ISO certification glossary: twelve terms explained plainly

Much of the confusion in a first certification project is vocabulary. Certification, accreditation and attestation are three different things decided by three different kinds of organisation, and a surveillance audit is not a recertification. When managers, process owners and the auditor use one set of definitions, findings are understood the first time and evidence is prepared for the right question.

Each definition below is written for people running a management system, not for lawyers, and matches the wording on our standard and guide pages. Where a standard or scheme sets its own formal definition, that text governs; ask your consultant which edition applies to you.

• AccreditationFormal recognition by an independent accreditation body that a certification body, laboratory or inspection body is competent to do the work it offers.
• CertificationThe decision by an independent, accredited certification body, after its audit, that your management system conforms to the standard, confirmed by a certificate.
• AttestationAn independent opinion on your controls rather than a certificate, such as a SOC 2 report issued by a licensed CPA firm against the Trust Services Criteria.
• ValidationIndependent confirmation against set criteria, such as PCI DSS compliance validated by a Qualified Security Assessor or, where the acquirer allows, a self-assessment questionnaire.
• Surveillance auditThe certification body’s return visit, normally each year between certification and recertification, to confirm the system is still running and improving.
• RecertificationA fuller audit before the certificate expires, commonly in the third year, that renews certification for a further cycle.
• NonconformityThe non-fulfilment of a requirement, whether it sits in the standard or in your own system; in a certification audit it is graded major or minor.
• Corrective actionAction to remove the cause of a nonconformity so it does not recur, taken after the problem is corrected and checked afterwards for effectiveness.
• Statement of ApplicabilityThe ISO/IEC 27001 record of every Annex A control, stating whether each applies, why, and its implementation status, updated as risks change.
• ScopeThe sites, activities, services and boundaries your management system covers, which the certificate then describes and no more.
• Management reviewA planned review in which top management judges what the management system has delivered and decides what changes, using defined inputs and outputs.
• Internal auditYour organisation checking its own management system at planned intervals against the standard and its own procedures, before the certification body does.

These are the terms our consultants are asked about most; the standard and guide pages in the menu explain each one in the context of a specific standard. Sterling does not certify, accredit, attest or validate: an independent body audits and decides.