The ISO 50001 certification process, step by step

Who takes part in ISO 50001 certification

Four parties have a role, and confusing them is the source of most bad advice about this standard. Your organisation designs, runs and owns the energy management system (EnMS). A consultancy such as Sterling helps you build it and get it ready, but has no say in whether you pass. The certification body audits the EnMS and takes the certification decision; it must be independent of anyone who helped you implement. An accreditation body, in turn, assesses the certification body, and its accreditation is what lets a customer, a tender panel or a regulator rely on your certificate.

Three documents set the rules. ISO 50001:2018, with its 2024 climate amendment, holds the requirements your system must meet. ISO/IEC 17021-1 governs how any management system certification is run: two audit stages, annual surveillance and a three-year cycle. ISO 50003:2021 adds the energy-specific rules for certification bodies, including how audit time is sized and how energy performance improvement is verified. That last document is why an ISO 50001 audit feels different from an ISO 9001 one.

Steps 1 to 5: the work on your side

Step 1: fix the scope and boundaries

Decide which sites, buildings, processes and activities the EnMS covers. Inside that boundary, every energy type counts: ISO 50001 does not let you leave out the diesel for the generators or the steam from the boiler house because the data are awkward. Note any regulatory reason for certifying, such as an obligation under the recast EU Energy Efficiency Directive or a chosen ESOS route in the UK, because it sets the date you are working back from. Name the people who will form the energy management team; in a small organisation one person can fill that role.

Step 2: gap analysis

Sterling's gap analysis is the first stage of the engagement. It looks at what you already hold: energy invoices, meter readings, maintenance routines, any previous energy audit, purchasing rules and how engineering projects are approved. The output is a list of what meets the standard, what exists but does not work and what is missing, with owners and dates. It is not the free online readiness check, and it is not the certification body's Stage 1 readiness review.

Step 3: build the technical core

This is the step that separates ISO 50001 from other management system standards. You analyse energy use and consumption from measured data, identify the significant energy uses (SEUs), set energy performance indicators (EnPIs), fix an energy baseline over a suitable period and, where production volume, weather or occupancy drives consumption, normalise both. A data collection plan then states what is measured, how often and how the records are kept. Operating criteria for each SEU, energy considerations in design and procurement, and action plans follow. The detail of each element is covered in separate guides on the energy review and SEUs, on EnPIs, baselines and normalisation and on the energy data collection plan.

Step 4: run the system and let the data accumulate

The EnMS has to operate long enough for the indicators to show a trend against the baseline. Where invoices and meter history already exist, the baseline comes from the past and the waiting time is spent implementing the actions that produce the improvement.

Step 5: internal audit and management review

Before any external auditor arrives, a full internal audit tests every requirement across the scope, and top management reviews energy performance, the indicators, the action plans and the audit results. Both need records, and any findings should be closed with evidence.

Step 6: select an accredited certification body

Choose the body before implementation ends, because its calendar can become the longest delay on the route. Confirm that it is accredited for ISO 50001 specifically, not only for ISO 9001 or ISO 14001, by an accreditation body recognised under the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA. Check the accreditation in the accreditation body's own directory rather than trusting a logo on a quotation.

The quotation should state the scope, the sites, the audit days for each stage and the surveillance days. Under ISO 50003 the audit time depends on the complexity of the EnMS: the energy types that make up most of your consumption, the number of SEUs and the number of people whose work affects energy performance, as well as locations. A quote that is far below the others usually means fewer days than the rules allow, or no real examination of the data. The guide to ISO 50001 certification cost explains how these factors move the price.

Step 7: Stage 1, the readiness review

Stage 1 is the certification body's check on whether you are ready for the full audit. Under ISO/IEC 17021-1 the auditor reviews your documented system, evaluates how prepared you are for Stage 2 and tests whether you understand the requirements. For an EnMS that means the auditor will expect to see the scope and boundary statement, the energy review with its method and SEU list, the EnPIs and baseline with the normalisation approach, the data collection plan, and evidence that the internal audit and management review have been planned and carried out.

The result is a report listing concerns that could become nonconformities at Stage 2. Treat each one as a task with a deadline. A weak baseline, an SEU list that ignores the largest consumer or a data plan nobody follows are the typical Stage 1 concerns, and each takes weeks, not days, to put right.

Step 8: Stage 2, the certification audit

Stage 2 evaluates whether the EnMS is implemented and effective. Auditors walk the site, interview the people who run the SEUs, sample records and trace the logic from the energy review through to the actions taken. The distinctive element is the examination of improvement: the auditor compares the EnPIs with their baselines to judge whether energy performance has improved. Under ISO 50003, a fall in total consumption only counts as evidence when conditions have not materially changed; where relevant variables such as output or weather are at work, the normalised indicators carry the argument.

ISO 50003 treats audit evidence that improvement was not achieved as a possible major nonconformity. That makes the months of operation before Stage 2 a technical requirement, not a formality.

Steps 9 and 10: findings, the decision and the certificate

At the closing meeting the auditor presents findings as major or minor nonconformities, or as opportunities for improvement, and agrees the time you have to respond. For a major nonconformity, the correction and corrective action must be completed and verified before a positive decision; for a minor one, the certification body usually accepts a credible plan. Analyse the cause properly: a missed deviation investigation is rarely fixed by a single late report.

The certification decision is taken by the certification body once the evidence is complete. If positive, the certificate is issued for three years and names your organisation, the scope, the sites and the standard. It certifies the management system, not a level of consumption or an energy rating.

Step 11: surveillance and recertification

A surveillance audit takes place at least once in each calendar year apart from the recertification year, the first no more than twelve months after the certification decision. At surveillance, ISO 50003 practice places the emphasis on how the improvement actions are being implemented. Before the certificate expires, a recertification audit reviews the whole system, and energy performance improvement must again be demonstrated against the baseline. Organisations that stop investing in actions after the first certificate often find the third year difficult, because improvement is not something that can be assembled in the month before the audit.

Tell the certification body about significant changes, such as a new site, a major process change or a change in scope, because they can require an extra audit. A baseline may also need revising after a major change to static factors; record the reason and the method.

How long the ISO 50001 certification process takes

Sterling's estimate is six to twelve months from start to certificate. The spread depends mostly on the state of your data and how quickly actions can be implemented, and far less on writing documents.

If a provider promises an ISO 50001 certificate within days, the energy review, the baseline and the improvement evidence have been skipped, and so has the audit that tests them.

ISO 50001 certification process: questions buyers ask