Technical reviewer requirements

Technical review is the check, by someone who did not produce the work, that an audit or evaluation team's findings are sufficient and complete before the body relies on them. The separation exists for the same reason the certification decision itself must sit apart from the audit team: a person who identified and judged the evidence should not also be the last check on whether that evidence supports acting on it. 

Each of the six standards ASCB accredits against places this check somewhere, but they place it differently. ISO/IEC 17065 and ISO/IEC 17029 name an explicit review step and require the reviewer to be independent of the work. ISO/IEC 17021-1 requires an effective review before every certification decision. ISO/IEC 17024 builds the check into the decision itself. ISO/IEC 17020 and ISO/IEC 17025 have no certification decision, so the check moves to approval and authorization of the reports and results they issue.

Management systems certification: ISO/IEC 17021-1

ISO/IEC 17021-1:2015, Clause 9.5.2 requires the certification body to run an effective review before any decision to grant, expand, reduce, renew, suspend, restore or withdraw certification. The review confirms that what the audit team has provided is sufficient for the certification requirements and the intended scope, and that for any major nonconformity the correction and corrective actions have been reviewed, accepted and verified. Clause 9.5.1.1 requires the decision itself to be made by persons or committees that had no part in carrying out the audit. The standard does not require the reviewer and the decision-maker to be different people: one person can review the report and decide, provided they took no part in the audit and hold the Annex A.3 competences set out below.

Product, process and service certification: ISO/IEC 17065

ISO/IEC 17065:2012 makes the review step explicit and separate. Clause 7.5.1 requires at least one assigned person to review everything the evaluation produced, and that person must not have been involved in the evaluation itself. Clause 7.5.2 requires the review's recommendation for a certification decision to be documented, unless one person completes the review and the decision together. Clause 7.6.2 then places the decision with a person or group that was not involved in the evaluation; a note confirms that one person or group may do both at once.

Validation and verification: ISO/IEC 17029

ISO/IEC 17029:2019 treats review as a named stage of every engagement. Clause 9.6 requires review by persons who took no part in the validation or verification execution, confirming three things: that everything agreed and programmed was carried out, that the evidence is sufficient and appropriate to support the decision, and that significant findings were identified, resolved and documented. The reviewer raises clarifications with the team, and the team must address the reviewer's concerns (Clause 9.6.4). Clause 5.3.7 fixes the separation structurally, requiring that neither the review nor the decision is made by anyone who performed the execution, and under Clause 9.7.1.1 the decision on whether to confirm the claim is made only once the review is complete.

Certification of persons: ISO/IEC 17024

ISO/IEC 17024:2026 has no separately named review step; the control sits in the decision. Clause 9.4.4 requires the certification decision to rest entirely on what the certification process gathered, made by personnel who had no part in examining or training the candidate. Clause 9.4.5 requires those personnel to be competent to determine whether the certification requirements have been met. Clauses 4.2 and 9.4.2 make the decision non-delegable: the certification body retains sole authority for it and cannot outsource it.

Inspection and laboratories: ISO/IEC 17020 and ISO/IEC 17025

Neither standard has a certification decision, so neither has a pre-decision technical review; the check moves to the output. ISO/IEC 17020:2026, Clause 7.6.2 requires every inspection report or inspection certificate to carry an indication of approval, such as a signature, from authorized personnel, with the inspectors who exercise the body's judgment selected, supervised and monitored under Clause 6.1. ISO/IEC 17025:2017, Clause 7.8.1.1 requires results to be reviewed and authorized before they are released, and Clause 6.2.6 requires the laboratory to authorize the specific people who analyze results, including statements of conformity, and who report, review and authorize them. Clause 7.8.7.1 adds that opinions and interpretations are released only by personnel authorized to express them. In these two standards the reviewer is not required to be independent of the work in the way ISO/IEC 17065 and ISO/IEC 17029 require; what is required is that the body defines who may review and authorize its outputs, and that those people are demonstrably competent.

Competence requirements

ISO/IEC 17021-1:2015, Annex A.3 is the fullest statement of what review and decision personnel must know: audit principles, practices and techniques, enough to understand a certification audit report; the specific management system standard, enough to decide on the basis of that report; the certification body's own processes, enough to determine whether its expectations have been fulfilled; and the client's business sector, enough to read the report in context. The other standards state the same idea more generally: ISO/IEC 17024:2026, Clause 9.4.5 requires decision personnel competent to judge whether the certification requirements are met, and ISO/IEC 17025:2017, Clause 6.2.5 requires the laboratory to determine competence requirements and retain records of authorization for each role. Whatever the scheme, the technical reviewer function is one of the specific roles the body's competence matrix should track, distinct from the auditors, inspectors or evaluators who produced the work under review: see Auditor competence requirements.

Common questions

What is technical review?

Which standards require it as a separate independent step?

What about bodies with no certification decision?

Can the reviewer also make the decision?