What is a certification body?
A certification body assesses, as an independent third party, whether a management system meets the requirements of a standard and attests the result with a certificate. To issue an accredited certificate it needs an accreditation of its own. Article 2(10) of Regulation (EC) No 765/2008 defines accreditation. It is an attestation by a national accreditation body that the body meets the requirements "to carry out a specific conformity assessment activity".
The process from the company's side is covered in the guide to ISO 27001 certification. The term does not mean a certificate authority in a public key infrastructure, which issues digital certificates for signatures.
Three years, two audit stages, yearly surveillance
A certification body takes an ISMS through a certification cycle that as a rule covers three years:
- Initial audit in two stages. Stage 1 and Stage 2 together form the initial certification audit.
- Certification decision. The audit team records findings; the body decides in a separate process.
- Surveillance audits. They take place at least once per calendar year, except in the recertification year; the first no later than twelve months after the certification decision.
- Recertification. At the end of the cycle the body audits the ISMS again for the next cycle.
What a body records as a finding in an audit is explained in the entry on nonconformity.
What is the difference between a certification body and an accreditation body?
The accreditation body accredits and oversees the certification body. In Germany that responsibility follows a chain of three provisions:
- Article 4(1) of Regulation (EC) No 765/2008: each Member State appoints a single national accreditation body.
- § 1(1) AkkStelleG, the German Accreditation Body Act: accreditation is a sovereign task of the Federation, carried out by that national accreditation body.
- § 1(1) AkkStelleGBV, its implementing ordinance: Deutsche Akkreditierungsstelle GmbH (DAkkS) is entrusted with those tasks.
In the United Kingdom, UKAS holds the same role as the national accreditation body appointed by government. The requirements for certification bodies are set out in ISO/IEC 17021-1, supplemented for information security management systems by ISO/IEC 27006-1:2024.
| Role | Who | Responsible for |
|---|---|---|
| Accreditation body | DAkkS in Germany, UKAS in the United Kingdom | accrediting and overseeing certification bodies |
| Certification body | the accredited body | audit planning, certification decision, issuing and maintaining the certificate |
| Audit team | people acting for the body | the audit and its findings, not the decision |
| BSI | Germany's Federal Office for Information Security | its own scheme for ISO 27001 on the basis of IT-Grundschutz |
The last row follows from § 1(2) AkkStelleG: it leaves the responsibility of other authorities unaffected and names information technology security among those areas. ISO 27001 certification on the basis of BSI IT-Grundschutz therefore runs through a separate BSI scheme. Whether a body is accredited, and for which activity, is shown in the DAkkS search for accredited bodies.
How do you recognise a suitable certification body?
A suitable body is accredited for your standard, impartial and able to audit your scope. Check seven points:
- accreditation and its scope for your standard
- impartiality: under clause 5.2.5 of ISO/IEC 17021-1, the body does not offer management system consultancy
- sector experience of the actual audit team
- audit language and availability at your sites
- procedures for findings, appeals and follow-up audits
- how outsourced services and cloud components in your scope are handled
- a quotation for the whole cycle: initial audit, surveillance audits and recertification
A certificate confirms conformity only for its scope; how to check a supplier's scope is covered in reading a supplier certificate.
A change of certification body runs as a transfer
A change of certification body is possible mid-cycle. The International Accreditation Forum (IAF) set the rules in IAF MD 2:2023. The IAF ceased operations on 1 January 2026, and the Global Accreditation Cooperation Incorporated (Global ACI) has replaced it. The accepting body reviews, among other things, the most recent audit reports and the status of open nonconformities beforehand.
| Situation | Consequence under IAF MD 2:2023 |
|---|---|
| valid accredited certification | transferable (section 2.1) |
| certification known to be suspended | not accepted for transfer (section 2.1.2) |
| audit reports missing or audits overdue | treated as a new client (section 2.2.4) |
| open major nonconformities | certificate only after corrections are verified (section 2.3.1) |
| open minor nonconformities | certificate once the correction plan is accepted (section 2.3.1) |
Close major nonconformities before the change; otherwise the new certificate waits for the corrections to be verified.