Initial Certification

Stage 1 confirms that your management system is ready to be assessed. It focuses on documented information, scope, site conditions, legal requirements and planning for Stage 2. Stage 2 is the main evaluation, where auditors test whether the system has been implemented and is effective in practice by interviewing staff, observing work and sampling records across the certified scope.

There is no single fixed gap. It depends on how ready the system is and on any concerns raised at Stage 1 that need attention before Stage 2. Some organisations proceed within a few weeks, while others need longer to resolve issues. The gap should not be so long that the Stage 1 findings are no longer valid, and we will agree timing with you.

Auditors need sufficient evidence that the system is operating, which normally means records showing that processes have been followed, at least one internal audit has been completed across the scope and a management review has taken place. Without this evidence it is difficult to demonstrate effective implementation at Stage 2.

A major nonconformity prevents certification until it has been addressed. You will need to determine the cause, take correction and corrective action, and provide evidence that we can verify, sometimes through a short follow up visit. If verification cannot be completed within the timeframe set out in ISO/IEC 17021-1, typically six months from the last day of Stage 2, a further Stage 2 audit is required.

The decision is made by competent personnel at Hexa Certifications who were not involved in your audit. They review the audit report, the evidence gathered and any corrective action submissions. Separating the audit from the decision is a core requirement of ISO/IEC 17021-1 and helps protect the impartiality and consistency of certification.

Certificates are issued for a three year cycle. Validity depends on successful surveillance audits during that period, normally at least once each calendar year. Before the three years end, a recertification audit is needed to renew the certificate for a further cycle. Certificates can be suspended or withdrawn if surveillance is not carried out or serious issues are found.

No. Certification bodies must not provide management system consultancy to the organisations they certify, as this would compromise impartiality. We can explain the certification process and what auditors will look for, but designing, writing or implementing your system must be done by your own team or an independent adviser with no link to our audit work.

Some audit activities can be conducted remotely where this is appropriate and permitted by the relevant IAF guidance, for example document review or interviews with staff at other locations. Activities that need direct observation, such as operational sites, production or construction work, are normally audited on site. We confirm the method for each activity in your audit plan.