"Subcontracting" and "outsourcing" are treated as synonyms in ISO/IEC 17021-1:2015, ISO/IEC 17024:2026, ISO/IEC 17065:2012, ISO/IEC 17020:2026 and ISO/IEC 17029:2019, each of which sets its own rules for when a certification, inspection or validation/verification body may use another organization's personnel to carry out part of its audit, inspection or evaluation work. ISO/IEC 17025:2017 covers the same ground under "externally provided products and services" rather than the subcontracting/outsourcing term, since a laboratory's use of an outside party can cover more than personnel. Across all six, one principle holds without exception: the accredited body remains fully responsible for subcontracted work, whatever agreement sits behind it.
Rules for using subcontracted auditors
Certain activities cannot be subcontracted at all.
• ISO/IEC 17021-1:2015, Clause 7.5.2 prohibits outsourcing the certification decision itself;
• ISO/IEC 17029:2019, Clause 7.4(b) prohibits outsourcing both the engagement activities and the decision to confirm a claim.
• ISO/IEC 17020:2026 goes further for inspection work specifically: Clause 6.3.3 restricts the use of externally provided inspection activities to exceptional circumstances, such as an unforeseen overload or key personnel being temporarily unavailable, rather than permitting it as routine practice.
• Where subcontracting is used, ISO/IEC 17029:2019, Clause 7.4(e) and ISO/IEC 17025:2017, Clause 7.1.1(c) both require the client's or customer's approval before the work goes ahead;
• ISO/IEC 17021-1:2015, Clause 7.5.3(c) requires that subcontracted personnel are not connected to the client organization in a way that could compromise impartiality.
Oversight and competence verification requirements
Every scheme requires a documented process for approving and monitoring who it subcontracts to. ISO/IEC 17024:2026, Clause 6.3.2 sets out the clearest checklist: take full responsibility for outsourced services, confirm the subcontracted body's competence and conformance, assess and monitor its performance, keep records demonstrating it meets all relevant requirements, and maintain a list of the bodies used. ISO/IEC 17021-1:2015, Clause 7.5.4 and ISO/IEC 17025:2017, Clause 6.6.2 add the same expectation in their own terms: a documented approval and monitoring process, with records of competence maintained for everyone involved, subcontracted or not.
A legally enforceable agreement covering confidentiality and conflicts of interest, required across all five outsourcing-framed standards, is what this oversight sits on top of.
This page sets out the rules; Subcontracting in certification covers the fuller good practice discussion of when subcontracting makes sense and how oversight works day to day.
Common questions
Can a conformity assessment body subcontract audit work?
Parts of it, under each standard's rules, but the accredited body remains fully responsible for the subcontracted work whatever agreement sits behind it.
What cannot be subcontracted?
The certification decision itself; and for inspection, externally provided inspection activity is restricted to exceptional circumstances rather than routine use.
Are subcontracted auditors held to the same competence rules?
Yes; the same competence verification and oversight that apply to the body's own personnel.