Applicable framework
The assessment hierarchy begins with the primary standard and includes applicable normative, regulatory, scheme-owner and ISCB documents. When requirements conflict, ISCB will identify the controlling criterion before assessment.
- ISO/IEC 17021-1:2015 is the primary certification-body standard.
- ISO/IEC 17011:2017 governs ISCB's accreditation process and decisions.
- Current IAF Mandatory Documents and scheme-specific normative documents apply according to the requested accreditation scope.
Core organisational requirements
Legal status and responsibility
The applicant must be a legally identifiable entity, or a defined part of one, that can be held responsible for its conformity-assessment activities, contractual obligations and decisions.
Impartiality and independence
Identify, analyse, evaluate, treat, monitor and record risks to impartiality. Commercial, financial, ownership, relationship, consultancy and self-review threats must be controlled continuously.
Confidentiality and information security
Protect confidential information, personal data, intellectual property, examination or scheme security and electronic records. Disclosures must be legally authorised and appropriately communicated.
Organisation and governance
Define authority, responsibilities, reporting lines, committees and safeguards. Technical work, review and decisions must be assigned to competent and appropriately independent functions.
Competence and resources
Set competence criteria for every role affecting accredited activities; evaluate, authorise, monitor and periodically re-evaluate personnel. Control facilities, equipment, software and externally provided resources.
Controlled operations
Accept work only after confirming capability and scope. Use controlled methods and records, handle deviations, review outputs and ensure decisions are traceable to adequate objective evidence.
Management system
Maintain document and record control, risk and opportunity processes, complaints, appeals, nonconforming work, corrective action, internal audit, management review and continual improvement.
Accreditation claims
Claims, certificates, symbols and references to accreditation must be accurate, limited to the granted scope and changed immediately when accreditation is suspended, reduced, withdrawn or expires.
Service-specific technical requirements
- Define each certification scope using the applicable management-system standard, technical sector classification, geography and certification activity.
- Operate a documented impartiality process with top-management commitment, threat analysis, stakeholder input and effective safeguards.
- Establish competence criteria and evaluation processes for application reviewers, auditors, technical experts, reviewers and certification decision-makers by scheme and technical area.
- Control application review, audit time, multi-site sampling, audit planning, stage 1, stage 2, surveillance, recertification, special audits, transfer and restoration.
- Ensure independent review and certification decisions, certificate content, public status information and controls over marks and claims.
- Maintain witnessed-audit readiness and reliable certification data required by applicable schemes and IAF documents.
Minimum application and readiness evidence
Submit current, approved documents and representative implementation records. Templates without operational evidence are not sufficient.
Assessment, decision and continued accreditation
Application and scope review
ISCB reviews legal identity, requested scope, locations, resources, readiness and applicable criteria before quotation and assessment planning. Acceptance of an application is not a promise of accreditation.
Assessment
Assessment may include document review, office or remote assessment, on-site technical assessment, witnessing, interviews, vertical and horizontal record tracing, and evaluation of representative activities. The mix depends on scope and risk.
Nonconformities and decision
The applicant must determine causes, correct the specific issue, implement proportionate corrective action and provide evidence of effectiveness within the notified period. Accreditation decisions are made independently from assessment and only for demonstrated competence.
Maintenance
Accredited bodies must remain competent, comply with surveillance and reassessment, notify significant changes without delay, cooperate with witnessing and record access, address complaints and nonconformities, and control all accreditation claims.
Principal references
- ISO/IEC 17021-1:2015
- Applicable ISO/IEC 17021 series competence documents
- IAF MD 1, MD 2, MD 4:2025, MD 5, MD 11, MD 15, MD 17 and MD 28
- Scheme-specific IAF MDs and normative documents, where applicable
Document editions and external publications can change. The edition stated in the accreditation agreement, transition notice or other formal ISCB communication controls the assessment. Applicants should verify current editions before use.