ISO Certifications: Your Top FAQs, Simplified

Danny Manimbo, principal and ISO practice leader at Schellman, answers the most frequently asked questions about ISO Certifications, including insights about the process, how to select a certification body, and the costs involved.

What does the certification process look like?

The ISO certification process is fairly unique, and successful completion results in a certification valid for a 3-year cycle, with annual certification reviews:

Year 1

Year 1 is referred to as your initial certification review and consists of a Stage 1 and Stage 2 review:

• The Stage 1 review is brief in nature, typically covered within a 2-day span with the primary objective of determining whether a management system has been designed to meet the requirements of the applicable standard, and whether the organization is ready to proceed to the Stage 2 review. This involves primarily a documentation review to ensure that the management system meets the requirements of the applicable standard. If a management system has a control set, such as ISO 27001, ISO 27701, or ISO 42001, the implementation of those controls would be reviewed in the Stage 2 review. The results of a Stage 1 are captured in a formal report; however, no nonconformities are issued during a Stage 1, rather only areas of concern which could materialize into formal nonconformities if not addressed prior to the start of the Stage 2 review.
• The Stage 2 review is the lengthier of the two stages and typically spans 1-3 weeks. While the Stage 1 review consisted of a design effectiveness review, the Stage 2 review covers operational effectiveness of the management system as well as the review of the resolution of any areas of concern identified during the Stage 1 review and the implementation of any applicable control sets – such as those from Annex A of ISO 27001. This operational effectiveness review has a primary focus on clauses 8-10 of the standard to determine that areas such as risk assessment and risk treatment, monitoring and measurement, internal audit, management review, nonconformity and corrective action, and continual improvement are operating effectively and in accordance with the requirements of the standard.
  If there are nonconformities identified during the Stage 2 review, these nonconformities are included in a formal report issued at the conclusion of the Stage 2 review and must be addressed by both a corrective action plan and correction of the issue prior to the certificate being issued to ensure that at the time of certificate issuance, the organization meets all of the requirements of the standard. 

Years 2 and 3

Once certified, in Years 2 and 3, we are required to perform what’s referred to as annual surveillance reviews. More brief in nature than the initial certification review, these surveillance reviews are typically performed within 1-2 weeks and primarily focus on the continued effective operational performance of the management system (focus on clauses 8-10) as well as the assessment of any material changes to scope and the resolution of any previously identified findings. At the conclusion of a surveillance review, the audit team will issue a final report with the audit results and reissue the certificate should updates be required to the certified scope. 

Year 4

In Year 4, a recertification review is performed, which, similar to a Stage 2, is a full system audit (covering clauses 4-10 and any applicable controls – should those be present within the management system standard). Unlike the initial certification review, this is a single stage audit as the Stage 1 and Stage 2 reviews are performed in Year 1 only. Successful completion of a recertification review results in the reissuance of the certification for another 3-year cycle. 

What is Schellman’s approach to readiness (gap) assessments? 

Schellman has the ability to perform readiness or gap assessments ahead of an initial certification review, which many of our clients have found very helpful in ensuring their preparedness, success, and alignment of audit and documentation expectations entering the Stage 1 review. As an independent certification body, Schellman is limited to providing feedback on whether or not our clients met the requirements of the standard, and cannot perform any consulting type activities such as helping our clients to draft policies, perform risk assessments or internal audits, implement processes and controls, etc. 

What are the factors for selecting a certification body?  Does accreditation matter? 

Prior to selecting a certification body, organizations should consider what their overall audit and compliance goals are both for the near future and long term. The majority of our clients at Schellman perform more than 1 service with us, which means our clients typically have compliance needs beyond just ISO – whether that be penetration testing, SOC reporting, PCI, federal assessments, or industry specific assessments such as healthcare with HIPAA and HITRUST or even other ISO management system standards.   

Our main value to our clients at Schellman who perform more than one service with us is what we refer to as the Power of One. You’ll have one firm, one team, one mission, and one vision – working towards an integrated overall audit approach for situations where we perform more than one assessment concurrently – creating multiple efficiencies during the audit process. That said, choosing a certification body that can support your organization’s growth and maturity is an important consideration. 

Lastly, accreditation is another important factor when choosing a certification body. Schellman maintains a dual accreditation with ANAB here in the US and UKAS in the United Kingdom, which demonstrates a commitment to the quality and integrity of our audit processes in that we’re annually assessed by each accreditation body for each standard we’re accredited for in order to determine conformance to audit requirements, including the competency of our team members and how we maintain our management system to support our practice. This ensures that we’re doing our audits the right way – adhering to professional best practices and requirements to provide the highest level of service and value to our clients. 

How can multiple management system standards be integrated? 

ISO standards that are management system standards, such as ISO 27001, ISO 9001, or ISO 42001 or any other standards we’re accredited to certify against, are all structured in the same way. By this we mean they are all structured around the common management system framework in clauses 4-10, while some also have specific control sets, but it is the clause 4-10 framework that is best integrated across management system standards. This means that clients certified to one ISO management system standard can integrate other management system standards into their existing management system. 

For example, a client who is certified to ISO 27001 for an information security management system (ISMS) can integrate another management system standard like ISO 42001 for an artificial intelligence management system (AIMS) by enhancing their existing ISMS documentation and creating what’s referred to as an integrated management system (or IMS), to cover the requirements of both documents, as opposed to starting from scratch for each new management system standard pursued. 

How much does an ISO certification cost? 

There are a variety of factors that can impact the pricing of an ISO certification review, which can include: 

• The standard(s) being certified against 
• Size and complexity of scope (e.g., number of products and services, personnel, locations in-scope, your role for role-specific standards like ISO 27701 and ISO 42001, scope and boundaries of the management system, inclusion of an extension standards such as those in ISO 27017 and ISO 27018, etc.) 
• Dependence on any third parties  
• Schellman’s knowledge and familiarity with the organization and scope via the performance of other audit and compliance activities  

It’s also worth noting that the timing of the audit can impact pricing as its often most advantageous to perform an ISO certification review in an integrated manner with other audit and compliance activities Schellman performs such as SOC 2, PCI, FedRAMP, or other related ISO standards in the case of integrated management systems to reduce the overall audit footprint and promote alignment and efficiency of all audits being performed via integrated planning and audit execution activities. 

That said, in general, ISO certification reviews can range in the low $30 to mid $40 thousands in year 1 with the price often dropping in surveillance review years to high teens to $20 thousands in years 2 and 3. This pricing will be refined after meeting with our SMEs once we have a better overall understanding of the scope of the review. 

Contact us today to learn more about the ISO Certification process, requirements, timeline, or any other details.