ISO writes international standards. It does not audit organizations, it does not issue certificates, and it does not approve or control the bodies that do. A company cannot be certified by ISO, and no certification body has been approved by ISO, whatever a marketing claim may suggest.

This is not a recent clarification. Addressing the conformity assessment community in Geneva in November 2001, ISO's then Secretary-General set out the same position, noting that ISO neither audits companies nor issues certificates nor controls the bodies that do so independently of it, and that no one at ISO had ever approved such a body. He was responding to complaints about certificates awarded to organizations that had not been properly audited, and about bodies writing a client's quality manual and then selling that client a certificate. Twenty-five years later the position is unchanged.

So who does what. ISO develops and publishes the standard, for example ISO 9001 for quality management. A certification body audits an organization against that standard and issues a certificate where the requirements are met. An accreditation body assesses the certification body itself against the international standard for its activity, which for management systems certification is ISO/IEC 17021-1. The accreditation body in turn works to ISO/IEC 17011.

Each link depends on the one before it, and each is performed by a different party. The organization is not assessed by the body that wrote the standard, and the certification body is not assessed by itself.

Two practical points follow for anyone evaluating a supplier's certificate. A claim of approval by ISO is not a claim that can be true. And the meaningful question is not whether the standard is genuine, which it almost always is, but whether the body that issued the certificate was independently assessed, and whether that assessment covered the activity on the certificate.

Source: ISO/CASCO 17th meeting, Geneva, November 2001.