Questions about ISO certification

A certification body independently audits your management system against an international standard such as ISO 9001 or ISO/IEC 27001. If the system meets every requirement and works in practice, we issue a certificate and then carry out surveillance audits to confirm it continues to work. We are the independent third party, separate from you and from any consultant you use.

Most of the time is spent building and running your management system before the audit. Once your system has operated for a few months, with an internal audit and a management review completed, the Stage 1 and Stage 2 audits and the certification decision usually take six to twelve weeks from booking.

Fees are driven by audit duration, which depends on headcount, the number of sites, the standards in scope and the complexity and risk of your activities. Every Hexa quotation is fixed and itemised for the full three-year cycle, including Stage 1, Stage 2, both surveillance audits and travel, so there are no surprises.

Yes. A management system certificate is valid for three years, provided you pass the surveillance audits held at least once each calendar year. Before the certificate expires we carry out a recertification audit to renew it for a further three years.

No. Certification bodies must stay impartial, so we cannot design, write or implement the system we certify. You can build it yourself or with any consultant you choose. We can offer an optional pre-assessment that identifies gaps, without telling you how to fix them.

Nonconformities are graded as major or minor. You submit a root-cause analysis and corrective action plan, and for majors you also provide evidence the fix is effective before certification can be granted. Minors are normally verified at the next audit. Your auditor explains the process clearly at the closing meeting.

Audit time is calculated using the accreditation rules for each standard, mainly IAF MD 5 for quality, environmental and health and safety systems, and ISO/IEC 27006 for information security. Headcount, number of shifts, sites and risk all affect the number of days, and any adjustment is documented.

You need a defined scope, the documented information the standard requires, evidence that the system has been operating, a completed internal audit covering the whole scope and a management review. Your auditor will confirm in writing whether you are ready for Stage 2.

Customers can contact Hexa through our certificate verification page, quoting the certificate number. We confirm the organisation name, scope, standard, issue date and current status. Keeping a verifiable record is part of how certification protects your credibility.

Yes. Hexa audits organisations in England, Scotland, Wales and Northern Ireland, from single-site businesses to multi-site groups. Browse our location pages to see how certification supports organisations in your city and region.