Frequently Asked Questions: ISO FAQs

An independent audit confirming your management system meets a published standard. You build and run the system, an accredited certification body audits it and issues the certificate. See the ISO standards we work with.

Usually whichever your customers or tenders ask for. Quality is ISO 9001, safety ISO 45001, environment ISO 14001, information security ISO 27001. If a tender prompted the question, send us the wording and we will tell you what it requires.

No. It is voluntary. It becomes a commercial requirement when a client, principal contractor or tender makes it a condition of supply, which is how most organisations end up needing it. See ISO 9001 for tenders.

Both are legitimate. If nobody is asking for the certificate, building to the standard without certifying gives you the operational benefit at lower cost. If a tender needs the certificate, the system alone will not satisfy it.

No. A small organisation usually has fewer processes and fewer significant risks, so there is less to control. Size changes the effort, not the eligibility.

You are certified. Certification bodies are accredited. An accreditation body such as JAS-ANZ audits the certification body, which is what makes the certificate mean something. See ISO certification bodies in Australia.

For ISO 9001, 45001 or 14001, most small to medium organisations land between $7,000 and $25,000 in the first year, covering both consulting support and the certification body audit fees. See the ISO 9001 certification cost guide.

More than the others, typically $15,000 to $30,000 in the first year, because the risk assessment, Statement of Applicability and Annex A controls carry more work. See the ISO 27001 certification cost guide.

Because they are pricing different things. Some cover only the certification audit, some only consulting, some both. Scope, number of sites, headcount and how much work you do yourself all move the number. Ask what is included before comparing.

Yes, substantially. The management clauses are shared, so a standard built as part of an integrated system generally runs 50% to 75% of its standalone cost, and the more you build at once the further toward the lower end it goes.

Sometimes. Funding usually arrives through broader business capability or industry programs where certification counts as eligible expenditure, rather than as an ISO specific grant. See government funding and grants.

A surveillance audit in years two and three, then a recertification audit. Surveillance audits are shorter and cheaper than the initial certification audit. Budget for internal audit and management review time as well.

Three to six months for most small and medium organisations. Shorter is usually rushed, because the system has to run long enough to produce records worth auditing. Longer and projects lose momentum. Larger, multi-site and multinational organisations run longer.

Rarely, and not well. The constraint is not how fast a consultant works, it is that a certification body needs evidence the system has been operating. See ISO 9001 certification in 10 days.

Three years, with a surveillance audit each year and a recertification audit before it expires.

The certification body can suspend and eventually withdraw the certificate. Suspension is usually recoverable, withdrawal means starting again. Tell them early if a date is a problem rather than letting it pass.

The international standard for a quality management system: a documented, working way of running the business so it consistently meets customer and regulatory requirements. See ISO 9001 quality management systems.

The standard for an occupational health and safety management system, built around hazard identification, worker consultation and controlling risk to health and safety. See ISO 45001 safety consulting.

The standard for an environmental management system: identifying where your operation affects the environment, controlling what matters, and meeting your compliance obligations. See ISO 14001 consulting.

The standard for an information security management system, built on a risk assessment, a Statement of Applicability and the Annex A controls. See ISO 27001 information security.

The standard for an artificial intelligence management system, covering governance of AI you build or use. See ISO 42001 AI management.

The standard for testing and calibration laboratories, covering technical competence and valid results rather than management system conformity alone. See ISO 17025 for laboratories.

A food safety approach based on identifying hazards and controlling them at critical points in the process. See HACCP food safety systems.

ISO 14001:2026 was published on 15 April 2026 and replaces both the 2015 edition and the 2024 climate change amendment. The clause structure is retained, so existing systems transition without a rebuild. See the ISO 14001:2026 transition guide and the ISO 9001 equivalent.

Yes, as a context issue. Clause 4.1 requires you to determine whether climate change is a relevant issue for your organisation, and clause 4.2 notes interested parties may have climate related requirements. It is not a requirement to measure emissions or set targets. See climate risk assessment.

One management system meeting several standards at once, with a single set of processes, internal audits and management reviews rather than running them in parallel.

Yes, and we usually recommend it. They share the same high level structure, so context, leadership, competence, document control, internal audit, management review and improvement are run once rather than three times.

Yes. Expect a standard built as part of an integrated system to run 50% to 75% of its standalone cost, and the certification body audits them together, which costs less than separate audits.

An accredited certification body, independent of any consultant. In Australia most are accredited by JAS-ANZ. See ISO certification bodies in Australia.

Check the accreditation covers the standard and the scope you need, confirm they have auditors competent in your industry, and compare the full three year cost rather than the first year alone. See how to choose a certification body.

Yes. Forgeries are now visually convincing, so the document itself proves nothing. See how to tell if an ISO certificate is real or fake.

Look the certification body up on the accreditation body register for the region where it was accredited, then confirm the certificate and its scope with that body directly. Do not rely on a logo or a PDF.

Yes. A transfer is a defined process and does not mean starting again, provided your current certificate is valid and in good standing. Timing it with a surveillance or recertification audit is usually cleanest.

No. Clause 7.2 asks you to work out what competence each role needs, make sure people have it, act where they do not, and keep records as evidence. A training matrix is a common and often sensible way to do that, but the standard does not name one, and neither does it name a learning management system. If a simple register shows the same thing, it meets the requirement. See clause 7.2 competence.

No. Clause 9.1.2 asks you to monitor how well your customers’ needs and expectations have been met, and leaves the method to you. Large clients rarely fill in feedback forms. A standing customer satisfaction item in your project close-out or retrospective, capturing complaints, compliments and what the client told your team on the job, gives an auditor a clear answer to where you monitor it.

The ones that feed into what you deliver: suppliers whose products or services go into your own, providers who deliver directly to your customers on your behalf, and anyone performing part of your process for you, such as subcontractors. Your accountant, your stationery supplier and your ISO consultant generally sit outside it. Set the level of control by risk, with prequalification and monitoring for providers who could affect your output.

Less than most people expect, and a little more than the standard strictly demands. Too much admin adds no value and people stop doing it. Too little and you cannot show conformity. Only some clauses call for documented information, but a short record for others, such as your context and interested parties, means everyone gives the auditor the same answer.

Stage 1 reviews the documented system and readiness. Stage 2 tests whether you do what the system says, by sampling records and interviewing people. Both are carried out by the certification body.

By being able to show objective evidence against each clause. The auditor is not looking for perfection, they are looking for a system that operates and that finds its own problems. See the ISO 9001 audit process.

A failure to meet a requirement of the standard or of your own system. Auditors grade what they find. Take the policy required by clause 5.2: having no policy at all is a major nonconformity, a policy that is unsigned or missing required content is a minor, and a sound policy that nobody has been told about may only be raised as an opportunity for improvement. Majors must be closed before certification, minors with an agreed corrective action. Finding your own is a sign the system works. See nonconformity and corrective action.

Your own check that the system is working and being followed, required by clause 9.2 of every management system standard, done before the certification body arrives. In an integrated system, plan your audits in one IMS calendar alongside management review and your other routines, and base them on risk, recent changes and previous results. See internal auditing.

Anyone competent, provided the audit is objective and impartial. ISO 19011 asks for independence from the area being audited where practicable, and you need to be able to show how bias was controlled. Where your team lacks the capacity or the impartiality to run it internally, an independent internal auditor is the simplest way to show it. See independent internal audits.

A review of what you already have against the requirements of the standard, so you know what is missing before committing to a project. See gap analysis audits.

Helps you design, build and implement the management system, and prepares you for the certification audit. See how an ISO consultant can help.

No. Certification bodies must be impartial under ISO/IEC 17021-1, so they will not certify a management system that they, or a consultancy linked to them, helped build. That separation is what makes the certificate credible.

Yes, and if you have a capable operations or HSE person it is often better value. See ISO mentoring, where your team builds it with an experienced auditor alongside.

Ongoing support where we run the management system routines with you, for organisations that need the system maintained without hiring for it. See outsourced ISO manager.

Yes. A gap analysis or a certification readiness review tells you where it would fail before a certification body finds it.

Yes, across Australia, on site and remotely. See ISO consultants Australia.