How we work

Our certification process.

Independent, rigorous and transparent — from the first scoping call to certificate and beyond. Here is exactly what to expect at each stage.

ABS certification process planning and audit

What to expect, from kick-off to certificate

Certification follows a well-established route, defined by the international rules for certification bodies (ISO/IEC 17021-1). It runs in four phases — scoping, a Stage 1 audit, a Stage 2 audit, and certification followed by ongoing surveillance. The aim at every step is the same: an honest, evidence-based assessment that earns a certificate worth having.

For most organisations under 200 employees, the full path from kick-off to certificate takes around 10–14 weeks; larger or multi-site organisations typically take longer. Every engagement begins with a fixed-price scoping call and a proposal within 24 hours, so you know the timeline and cost before you commit.

The four phases

1. Scoping & quote

We start with a scoping call to understand your organisation, the standard you are pursuing, the number of sites, and the complexity of your operations. From that, we send a fixed-price proposal within 24 hours with a firm timeline. Nothing else begins until you are comfortable with the scope and cost. You'll prepare: a basic picture of your business, sites and any existing certifications.

2. Stage 1 audit — documentation & readiness review

The Stage 1 audit reviews whether your management system is documented and ready for assessment. The auditor checks your policies, procedures and scope, confirms that the key elements of the standard are in place, and identifies anything that needs attention before Stage 2. This stage is deliberately designed to surface gaps early, so there are no surprises later. It can often be conducted remotely. You'll prepare: your documented system and evidence that it has started operating.

3. Stage 2 audit — implementation assessment

The Stage 2 audit assesses whether your system is genuinely implemented and effective — not just written down. The auditor gathers evidence across your operations: interviewing staff, reviewing records, and observing the system in practice. Any findings are documented clearly. Depending on the standard, Stage 2 may be on-site, remote or a mix. You'll prepare: records and people who can show the system working day to day.

4. Certification & surveillance

Once any findings are closed, an independent certification decision is made and your certificate is issued — recognised internationally through our accreditation. Certification is not a one-off event: it is maintained through regular surveillance audits and renewed on a recertification cycle, which keeps it credible over time. You'll prepare: to keep the system live, because the next audit confirms it is still working.

Maintaining your certification

A certificate is a living thing. Under the ISO/IEC 17021-1 framework that governs management system certification, certification runs on a three-year cycle for most ISO standards, with surveillance audits — typically annual — in between. These are lighter than the original assessment, but they confirm that your system is still operating and improving rather than drifting after the certificate is on the wall.

At the end of the cycle, a recertification audit renews the certificate for the next period. If your organisation changes materially — new sites, new activities, a wider scope — that can be assessed and added at the appropriate point rather than waiting. The principle throughout is continuity: certification should reflect how your organisation actually runs, today and over time.

Common questions about our process

Can audits be conducted remotely?

Many can. Stage 1 reviews, surveillance audits and assessments such as ISO 27001 and SOC 2 are frequently delivered fully remotely. Some certifications — for example ISO 45001, where site safety must be observed — may require an on-site visit. We confirm the approach for your scope upfront, so there are no surprises.

What documentation do we need to prepare?

It depends on the standard, but typically your policies, key procedures, records that show the system operating (for example management review and internal audit results), and evidence relevant to the standard's requirements. We tell you exactly what is in scope at the scoping stage, and the Stage 1 audit is designed to surface any gaps before the main assessment.

What happens if we have a non-conformity?

A non-conformity is not a failure — it is a finding to be addressed. You implement corrective action within an agreed timeframe, and we verify it (often remotely). Certification proceeds once findings are satisfactorily closed. Our approach is to surface gaps early, during Stage 1, so material issues rarely appear for the first time at Stage 2.

How quickly can we get the certificate after Stage 2?

Once any Stage 2 findings are closed and the independent certification decision is made, the certificate is issued. For most organisations under 200 employees the full path from kick-off to certificate is around 10–14 weeks; larger or multi-site organisations typically take longer. We give you a firm timeline with your initial quote.

Looking for a specific standard? See, for example, ISO 27001 or ISO 9001 — or contact us to talk through your scope.