Standard status
- Current published edition
- ISO/IEC 17021-1:2015
- Scheme type
- Management systems certification bodies
ISO/IEC 17021-1 is the international standard for bodies that audit and certify management systems. A body accredited against it is a management systems certification body, often shortened to certification body or CB. The standard sets out what such a body must do, and how it must be structured, resourced and governed, so that its certification decisions are competent, impartial and consistent. It is the standard behind an accredited ISO 9001, ISO 14001, ISO 45001 or ISO/IEC 27001 certificate: the organization is certified to one of those management system standards, and the body that certified it is accredited against ISO/IEC 17021-1. ASCB offers accreditation to ISO/IEC 17021-1.
Certification, accreditation, and where ISO/IEC 17021-1 fits
These terms are often used as if they were the same thing, and the difference is the whole point of the standard. Certification is what a certification body does to an organization: it audits the organization's management system against a standard such as ISO 9001 and decides whether to certify it. Accreditation is what an accreditation body does to the certification body: it assesses the certification body against ISO/IEC 17021-1. An organization is certified; a certification body is accredited. ISO/IEC 17021-1 is the standard the certification body is accredited against, and ISO/IEC 17011 is the standard the accreditation body itself works to.
What ISO/IEC 17021-1 requires
The requirements fall into a set of themes, built on the principles the standard opens with.Principles
Clause 4 sets the principles that the rest of the standard rests on: impartiality, competence, responsibility, openness, confidentiality, responsiveness to complaints, and a risk-based approach. These are the basis for inspiring confidence in certification, and every later requirement traces back to one of them.
Impartiality and its management
Clause 4.2 and Clause 5.2 treat impartiality as structural, not a matter of good intentions. The standard recognizes that a certification body's income comes from the clients it certifies and names that as a threat to be managed. It requires the body to identify, analyze and treat impartiality risk on an ongoing basis, prohibits certifying a management system on which it or a related body has provided consultancy within a defined period, and prohibits marketing certification as linked to consultancy.
Legal, financial and structural requirements
Clauses 5 and 6 require the body to be a legal entity able to take responsibility for its certification decisions, to have the financial stability and arrangements to cover its liabilities, and to be organized so that certification decisions have clear ownership and are kept separate from commercial pressure.
Resources and competence
Clause 7 requires the body to determine the competence its functions need, including auditors, technical experts, those who review audit reports, and those who make certification decisions, and to evaluate and authorize personnel against those criteria. Annex A sets out the knowledge and skills each function must have. Use of external auditors and outsourced work is controlled.
Information and the use of marks
Clause 8 covers the information the body must make public, what its certification documents must contain, the directory of certified clients, and the rules on how certification and accreditation marks may be used.
The certification process
Clause 9 sets out the process end to end: application and review, the audit program, the two-stage initial audit, the certification decision made by someone who did not carry out the audit, surveillance, recertification on a three-year cycle, special audits, and the suspension or withdrawal of certification, together with appeals and complaints.
Management system
Clause 10 requires the certification body to run its own management system supporting consistent operation, with document and record control, internal audit, management review, and corrective action.
The ISO 19011:2026 dependency
ISO/IEC 17021-1 does not stand entirely alone. Audits of management systems draw on ISO 19011, the guidance standard for auditing management systems, which was revised in 2026. A certification body's audit methodology, auditor competence criteria and audit planning reflect that guidance, so the move to ISO 19011:2026 is the active transition most certification bodies need to plan for, even though ISO/IEC 17021-1 itself is unchanged. The current status of ISO 19011 and the transition detail are covered in Watch and Bulletins.
Scheme and sector application
ISO/IEC 17021-1 is the base standard for certification of any management system. The most widely held schemes are ISO 9001 for quality, ISO 14001 for environment, ISO 45001 for occupational health and safety, and ISO/IEC 27001 for information security, with many others in use. Some schemes carry sector-specific requirements that apply on top of ISO/IEC 17021-1, for example ISO/IEC 27006 for information security management systems and ISO/IEC TS 42006 for artificial intelligence management systems. A certification body is accredited against ISO/IEC 17021-1 together with the sector-specific requirements that apply to its scope.
Why seek ASCB accreditation against ISO/IEC 17021-1
ASCB assesses a certification body against the requirements of ISO/IEC 17021-1 on a periodic, risk-based basis, sampling records, personnel authorizations, and live audit and decision activity. For a certification body and the users of its certificates, that means: independent third-party assessment against the international standard for management systems certification, applied on its own terms; a clear signal to the organizations it certifies, and to their buyers and regulators, that its certification decisions rest on the same international requirements as the wider field; public verifiability, since ASCB-accredited bodies and the scope of their accreditation can be confirmed on the ASCB register, and the certificates they issue can be verified on the IRQAO register; and delivery by an established international accreditation body operating to ISO/IEC 17011 for more than 30 years; organizations certified by ASCB-accredited bodies operate in 140+ countries.
Where ISO/IEC 17021-1 sits among the standards
ISO/IEC 17021-1 is one of a family of conformity assessment standards. The most closely related are:
• ISO/IEC 17000: the conformity assessment vocabulary and principles; it defines the shared terms this standard uses.
• ISO/IEC 17011: requirements for accreditation bodies; the standard ASCB itself works to when it accredits a certification body.
• ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001: the management system standards organizations are certified against; ISO/IEC 17021-1 governs the body that certifies them.
• ISO 19011: guidance for auditing management systems; it informs how a certification body plans and conducts its audits.
• ISO/IEC 17065: product, process and service certification; a related standard for a different activity, certifying products rather than management systems.
• ISO/IEC 17024: certification of persons; a related standard for a different activity, certifying individual competence.
How to apply
How to apply for ISO/IEC 17021-1 accreditation, including the process, the fees and the application documents, is set out on Become Accredited.