Program requirements: ISO/IEC 17021-1
Management System Certification Body Accreditation Program
Standard
ISO/IEC 17021-1
Program overview
Organizations covered
- Information security (ISO/IEC 27001) certifiers
- Certifiers of sector-specific management systems (food, compliance, anti-bribery and more)
Principal requirements
- Personnel competence — qualified and competent personnel with appropriate qualifications and experience
- Impartiality — independence and freedom from conflicts of interest in certification decisions
- Assessment methods — valid and reliable assessment methods and processes for certification activities
- Confidentiality — proper handling and protection of client information and certification data
Value of accreditation
- Credibility — independent evidence of certification competence within the approved scope
- Standards conformity — demonstrate competence against applicable accreditation requirements
- Stakeholder confidence: support the confidence of clients, regulators and other stakeholders through accredited certification
Overview
What does a management system certification body do?
A management system certification body evaluates and certifies an organization’s management systems against defined standards or frameworks, including ISO management system standards.
Management system certification bodies assess the effectiveness, efficiency, and conformity of management systems against internationally recognized standards. These assessments support organizations in demonstrating their commitment to continual improvement, regulatory compliance, and customer satisfaction.
Management system certification provides stakeholders with assurance and can support market competitiveness and confidence in an organization’s ability to maintain consistent quality and performance.
Accreditation criteria
ISO/IEC 17021-1
ISO/IEC 17021-1 is the international standard that specifies requirements for the competence, impartiality and consistency of management system certification bodies. Accreditation to ISO/IEC 17021-1 demonstrates that a certification body has the technical competence, resources and management system in place to conduct certification activities effectively and impartially. The ISO/IEC 17021 series covers the qualification and competency of personnel, the validity and reliability of assessment methods, the impartiality and independence of certification decisions, and the confidentiality of client information.
Assessment process
Your 7-step path to accreditation
-
01
Application submission
Certification bodies apply for accreditation by submitting an application form with the required documentation, including quality manuals, procedures and evidence of competence in specific management system standards.
-
02
On-site office assessment
QAC uses on-site assessment to evaluate the certification body's compliance with ISO/IEC 17021-1 requirements, through document review, personnel interviews, and observation of assessment activities.
-
03
Witnessed assessment
QAC requires witness assessments in which a QAC assessor observes an auditor conducting an assessment. Witnessing evaluates conformity with accreditation standards and supports impartial, consistent, and reliable practice.
-
04
Accreditation committee review
The accreditation committee reviews the findings to determine whether the certification body meets the accreditation criteria. Before deciding, the committee may request further information or clarification.
-
05
Accreditation decision
The accreditation committee decides accreditation status on the basis of the assessment findings and recommendations. Accredited bodies receive a certificate and an entry in QAC’s official registry.
-
06
Annual surveillance assessment
Accredited certification bodies undergo annual surveillance assessments to evaluate continued conformity with accreditation requirements. These may include site visits, document reviews and interviews with personnel.
-
07
Reaccreditation every four years
The accreditation cycle is four years. To retain accreditation, certification bodies must complete reaccreditation at the end of the cycle through a comprehensive reassessment of competence, management system and compliance with ISO/IEC 17021-1.
Standards
Management system standards covered by the program
56 standards grouped into 9 technical categories, covering management system disciplines and supporting guidance.
Artificial Intelligence
7-
ISO/IEC 17021-1:2015
Conformity Assessment — Requirements for Bodies Providing Audit and Certification of Management Systems — Part 1: Requirements
-
ISO/IEC 23894:2023
Information Technology — Artificial Intelligence — Guidance on Risk Management
-
ISO/IEC 27090:2026
Cybersecurity — Artificial Intelligence (AI) — Addressing Security Threats and Compromises to AI Systems
-
ISO/IEC 42001:2023
Information Technology — Artificial Intelligence — Management System (AIMS)
-
ISO/IEC 42005:2025
Information Technology — Artificial Intelligence — AI System Impact Assessment
-
ISO/IEC 42006:2025
Information Technology — Artificial Intelligence — Requirements for Bodies Providing Audit and Certification of Artificial Intelligence Management Systems
-
ISO/IEC 5338:2023
Information Technology — Artificial Intelligence — AI System Life Cycle Processes
Continuity, Risk & Resilience
3-
ISO 22301:2019
Business Continuity Management System (BCMS)
-
ISO 28000:2022
Security and Resilience — Security Management Systems
-
ISO 31000:2018
Risk Management — Guidelines
Environment, Energy & Safety
5-
ISO 14001:2015
Environmental Management System (EMS)
-
ISO 39001:2012
Road Traffic Safety Management System (RTSMS)
-
ISO 45001:2018
Occupational Health and Safety Management System (OH&SMS)
-
ISO 46001:2019
Water Efficiency Management System
-
ISO 50001:2018
Energy Management System (EnMS)
Industry & Sector-Specific
8-
ISO 13485:2016
Medical Devices Quality Management System
-
ISO 14298:2021
Security Printing Management System
-
ISO 15378:2017
Quality Management Requirements for Primary Packaging Materials for Medicinal Products
-
ISO 18788:2015
Management System for Private Security Operations
-
ISO 19443:2018
Quality Management System for Nuclear Energy Supply Chain
-
ISO 22000:2018
Food Safety Management System (FSMS)
-
ISO 29001:2020
Sector-Specific Quality Management System for Petroleum, Petrochemical and Natural Gas Industries
-
ISO 34101-1:2019
Sustainable and Traceable Cocoa Management System
Information Security & Technology
2-
ISO 20000-1:2018
Information Technology Service Management System (ITSMS) — formally ISO/IEC 20000-1
-
ISO/IEC 27001:2022
Information Security Management System (ISMS)
Project, Programme & Portfolio Management
7-
ISO 21500:2021
Project, Programme and Portfolio Management — Context and Concepts
-
ISO 21502:2020
Project, Programme and Portfolio Management — Guidance on Project Management
-
ISO 21503:2022
Project, Programme and Portfolio Management — Guidance on Programme Management
-
ISO 21504:2022
Project, Programme and Portfolio Management — Guidance on Portfolio Management
-
ISO 21505:2017
Project, Programme and Portfolio Management — Guidance on Governance
-
ISO 21508:2026
Earned Value Management in Project and Programme Management
-
ISO 21511:2018
Work Breakdown Structures for Project and Programme Management
Quality, Governance & Compliance
10-
ISO 21001:2018
Educational Organizations Management System (EOMS)
-
ISO 30301:2019
Management Systems for Records
-
ISO 30401:2018
Knowledge Management System
-
ISO 37001:2025
Anti-Bribery Management System (ABMS)
-
ISO 37301:2021
Compliance Management System (CMS)
-
ISO 41001:2018
Facility Management System (FMS)
-
ISO 44001:2017
Collaborative Business Relationship Management System
-
ISO 55001:2024
Asset Management System (AMS)
-
ISO 56001:2024
Innovation Management System
-
ISO 9001:2015
Quality Management System (QMS)
Software & Systems Engineering
10-
ISO/IEC 25010:2023
Systems and Software Quality Requirements and Evaluation (SQuaRE) — Product Quality Model
-
ISO/IEC 330xx series
Information Technology — Process Assessment
-
ISO/IEC/IEEE 12207:2017
Systems and Software Engineering — Software Life Cycle Processes
-
ISO/IEC/IEEE 14764:2022
Software Engineering — Software Life Cycle Processes — Maintenance
-
ISO/IEC/IEEE 15288:2023
Systems and Software Engineering — System Life Cycle Processes
-
ISO/IEC/IEEE 15289:2019
Systems and Software Engineering — Content of Life-Cycle Information Items (Documentation)
-
ISO/IEC/IEEE 16085:2021
Systems and Software Engineering — Life Cycle Processes — Risk Management
-
ISO/IEC/IEEE 16326:2019
Systems and Software Engineering — Life Cycle Processes — Project Management
-
ISO/IEC/IEEE 29119 series
Software and Systems Engineering — Software Testing
-
ISO/IEC/IEEE 29148:2018
Systems and Software Engineering — Life Cycle Processes — Requirements Engineering
Sustainability & Community
4-
ISO 20121:2024
Event Sustainability Management System
-
ISO 21401:2018
Sustainability Management System for Accommodation Establishments
-
ISO 24518:2015
Crisis Management of Water Utilities
-
ISO 37101:2016
Management System for Sustainable Development in Communities
Scope
Technical domains within the accreditation scope
The industries and sectors in which management system certification bodys operate.
Food
Scope covers food products, beverages and tobacco (IAF code 3).
Mechanical
Scope covers basic metals, fabricated metal products, machinery, equipment, electrical and optical equipment, shipbuilding and other transport equipment (IAF codes 17, 18, 19, 20, 22).
Paper
Scope covers publishing companies and printing companies (IAF codes 8, 9).
Minerals
Scope covers mining and quarrying, non-metallic mineral products, concrete, cement, lime and plaster (IAF codes 2, 15, 16).
Construction
Scope covers construction (IAF code 28).
Goods production
Scope covers textiles, leather products, wood products, rubber and plastic products, manufacturing not elsewhere classified (IAF codes 4, 5, 6, 14, 23).
Chemicals
Scope covers chemicals, chemical products and fibers (IAF code 12).
Supply
Scope covers electricity supply, gas supply and water supply (IAF codes 25, 26, 27).
Transport & waste management
Scope covers recycling, transport, storage, communication and other social services (IAF codes 24, 31, 39).
Services
Scope covers wholesale and retail trade, financial intermediation, information technology, education, public administration and other services (IAF codes 29, 32, 33, 35, 36, 37).
Nuclear
Scope covers nuclear fuel (IAF code 11).
Pharmaceutical
Scope covers pharmaceuticals (IAF code 13).
Aerospace
Scope covers aerospace (IAF code 21).
Health
Scope covers health and social work (IAF code 38).
Compare our other accreditation programs