
- First surveillance within 12 months of the decision
- Recertification audit before expiry
- Scope changes assessed as you grow
What we audit
Six clauses, one cycle of improvement
Most of the standards we certify share the same Harmonized Structure. Your auditor follows it clause by clause, from the context of your organisation through to performance evaluation, and checks that each one feeds continual improvement.
- The same structure across ISO 9001, 14001, 45001, 27001 and more
- Shared clauses make integrated audits efficient
- Findings are mapped to the clause they relate to
Audit duration
How we calculate audit days
Audit time is not guesswork. It is set using the rules published for accredited certification, chiefly IAF MD 5 for quality, environmental and health and safety systems, and ISO/IEC 27006-1 for information security.
Effective headcount
Everyone working under your control, including part-time staff and contractors, adjusted for shifts.
Complexity and risk
The nature of your activities and the risks they carry, from office services to high-hazard operations.
Sites and scope
How many locations are included and how much of your activity sits inside the certified scope.
Integration
How far your systems for different standards share processes, which can reduce combined audit time.
Audit planner
Get an indicative audit profile in seconds
Audit time is calculated from published accreditation rules, not guesswork. Move the slider to see the typical audit days for ISO 9001 at your size.
- Based on the IAF MD 5 quality management table
- Adjusted for complexity, sites and shifts in your quote
- Integrated audits can reduce combined time
- Initial certification
- 3days
- Stage 1 + Stage 2
- Each surveillance
- 1days
- Years 1 and 2
- Recertification
- 2days
- Year 3
Indicative only. Final audit duration is confirmed in your quotation after reviewing scope, risk, sites and shifts. Larger organisations are quoted individually.
Get my exact quoteCertificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
Process questions
What is the difference between Stage 1 and Stage 2?
Stage 1 checks readiness: your scope, documented information, legal awareness, internal audit and management review. Stage 2 evaluates how effectively the system is implemented across your operations. Certification can only be recommended after Stage 2.
How much time should pass between Stage 1 and Stage 2?
Enough to resolve any areas of concern raised at Stage 1, but not so long that the findings become out of date. For most organisations this is a few weeks. Your auditor will agree a sensible gap with you based on what Stage 1 found.
What is a major nonconformity?
A major nonconformity is a failure that affects the ability of the system to achieve its intended results, such as a requirement not being addressed at all or a systemic breakdown. It must be corrected, with evidence of effectiveness, before certification can be granted.
What is a minor nonconformity?
A minor nonconformity is an isolated lapse that does not undermine the system as a whole. You provide a corrective action plan, and the auditor verifies its implementation at the next audit.
What does the certificate show?
The certificate shows your organisation name, the certified sites, the scope of activities, the standard and edition, the certificate number and the issue and expiry dates. Scope wording is agreed with you so it accurately describes what is certified.
Can we use a certification mark on our marketing?
Yes, within the rules in our certification agreement. Marks may be used on letterheads, websites and marketing, but not on products or packaging in a way that suggests product certification, and never for activities outside your certified scope.
What happens if we miss a surveillance audit?
Surveillance must take place at least once each calendar year. If it cannot be carried out in time, certification may be suspended until it is completed. Talk to us early if dates need to change and we will help reschedule within the rules.
Can our certificate be suspended or withdrawn?
Yes, for example if serious nonconformities are not resolved, surveillance does not happen, or the certificate or mark is misused. Suspension is temporary while issues are fixed; withdrawal ends certification. Both decisions can be appealed.
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.
