Choosing an ISO 9001 certification body: accreditation, sector codes, and how to read a quote

What accreditation means for an ISO 9001 certificate

Accreditation is the independent check on the certification body. An accreditation body, itself working to ISO/IEC 17011, assesses the certification body against ISO/IEC 17021-1, covering its impartiality, its auditors' competence and how it audits and decides, and keeps assessing it while the accreditation lasts.

Accreditation bodies recognise one another through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA when Global Accreditation Cooperation Incorporated took over from IAF and ILAC on 1 January 2026. Certificates issued under a signatory's accreditation are meant to be accepted across borders, though a regulator, tender or customer can still set its own conditions.

Accreditation is also specific: a body accredited for ISO 14001, or for ISO 9001 in other sectors, is not thereby accredited for your scope.

How to check a certification body's accreditation

Use three sources, none of them the certification body's own website.

1. Get the details in writing. The quote should name the legal entity that will certify you, its accreditation body and its accreditation number. Accreditation belongs to a legal entity, and certification groups often trade through several companies under one brand, so check the one that will sign your contract.
2. Check the accreditation body. Confirm it is on Global ACI's list of recognised accreditation bodies for management system certification. An organisation missing from that list offers no internationally recognised accreditation.
3. Read the scope of accreditation. In the accreditation body's directory, confirm that the entry lists ISO 9001 and your sector and that the accreditation is current, not suspended or withdrawn.
4. Search IAF CertSearch. The global database of accredited management system certifications (it has kept the IAF name) is searchable by company or certificate. Look up the certification body and a few certificates it has issued in your sector; if one you expect is missing, ask the body why.

Checking a supplier's certificate is a separate task, covered in our guide on verifying an ISO 9001 certificate.

Sector codes and auditor competence

ISO 9001 accreditation is granted for defined sectors of economic activity, expressed as codes commonly called IAF codes, each covering a group of activities defined against the European NACE classification. Global ACI's informative document on QMS and EMS scopes of accreditation (TECH-3-021, issued July 2026) helps accreditation and certification bodies apply the scope rules of ISO/IEC 17021-1 and ISO/IEC 17011 consistently.

The code decides whether your certificate can carry accreditation at all, and who can audit you: ISO/IEC 17021-1 requires an audit team with the competence your activities call for. A body strong in construction may have neither the accredited scope nor the auditors for food manufacture.

Ask about language and risk as well: the need for interpreters, heavy regulation and high-risk activities are all grounds for more audit time under the international rules. Sector schemes such as IATF 16949 and AS9100 add their own rules on who may certify; see our guide to ISO 9001 and the sector standards.

What an ISO 9001 quote must state

ISO 9001 audit time is planned under IAF MD 5, "Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems", reissued by Global ACI in July 2026 as TECH-3-004. It converts the effective number of personnel in scope, adjusted for risk, complexity and sites, into auditor days, and the justification must reach you as part of the contract; a bare reference to the document does not count. A complete quote shows:

• Who certifies: the legal entity, its accreditation body and number, and the sector codes assigned to you.
• What was understood: the activities, sites and effective number of personnel used; if they differ between quotes, the quotes are not comparable.
• Audit time for every audit: auditor days for Stage 1, Stage 2, each surveillance audit and recertification, with the adjustments applied.
• Sites and sampling: which sites each audit visits. Sampling is allowed only for sites doing very similar work under one management system.
• The whole cycle: surveillance at least once each calendar year and recertification before expiry, each priced rather than left "on request".
• Travel and other charges: the travel basis, and any application, certificate, annual, follow-up, cancellation or rescheduling fees.
• Delivery: any remote elements, and the language of the audit and the report.

How each line moves the price is explained in our guide to ISO 9001 certification cost.

Three ISO 9001 quotes compared

These illustrative quotes combine patterns organisations commonly receive, all for one company with two similar sites and one scope. Put every quote into the same rows before comparing totals.

Quote A is the one to negotiate from, because every line can be checked. Quote B may still win once the body shows its calculation and a sector code inside its accreditation; Quote C is cheapest because it leaves out the audit, the accreditation and the cycle.

Questions to ask, and the warning signs

Before you sign

• Which legal entity will certify us, and which sector codes will you assign?
• How did you reach these audit days?
• Who will lead the audit, and what is their experience in our sector?
• What is charged if a major nonconformity needs a follow-up visit?
• How will our scope be worded on the certificate?

Warning signs

• A certificate promised before the audit. No certification body can promise the result of an audit it has not performed; the decision is taken after the audit, by people who were not on the team.
• No Stage 1, or one short visit for everything. Initial certification under ISO/IEC 17021-1 always has two stages.
• Audit time far below the rest, with no calculation. The audit-time rules cap reductions at 30% of the figure in their tables, so an unexplained gap usually means a shorter audit.
• Accreditation you cannot find on Global ACI's list, in the accreditation body's directory or in IAF CertSearch.
• Consultancy and certification from one source. A certification body may not provide management system consultancy, so an offer to write your procedures and then certify them is a conflict.
• No surveillance. Accredited certificates are maintained by audits in every year of the three-year cycle.

Where Sterling stands

Sterling does not certify. The certification body you select audits your system and decides on certification, and the choice of body is yours; our part is to make it an informed one and to prepare you for the audit.

Choosing an ISO 9001 certification body: questions buyers ask