If you have ever searched for “Who issues an ISO certificate?”, you are not alone.
Many business owners, HR professionals, compliance officers, procurement teams, and quality managers believe that the International Organization for Standardization (ISO) itself issues ISO certificates. Others assume that the Government of India grants ISO certification.
The truth is different.
ISO develops international standards, but it does not certify companies. Instead, independent Certification Bodies (also known as Registrars) audit organizations and issue certificates if they comply with the applicable ISO standard.
In this guide, you will learn exactly how the ISO certification system works, who is responsible for what, and how a company obtains an ISO certificate.
What is ISO?
ISO (International Organization for Standardization) is an independent, non-governmental international organization headquartered in Geneva, Switzerland.
Its primary role is to develop internationally accepted standards that help organizations improve quality, safety, efficiency, information security, environmental performance, and many other areas.
Some of the most popular ISO standards include:
- ISO 9001 – Quality Management System (QMS)
- ISO 14001 – Environmental Management System (EMS)
- ISO/IEC 27001 – Information Security Management System (ISMS)
- ISO 45001 – Occupational Health & Safety Management System
- ISO 22000 – Food Safety Management System
Important: ISO develops standards but does not conduct audits or issue certificates.
If you want the full picture of ISO itself — its history, structure, and the standards it publishes — see our complete ISO guide.
Does ISO Issue ISO Certificates?
No.
This is probably the biggest misconception.
The International Organization for Standardization creates standards but never certifies organizations.
Instead, certification is carried out by independent organizations known as Certification Bodies (CBs) or Registrars.
Then Who Issues an ISO Certificate?
ISO certificates are issued by Certification Bodies (CBs) after successfully auditing an organization’s management system.
These organizations employ qualified auditors who verify whether a company complies with the selected ISO standard.
Examples of Certification Bodies include:
- Bureau Veritas
- TÃœV SÃœD
- SGS
- DNV
- Intertek
- BSI
- SQC Certification Services Pvt. Ltd.
- Assurance Quality Certification (AQC)
If the audit is successful, the Certification Body issues the ISO certificate.
What is a Certification Body (CB)?
A Certification Body is an independent organization authorized to assess whether a company’s management system complies with an ISO standard.
Its responsibilities include:
- Reviewing company documentation
- Conducting Stage 1 Audit
- Conducting Stage 2 Audit
- Identifying Non-Conformities (NCs)
- Verifying corrective actions
- Issuing ISO certificates
- Conducting surveillance audits
- Performing recertification audits
The Certification Body is sometimes called a Registrar.
Certification Body = Registrar
Both terms mean the same thing.
What is an Accreditation Body?
An Accreditation Body does not certify companies.
Instead, it evaluates and accredits Certification Bodies to ensure they are competent, impartial, and capable of conducting certification audits.
In simple words:
Accreditation Body → Accredits Certification Bodies
Certification Body → Certifies Companies
In India, the recognized accreditation body is the National Accreditation Board for Certification Bodies (NABCB), which operates under the Quality Council of India (QCI). NABCB evaluates Certification Bodies operating in India to ensure they meet international competence and impartiality requirements before those CBs are allowed to issue accredited certificates.
Globally, this same function was historically coordinated by the International Accreditation Forum (IAF), which linked national accreditation bodies together through mutual recognition agreements so that a certificate issued in one country would be trusted in another. As of January 1, 2026, IAF merged with the International Laboratory Accreditation Cooperation (ILAC) to form a single body, Global Accreditation Cooperation Incorporated (Global ACI), which now performs this global coordinating role. NABCB’s accreditations continue to be recognized within this framework.
Difference Between ISO, Accreditation Body, Certification Body and Company
| Organization | Primary Role |
| ISO | Develops international standards |
| Accreditation Body |
Accredits Certification Bodies
|
| Certification Body / Registrar | Audits organizations and issues certificates |
| Company | Implements the management system and undergoes certification |
How Does ISO Certification Work?
The certification process usually follows these steps.
Step 1: Select the ISO Standard
The organization first identifies the applicable standard.
For example:
- ISO 9001 – Quality Management
- ISO 27001 – Information Security
- ISO 14001 – Environment
Step 2: Implement the Management System
The organization develops and implements processes required by the chosen standard.
Examples include:
- Standard Operating Procedures (SOPs)
- Quality Policy
- Quality Objectives
- Risk Assessment
- Document Control
- Internal Audit Process
- Corrective Action Procedure
- Management Review Meetings
Step 3: Apply to a Certification Body
The company chooses a Certification Body.
The CB generally asks for:
- Company details
- Scope of certification
- Number of employees
- Number of locations
- Business activities
Step 4: Stage 1 Audit
The Certification Body reviews documentation to verify that the required management system has been established.
Typical documents reviewed include:
- Policies
- Procedures
- SOPs
- Organization Structure
- Risk Register
- Process Maps
Step 5: Stage 2 Audit
This is the implementation audit.
The auditor checks whether employees actually follow the documented procedures.
The audit may include:
- Employee interviews
- Process verification
- Record verification
- Site inspection
- Sampling of documents
- Evidence review
Step 6: Non-Conformities (NCs)
If deficiencies are identified, the auditor raises Non-Conformities.
These are generally classified as:
Minor NC
Examples:
- Missing signatures
- Incomplete records
- One procedure not followed
Usually corrected by submitting evidence.
Major NC
Examples:
- No internal audit
- No management review
- Required process not implemented
- Significant failure of the management system
Major NCs may require a follow-up audit before certification.
Step 7: Corrective Actions
The organization analyses the root cause, implements corrective actions, and submits evidence to the Certification Body.
The auditor reviews whether the corrective action effectively resolves the issue.
Step 8: Certificate Issued
Once all certification requirements are satisfied, the Certification Body issues the ISO certificate.
The certificate generally contains:
- Company Name
- ISO Standard
- Scope of Certification
- Certificate Number
- Issue Date
- Expiry Date
- Certification Body details
Is ISO Certification Valid Forever?
No.
ISO certificates are generally valid for three years.
However, the Certification Body normally conducts periodic surveillance audits during the certification cycle to verify that the management system continues to comply with the standard.
At the end of the certification cycle, a recertification audit is required to renew the certificate.
Is ISO Certification Mandatory in India?
Generally, No.
ISO certification is not legally mandatory for most businesses.
However, it may become necessary if:
- A client requires it.
- It is specified in a contract.
- It is required for vendor registration.
- It is an eligibility criterion in a tender.
Many organizations obtain ISO certification to improve credibility, customer confidence, and process consistency.
Common Myths About ISO Certification
Myth 1: ISO issues certificates.
Reality: Certification Bodies issue certificates.
Myth 2: The Government of India issues ISO certificates.
Reality: Independent Certification Bodies conduct audits and issue certificates.
Myth 3: Every ISO certificate has equal credibility.
Reality: The reputation and accreditation of the Certification Body are important considerations.
Myth 4: Certification is a one-time activity.
Reality: Organizations must maintain compliance through periodic surveillance and recertification audits.
Example: ISO 9001 Certification for an HR Staffing Company
Suppose an IT staffing company wants ISO 9001 certification.
The company develops documented processes for:
- Recruitment
- Candidate onboarding
- Payroll
- Compliance
- Client communication
- Complaint handling
- Vendor management
- Document control
- Internal audits
A Certification Body audits these processes.
If the organization complies with ISO 9001 requirements, the Certification Body issues the certificate.
Final Thoughts
Understanding the difference between ISO, Certification Bodies, and Accreditation Bodies helps organizations make informed decisions when pursuing certification.
Remember these four simple points:
- ISO develops international standards.
- Accreditation Bodies evaluate Certification Bodies.
- Certification Bodies audit organizations and issue certificates.
- Companies implement the standards and maintain compliance.
Once these roles are understood, the ISO certification process becomes much easier to understand and navigate.
Frequently Asked Questions (FAQs)
Who actually issues an ISO certificate?
A Certification Body (also known as a Registrar) issues the certificate after successfully auditing the organization.
Does ISO certify companies?
No. ISO develops standards but does not certify organizations.
What is the difference between ISO and a Certification Body?
ISO creates international standards. Certification Bodies audit organizations and issue certificates.
What is a Registrar?
Registrar is another term for a Certification Body.
What is an Accreditation Body?
An Accreditation Body evaluates and accredits Certification Bodies to ensure they operate competently and impartially.
Is ISO certification compulsory?
In most cases, no. However, clients, contracts, or tenders may require it.
How long is an ISO certificate valid?
Typically three years, subject to successful surveillance and recertification audits.
Find More Posts :