A buyer asks for “ISO certification” without naming the standard. Does your business need a quality certificate, a food safety system or an information security audit? The right answer depends on what you do, the scope to be certified and the buyer’s exact requirement. This guide explains the common standards and the checks to make before paying a certification body.
What is ISO certification?
The International Organization for Standardization (ISO) develops international standards. For a certifiable management system standard, an independent certification body assesses whether an organization’s defined management system meets its requirements. If the audit is successful, the body may issue a certificate naming the standard, edition, sites and scope. ISO says explicitly that it neither audits organizations for certification nor issues certificates . A claim that a company is “certified by ISO” is therefore inaccurate.
A management system certificate concerns the processes within its stated scope. ISO 9001 certification, for example, is not a guarantee that every individual product is flawless or approved by a regulator. Read the exact certificate before promising a customer anything broader. ISO standards can also be implemented without obtaining third-party certification, although a tender or buyer may require an independently verified certificate.
Certification body and accreditation body: who checks whom?
The certification body audits the organization. An accreditation body independently assesses the certification body’s competence for particular standards and scopes. India’s National Accreditation Board for Certification Bodies (NABCB) , part of the Quality Council of India, publishes listings for management system certification bodies. Accreditation is not legally compulsory for every certificate, as ISO’s certification guidance notes. A buyer may nevertheless require a certificate under a specified accreditation scheme. Check that condition in the tender before choosing a body.
Ask the body for its legal name, accreditation body, current accreditation scope, audit plan, certificate wording and surveillance fees. Verify the standard, sector, location and status against the accreditation body’s directory. ISO also points to IAF CertSearch for accredited certificate verification, or you can contact the certification and accreditation bodies directly. The absence of a record in a database should prompt a direct verification request; do not rely on a logo alone.
Which ISO standard fits your business?
These are management system standards that address different risks. More certificates are not automatically better; start with the requirement that matters to your customer and operations.
| Standard and current edition | What it addresses | Example use |
|---|---|---|
Quality management systems (QMS) | Manufacturing, trading and service delivery where consistent processes and customer requirements matter | |
Environmental management systems (EMS) | Organizations managing environmental aspects, resource use and impacts | |
Occupational health and safety management | Construction sites, factories, logistics and other workplaces with worker safety risks | |
Food safety management systems | Food production, processing and other organizations in the food chain | |
Information security management systems | Companies handling client data, digital services and sensitive information |
Publication years identify the edition of a standard, not a certificate expiry date. Check the latest ISO catalogue and any later amendments when setting an audit scope. ISO 22000:2018, ISO 45001:2018 and ISO/IEC 27001:2022 remain the relevant editions shown above as at 5 November 2026; ISO also lists amendments or work on subsequent revisions. ISO’s catalogue already lists ISO 14001:2026 as the fourth edition.
ISO 9001:2015 versus ISO 9001:2026
ISO 9001:2026 was published on 16 September 2026 and is now the current edition, replacing ISO 9001:2015. ISO describes clearer wording and stronger emphasis on leadership, quality culture, and treating risks and opportunities distinctly. The underlying focus on customers, processes and continual improvement remains. See ISO’s explanation of the revision .
Existing ISO 9001:2015 certificates do not instantly become worthless. ISO’s technical committee transition guidance says organizations already certified to the 2015 edition have until 30 September 2029 to transition. It also states that from 31 March 2028, new and initial accredited certifications may be issued only to ISO 9001:2026. If a provider offers an initial 2015 audit in late 2026, ask the certification body which edition will appear on the certificate, whether the tender accepts it and what a later transition audit will cost. TaxQue’s existing ISO 9001:2015 support should be described with that transition context rather than advertised as the latest edition.
A practical choice for five kinds of business
- A general trader or service company: consider ISO 9001 when customers ask for a quality management system; define the actual activities and locations to be certified.
- A construction or manufacturing operation: ISO 9001 may address quality, ISO 45001 worker safety, and ISO 14001 environmental management. Choose each for a real need, not as a bundle of badges.
- A food processor or caterer: ISO 22000 concerns the food safety management system. It does not replace your applicable FSSAI licence or registration, premises conditions or product obligations.
- A software or data services firm: ISO/IEC 27001 focuses on information security controls and risk management. It does not by itself prove compliance with every data protection obligation.
- A bidder for a tender: read the precise edition, accredited status, industry scope, site coverage and certificate validity required in the tender. A certificate for another business activity may fail the eligibility test.
Some buyers seek an integrated system under several standards; that can be sensible when the operations and audits truly overlap. Start with the actual requirements and a realistic maintenance plan. The most useful outcome is a working process that improves decisions, not a printed certificate that nobody in the business uses.
How certification usually works
- Define the scope: name the sites, products or services and responsible team. Obtain the relevant standard and the customer’s exact certificate requirement.
- Compare current practice with the requirements: identify gaps in records, controls, training, responsibilities and monitoring.
- Put the management system to work: implement the needed processes, keep evidence and train staff who operate them.
- Review it internally: perform an internal audit, address findings and hold a management review before external assessment.
- Use an independent certification body: it conducts the applicable initial assessment, typically stage 1 and stage 2. Resolve any nonconformities before the certification decision.
- Maintain the certification: follow surveillance audits and recertification requirements. For example, ISO notes annual surveillance and a three-year recertification cycle are usual for ISO 14001.
Ask for a written quote that separates implementation support from independent certification audit, and lists travel, site count, surveillance, recertification and edition-transition costs. An adviser may help you prepare, but the certificate decision belongs to the certification body. Read our guide to ISO certification cost drivers for the fee questions to ask.
What ISO certification does not replace
Most ISO management system certification is voluntary unless a particular contract or scheme requires it. It is distinct from licences and statutory approvals. A food business still needs its applicable FSSAI approval; a factory still needs its relevant safety and environmental permissions. India’s BIS compulsory product certification is a different regime: certain products must carry a Standard Mark under a BIS licence or certificate when a Quality Control Order applies. Do not market a management system certificate as BIS approval or government licensing.
Before signing a certification contract
Check the certificate sample, the exact edition, audit scope, accredited status, surveillance schedule and cancellation conditions. Confirm that your buyer accepts the proposed accreditation and that the body is accredited for your sector. If you are already certified to ISO 9001:2015, get a documented transition plan to the 2026 edition rather than purchasing a second unrelated certificate.
TaxQue can help you assess the business scope, prepare documentation and compare an accredited audit route for your ISO 9001 work. Contact TaxQue or email info@taxque.in to discuss the requirements before you commit to a certification body.
Official references
- ISO: certification and certificate verification
- ISO 9001:2026 standard page
- ISO technical committee: ISO 9001 transition dates
- ISO 14001:2026 standard page
- NABCB: accredited management system certification bodies
- BIS: products under compulsory certification
This article is general information as at 5 November 2026. Check the current standard edition, certification-body scope and any contract or statutory requirements for your business.
