ISO/IEC 17021-1:2015: what certification bodies must meet, audit time and accreditation

ISO/IEC 17021-1:2015 is the standard a management system certification body must meet to be accredited, setting requirements for its competence, consistency and impartiality when it audits and certifies other organisations. The 2015 edition is still the one in force, and ISO's systematic review of it closed on 5 March 2026 with no new edition announced.

This guide is for people setting up or running a certification body, and for quality managers who want to know what sits behind an accredited certificate.

What is ISO/IEC 17021-1 for?

ISO/IEC 17021-1 applies to the certification body, not to the organisations it certifies. A company certified to ISO 9001 or ISO 14001 never needs it. The body that audited that company does, if it wants its certificates to be accredited.

ISO describes the standard as containing principles and requirements for the competence, consistency and impartiality of bodies that audit and certify any type of management system. A certification body does not have to offer every type. Certification of management systems is third-party conformity assessment, so the body must be independent of the client.

The current text is Edition 1, published in June 2015 by ISO/CASCO. It runs to 48 pages and replaced ISO/IEC 17021:2011. It was confirmed in 2020, and the latest review cycle ran from October 2025 to March 2026, according to ISO's page for the standard. Check that page before you plan for a revision.

What must a certification body have in place?

The standard covers the whole certification business, from legal status to the final decision on a certificate. In AGS's reading, an accreditation body will look for evidence in six areas.

• Legal and structural: a legal entity, liability arrangements, financial stability and an organisation chart that shows who decides on certification.
• Impartiality: a documented analysis of threats to impartiality and a mechanism to safeguard it, which many bodies run as an impartiality committee.
• Competence: criteria for auditors, technical experts and decision makers, with evaluation, authorisation and monitoring records.
• Information: public information about the process, certification documents, a directory of certified clients, and rules for marks.
• Process: application review, audit time, audit planning, Stage 1 and Stage 2 audits, reporting, the certification decision, surveillance, recertification, suspension and withdrawal, complaints and appeals.
• Management system: document control, records, internal audit, management review and corrective action for the body itself.

One rule surprises new bodies. Clause 5.2.5 bars a certification body, and any part of its legal entity, from offering or providing management system consulting. European Accreditation confirmed in a 2019 FAQ that this applies even to standards the body is not accredited for.

How is audit time calculated under IAF MD 5?

For quality, environmental and occupational health and safety audits, audit time follows IAF MD 5:2023, Issue 4, Version 3, issued on 14 June 2023. It is a mandatory document for applying ISO/IEC 17021-1 to those three standards, and its full text is public.

The starting point is the client's effective number of personnel, read against tables in Annexes A, B and C for each standard. The body then adjusts for complexity, risk, sites and shifts. Key rules from the document:

• The initial audit is Stage 1 plus Stage 2, and the time for both is set during application review.
• Reductions must not exceed 30% of the times in the tables, and each reduction is justified in writing.
• An audit should typically not run below 80% of the calculated audit time.
• Surveillance in the three-year cycle totals about one third of the initial audit time each year.
• Recertification is normally about two thirds of the time an initial audit would need at that point.

Assessors check that the calculation is recorded and applied the same way for every client. A worksheet per client, kept with the application review, is the usual evidence.

Which extra documents apply to each certification scheme?

ISO/IEC 17021-1 is the base. Most schemes add their own requirements for auditor competence or audit time. The table lists the documents the Emirates International Accreditation Centre (EIAC) names alongside ISO/IEC 17021-1:2015 on its certification bodies page, and whether the Saudi Accreditation Center (SAAC) lists the same subfield.

EIAC also accredits HACCP certification against food code requirements based on Codex, and certification to ADHICS and to UAE.S 5037:2021. A body certifying ISO 9001 also has to manage the move to the new edition, covered in our ISO 9001:2026 transition guide.

What does a multi-scheme certification body need for each scheme?

Every scheme a body offers needs its own scheme document. In AGS's reading, each one should state the certification standard and the extra certification body requirements from the table. It should also set out how scopes are classified, the certification cycle, the basis for audit time, and the competence criteria for auditors and decision makers.

A body with ten schemes needs ten of these, plus audit checklists, report formats and certificate templates for each. This layer is often what delays a launch, because it cannot be copied from the base standard. It also has to match the scope you apply for, since accreditation is granted scheme by scheme.

How does a certification body get accredited?

Accreditation bodies assess certification bodies against ISO/IEC 17021-1 and the scheme documents. Since 1 January 2026 the international arrangement runs through Global ACI (formerly ILAC and IAF), whose signatories recognise each other's accreditation as equivalent. IAF ceased operations on that date. Existing recognitions continue.

EIAC's process shows what to prepare. An application needs a valid licence covering the activity, the management system manual and procedures with records of implementation, and a location map. It also needs the last management review and internal audit reports, a list of key staff, and the regulations that apply where you operate.

EIAC then runs a document review, an optional pre-assessment and an on-site assessment that includes witnessing. After accreditation it makes periodic visits and a full reassessment every three years.

Plan to have real audit files before the assessment, because witnessing means an assessor watches your auditors at a client. SAAC gives up to 85 working days to complete its accreditation process. Inspection bodies follow a different standard, explained in our ISO/IEC 17020:2026 guide.

How AGS can help

AGS has two kits written for ISO/IEC 17021-1 certification bodies:

• ISO 17021-Management System: 124 editable Word documents, including a management system manual, impartiality and certification committee annexes, 10 procedures, and scheme documents, audit checklists and certificate templates for 19 schemes.
• Integrated Certification Body Management System (ISO/IEC 17021-1, 14 Schemes): 108 files, mostly Word, with an Excel fee calculator and 7 browser-based tools. Includes 20 procedures, an audit time calculation worksheet, and scheme documents, checklists and certificate templates for 14 schemes.

Frequently asked questions

Can a company be certified to ISO/IEC 17021-1?

No. Companies are certified to standards such as ISO 9001. ISO/IEC 17021-1 is for the certification body, which is accredited against it.

Is ISO/IEC 17021-1:2015 being replaced?

Not yet. The 2020 review confirmed it, and the review that closed in March 2026 has not produced a new edition at the time of writing. Accreditation bodies still name the 2015 edition.

Does IAF MD 5 apply to every scheme?

Its mandatory provisions cover quality, environmental and occupational health and safety audits. Other schemes use their own documents, such as ISO/IEC 27006-1 for information security, although IAF MD 5 notes that some of its elements can be used elsewhere.

Where can I buy the text of ISO/IEC 17021-1?

From ISO or your national standards body. AGS kits do not include the text of any standard.

AGS provides independent documentation toolkits. ISO, IEC, Global ACI, IAF, ILAC, European Accreditation, EIAC and SAAC are named for identification only. AGS is not affiliated with, endorsed by or approved by any of them, and no kit guarantees an accreditation outcome.

Reviewed October 2026. Facts checked against the sources current at publication.