ISO/IEC 17021-1 accreditation and requirements: certificates that stand up to scrutiny.

What it is

What is ISO/IEC 17021-1 and what is it used for?

ISO/IEC 17021-1, "Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements", is the international standard that certification bodies for ISO 9001, ISO 14001, ISO/IEC 27001 and every other management system standard are accredited against. It comes from ISO's committee on conformity assessment, CASCO, and it governs the certifier rather than the certified organisation.

Its purpose is trust. When an accreditation body confirms that your body meets it, your clients, their customers and regulators can rely on your audits and certification decisions. For the certification body, the standard is also a working discipline: how audit time is set and justified, how auditors are qualified, how conflicts of interest are handled and how certificates are issued, maintained and withdrawn.

Current edition. ISO/IEC 17021-1:2015, published in June 2015, replaced ISO/IEC 17021:2011 and was confirmed by ISO in 2020. A further systematic review closed in March 2026; iso.org shows no outcome yet, so the 2015 edition remains the one your accreditation body assesses against.

Who it is for

Who needs ISO/IEC 17021-1 accreditation?

Any organisation that wants to issue accredited management system certificates. An unaccredited certificate can fail the checks that buyers, tender panels and regulators run, and your clients carry that risk. Enquiries come to us from four directions:

• Your clients' customers reject unaccredited certificates. Buyers can look up a certificate and its accreditation before they qualify a supplier.
• Tenders specify accredited certification. Public and private tenders name accreditation, and a certificate without it disqualifies your client.
• A regulator or scheme requires it. Food safety, information security, AI and service management schemes add their own requirements on top of ISO/IEC 17021-1.
• A group company or new market expects it. A parent body extends accreditation to a subsidiary, or an inspection or testing organisation adds management system certification.

Requirements

What are the main ISO/IEC 17021-1 requirements?

The requirements sit in clauses 4 to 10, after the scope, references and terms, including the definitions of major and minor nonconformity that every audit report relies on. The list below stays at clause-title level and in plain language; your body is assessed against the standard itself and against the sector documents that apply to each scope.

• Clause 4 Principles: the principles that make certification worth relying on, which the rest of the standard puts into practice.
• Clause 5 General requirements: legal and contractual matters and the management of impartiality, including the rule that a certification body does not provide management system consultancy.
• Clause 6 Structural requirements: how the body is organised and governed so that certification decisions are made with authority and independence.
• Clause 7 Resource requirements: competent auditors, reviewers and decision-makers, and control of the people and organisations the body relies on.
• Clause 8 Information requirements: what the body makes public and what each certificate must identify: client and sites, dates, a unique code, the standard and its issue, the scope and the body.
• Clause 9 Process requirements: the audit and certification process, from audit time and planning through the two-stage initial audit, surveillance and recertification to special audits and suspension.
• Clause 10 Management system requirements for certification bodies: the body's own management system, which keeps the other requirements working over time.

Accreditation process

How do you get ISO/IEC 17021-1 accreditation?

Accreditation is granted by an accreditation body, not by another certification body and not by a consultant. The body has to run real audits under its new system before there is anything to assess, so the route has five stages.

1. 01
   Define the accreditation scope and choose the accreditation body.Agree the standards, technical areas, sector documents and locations you will apply for, and the accreditation body, usually the national one.
2. 02
   Gap analysis: review the body against clauses 4 to 10.Compare governance, impartiality, competence, audit processes and records with the standard and each sector document; agree actions, owners and dates.
3. 03
   Build the system and audit clients under it.Set procedures, audit time rules, competence criteria and templates, then run initial audits and decisions so the assessor has files to sample and audits to witness.
4. 04
   Audit internally and hold the management review.An internal audit traces real client files from application to certificate; the management review acts on the results, and findings are closed with evidence.
5. 05
   Complete the accreditation body's assessment.Document review, the assessment at your offices and witnessed client audits; you close any findings by its deadline, its decision-makers grant the scope, and surveillance and reassessment follow on its cycle.

Check the route before you sign. Only an accreditation body operating to ISO/IEC 17011 can accredit a certification body; a "17021-1 certificate" from anyone else will appear on no register. Confirm that the accreditation body is recognised under the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA, for the standards you intend to certify. The accreditation buyer's checklist

Cost

How much does ISO/IEC 17021-1 accreditation cost?

The accreditation budget grows with the scope you ask for. A body applying for one standard in a few technical areas needs far less than one applying for several standards, each with its own sector document and auditor pool.

Timeline

How long does ISO/IEC 17021-1 accreditation take?

The documents come quickly; operating history does not. Your body needs completed client audits and decisions under its new procedures, and the accreditation body's queue and witnessing schedule sit outside your control. As an estimate, a first accreditation takes six to twelve months.

Your engagement

What your ISO/IEC 17021-1 engagement includes

Sterling OS™ runs every engagement, adapted to a certification body. Sterling does not accredit and does not certify: the accreditation body assesses your body and decides on accreditation, and your body alone makes the certification decisions for its clients.

• Design™: guided support

  Your managers and auditors write the procedures and competence criteria; a Sterling consultant sets the method, reviews each output and coaches the owners.

• Drive™: managed support

  The alternative to Design™ for bodies short of time: Sterling drafts the management system, audit time rules and templates with your people and runs the programme to the assessment.

• Sustain™: after accreditation

  Internal audits, competence reviews, preparation for surveillance and reassessment, and support when you extend the scope.

• Automate™: Effivity

  Your certification body's management system runs in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Accreditation decisions remain with the accreditation body.

Often combined with

Standards organisations pair with ISO/IEC 17021-1

• CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
• ISO 10012ISO 10012 Measurement Management certification consulting: measurement processes and equipment controlled for valid results, ready for a certification audit.
• ISO 14065ISO 14065 accreditation and requirements for bodies verifying environmental information: GHG statements, footprints, the route, cost and timing factors.
• ISO 15189ISO 15189 accreditation consulting for medical laboratories: quality and competence for reliable, timely results, prepared for the accreditation assessment.
• ISO 15190ISO 15190 laboratory safety for medical labs: gap and risk assessment, procedures, training and internal audit alongside ISO 15189.
• ISO 17034ISO 17034 accreditation consulting for reference material producers: competence and consistent operation evidenced and prepared for accreditation assessment.