Frequently asked questions — ISO standards and certification
Answers to the questions we are asked before implementation even starts — how certification works, how long it takes, what affects the price and what happens when a standard gets a new edition. For questions about a particular standard, the pages for individual standards have their own FAQ sections — start from the overview of standards.
ISO standards: the basics
What is an ISO standard?
An ISO standard is an internationally agreed document that sets out requirements for how something is done — for example, how quality, information security or environmental impact is managed. A management system standard such as ISO 9001 doesn’t prescribe what a product should be like, but how an organisation manages things so that the result is consistent and repeatable.
Which ISO standard do we need?
It depends on what you do and who is asking you to be certified. The usual starting point is ISO 9001 for quality; manufacturers and other companies whose work has a visible impact on the environment or on safety add ISO 14001 and ISO 45001; IT companies and those that process other people’s data go for ISO 27001; food producers and distributors go for HACCP and ISO 22000. If you’re not sure, the overview of all standards explains what each one covers.
Is an ISO certificate a legal requirement?
ISO standards themselves are voluntary — none of them is required by law. What is mandatory are the regulations in particular areas, such as the requirement for food business operators to have a system based on HACCP principles. A standard helps you organise and demonstrate how you meet such an obligation, but it doesn’t replace it. In practice, a certificate is most often required by the market — a contracting authority in a tender or a customer in the supply chain.
What is the difference between a standard and a certificate?
A standard is a document containing requirements. A certificate is confirmation from an independent body that your organisation meets those requirements. You can work to a standard without a certificate; the certificate is proof for third parties.
How you get an ISO certificate
How do you get an ISO certificate?
The process has two separate parts. First the system is implemented — the scope is defined, processes and risks are listed, the rules are written down and records start being kept, staff are trained, and then an internal audit and management review are carried out. Next comes the certification audit, carried out by an independent body in two stages. Stage 1 checks readiness: the documentation is reviewed, but so are the scope, the sites, the regulations that apply to you and whether the internal audit and management review really took place. Stage 1 can also be carried out on site — the body must tell you in advance. Stage 2 takes place on site and checks whether the system actually works in practice. If there are no nonconformities that prevent certification, the certificate is issued.
Who issues ISO certificates?
An independent certification body — and it should be an accredited one. The consultant who prepares you must not issue the certificate — that would be a conflict of interest. STANDARDISO guides organisations through the preparation and the certification process itself, but does not issue certificates. We only work with accredited certification bodies.
What does ‘accredited’ mean, and why does it matter?
Accreditation means the certification body itself has been assessed by the competent accreditation body and works to rules that apply internationally. Accreditation is what a customer or contracting authority checks when it asks for proof. A certificate from a body without accreditation doesn’t carry the same weight, so you may have to go through certification again with an accredited body.
How can I check whether a certification body is accredited?
It is a public check that takes a minute. For Serbian bodies there is the directory of the Accreditation Body of Serbia (ATS), which also shows which standards and fields each body is accredited for — because accreditation isn’t general, it is granted for a specific scope. For foreign bodies there is IAF CertSearch, an international database where the certificate itself can also be validated.
Check two things: that the body has valid accreditation, and that the scope of its accreditation covers your standard and your sector. The second is the easiest to miss.
One limitation of IAF CertSearch: a certificate can only be validated if you know the company name or the certificate number — you can’t search blindly. Since October 2024, accredited certification bodies have had to keep their certificates up to date there, so a certificate that isn’t there is a warning sign — though not proof on its own. If the body isn’t based in Serbia, the safest option is to check the register of the accreditation body that accredited it.
How long is an ISO certificate valid?
The certification cycle lasts three years — as set out in ISO/IEC 17021-1, which all accredited certification bodies follow. During that time the certification body carries out surveillance audits, and before the certificate expires there is a recertification audit.
What happens at a certification audit?
The auditor checks whether what your documents say matches what actually happens. They talk to employees, ask for records and watch how the work is actually done. A finding can be conformity, an opportunity for improvement or a nonconformity. Nonconformities are graded as major or minor — what follows from that is explained in the next question.
What if they find a nonconformity at the audit?
A nonconformity isn’t failing an exam — finding deviations is part of what an audit does. The certification body grades them as major or minor, and what happens next depends on that.
A minor nonconformity doesn’t stop the certificate being issued: the body reviews the finding and accepts your plan for correction and corrective action, and checks, at the next audit at the latest, that the plan has been carried out. A major nonconformity does stop it — it must be closed before the certification decision, and verifying that may require another visit to the site.
In both cases the same three things are needed: a correction — fixing the specific case; a root cause analysis — why it happened; and a corrective action that prevents it from happening again, with evidence that it has been carried out. The certification body sets the deadlines and states them in the audit report. One deadline is fixed: if the body hasn’t verified the corrections and corrective actions for a major nonconformity within six months of the last day of stage 2, stage 2 is repeated.
What if the body doesn’t recommend certification?
This happens when a major nonconformity remains open. Certification isn’t refused permanently — the body sets a deadline for corrections and corrective actions and verifies them. If it can’t verify them within six months of the last day of stage 2, stage 2 is repeated, which means a new site visit and a new cost. That is why an internal audit is done before the certification audit: to find major nonconformities while they are still cheap to fix.
Can we switch to a different certification body?
Yes. Transferring a certificate to another accredited body is a defined procedure: the new body reviews the valid certificate, the reports from the latest audits and the status of any open nonconformities, then decides whether to accept the transfer and on what terms. The new body won’t issue its certificate until any major nonconformities have been closed.
What do we submit as evidence in a tender?
A copy of the certificate, showing the scope, the edition of the standard, the expiry date and the accreditation mark of the body that issued it. The contracting authority may also check the register, so it is important that the scope on the certificate really covers the work you are bidding for — a certificate for one activity doesn’t prove another.
Cost and duration
How much does ISO implementation cost?
Three things affect the price: the size of the organisation, the number of employees and the standard being implemented. We can only give an exact price after you get in touch and we have a short conversation about the scope — without that, any figure would be guesswork, so we don’t give one here.
Is the consultant’s fee the same as the cost of certification?
No. They are two separate costs paid to two different parties: the consultant prepares you, while the certification body charges for the audit itself. The body’s fee is based on the number of audit days, and that number isn’t arbitrary: it is derived from the effective number of personnel and the complexity of the system, under international accreditation rules that apply to all accredited bodies. If two quotes differ significantly in the number of days, ask how they were calculated.
How long does ISO implementation take?
Implementation usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much is already in place. Add to that the time the certification body needs to schedule and carry out the audit.
Can we speed up implementation?
Partly. What you can’t skip are the records — the system has to run for a while so that there is evidence it works. The internal audit and management review must be carried out before the certification audit, not after it.
Is co-funding available?
It is worth checking before you start. Through its competitiveness support programmes, the Development Agency of Serbia (RAS) also co-funds costs related to standards and certification. Eligibility rules, amounts and deadlines change from year to year, and current calls are open only to small and medium-sized companies majority-owned by Serbian persons or entities, so foreign-owned companies usually can’t apply. Check the current public calls on the Development Agency of Serbia website (in Serbian).
What if we have several sites?
Several sites don’t necessarily mean several full audits. When the same work is done at all sites under the same rules, the body may audit a sample of sites under international accreditation rules, and always audits the head office. If the activities differ, sampling isn’t allowed: every site is audited at certification and recertification, and some of them at each surveillance audit.
Working with a consultant
How much of our time does ISO implementation take?
It doesn’t require daily involvement. For most small and medium-sized organisations it takes 2 to 5 hours a week in total, shared between the responsible person, management and the owners of individual processes.
Some phases are busier — the gap analysis, training, the internal audit and preparing for the certification audit. That’s why activities and deadlines are agreed in advance, so the project fits around your normal business.
What we need from you: accurate information, named responsible people, review and approval of the documentation, applying the agreed procedures and keeping records. We run the project, prepare the documentation, deliver the training and carry out internal audits, and give you a clear list of what needs to be done between meetings.
Who in the company is involved in ISO implementation?
Typically the project involves:
- the managing director or a representative of top management;
- a named project coordinator;
- managers or people responsible for individual processes;
- employees whose work is covered by the system;
- where needed, legal, HR, IT, health and safety, finance or other specialist functions.
Do you work outside Belgrade?
We work throughout Serbia, through a mix of on-site work at the client’s premises and remote consultations — the balance depends on the sector, the number of sites and how complex the processes are. We are also available for projects elsewhere in the region and for international projects, remotely or with agreed visits. Where we have worked is listed on our About us page.
How many internal auditors do we need to train?
The standard doesn’t set a number. It requires auditors to be competent and impartial — and impartiality means nobody audits their own work. That gives you a practical rule: you need at least enough people for every process to be audited by someone who doesn’t work in it.
Does the documentation have to be in Serbian?
The standard doesn’t prescribe a language. It requires the documentation to be understood by the people who use it — so if instructions are used by people on the shop floor, they must be in a language those people understand. The language of the audit is agreed with the certification body. For records you may have to show to government inspectors, the law decides the language, not the standard. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.
Editions and transitions
Which editions are current?
The year in the name shows the edition. As of October 2026:
- ISO 9001:2026 — published on 16 September 2026, replaces the 2015 edition; ISO 9001:2015 certificates stay valid until 30 September 2029 at the latest.
- ISO 14001:2026 — published on 15 April 2026, replaces the 2015 edition.
- ISO/IEC 27001:2022 — replaced the 2013 edition.
- ISO 37001:2025 — replaces the 2016 edition.
- ISO/IEC 27701:2025 — replaces the 2019 edition; the standard is now standalone, so organisations can be certified to it without ISO 27001.
- ISO 45001:2018, ISO 22301:2019, ISO 50001:2018, ISO/IEC 20000-1:2018, ISO 22000:2018 and ISO 41001:2018 — all current editions.
- ISO 13485:2016 — the current edition.
The February 2024 amendment, which added climate change to the consideration of context, was made to the older editions listed: ISO/IEC 27001:2022, ISO 45001:2018, ISO 22301:2019, ISO 50001:2018, ISO/IEC 20000-1:2018, ISO 22000:2018 and ISO 41001:2018. Editions published since — ISO 55001:2024, ISO 37001:2025, ISO/IEC 27701:2025, ISO 21001:2025, ISO 14001:2026 and ISO 9001:2026 — include it in the text itself. ISO 13485:2016 isn’t covered, because it doesn’t follow the harmonised structure.
We have a certificate to an old edition — what now?
Every new edition comes with a transition period. After it ends, certificates to the old edition are no longer valid. For ISO 37001 the transition must be completed by 28 February 2027, and since 31 August 2026 new certifications and recertifications are only issued against the 2025 edition. For ISO 14001 the deadline is 30 April 2029, and from 31 October 2027 new certifications are only issued against the 2026 edition. For ISO 9001 the transition must be completed by 30 September 2029, and from 31 March 2028 new certifications are only issued against the 2026 edition.
Does moving to a new edition mean starting from scratch?
No. A transition is an update to the existing system — most of the documentation and records stay. The work starts with a gap analysis: what the new edition adds and what your system is missing.
HACCP and food safety
Who must have HACCP?
Food business operators at the production, processing and distribution stages. Primary production is exempt, and the obligation doesn’t depend on the size of the company. Exceptions exist, but they apply to establishments — those handling small quantities of food, using traditional methods or facing particular geographical constraints — and are set out in more detail by the minister. Exactly who must comply, and at which stage, is explained on our HACCP page.
What is the difference between HACCP and ISO 22000?
HACCP is a legal obligation; ISO 22000 is a voluntary standard that includes HACCP and builds on it. The difference is explained in detail on our HACCP page.
Do we need a HACCP certificate, or is having the system enough?
The law requires a system that is set up and applied, not a certificate. The certificate is required by the market — customers, retail chains and foreign partners.
Several standards together
Can we implement several standards at once?
Yes, and that is how it is usually done. Most management system standards share the same structure, so the context, policy, document control, internal audits and management review are done once for all the systems instead of separately for each.
What is an integrated management system?
It is a single system that meets the requirements of several standards at the same time — for example ISO 9001, ISO 14001 and ISO 45001 together. Instead of three separate sets of documents and three separate audits, there is one system and one audit covering everything.
Is certification done together as well?
It can be. The certification body can carry out a combined audit, which usually takes less time than three separate audits.
After certification
What happens after certification?
The system has to keep running. That means internal audits, management reviews, monitoring of objectives and dealing with nonconformities all continue — because those are exactly the records asked for at the next audit.
What is a surveillance audit?
An audit the certification body carries out between certifications to confirm that the system still meets the requirements. It is shorter than the certification audit and covers part of the system, not everything at once.
Can a certificate be withdrawn?
Yes — if nonconformities found at a surveillance audit aren’t resolved within the agreed time, the certification body can suspend or withdraw the certificate.
What if the company changes while the certificate is valid?
Changes in your activities, sites or scope of work can affect the scope of certification and must be reported to the certification body. The scope stated on the certificate must match what the organisation actually does.
Do you offer support after certification?
Yes. Certification isn’t the end of the system but the start of its regular maintenance. Support is agreed separately and tailored to the size of the organisation, the number of standards, the sites, the sector and how much expertise you already have in-house. It can be monthly, quarterly or as your organisation needs, and you decide who the responsible person is.
Depending on what we agree, it covers: reviewing documentation and records; updating procedures and forms; tracking changes in the organisation and adapting the system; objectives and performance indicators; updating risks, opportunities, environmental aspects and relevant requirements; dealing with nonconformities and corrective actions; internal audits; management review; training; preparation for surveillance and recertification audits; and support in communicating with the certification body.
Didn’t find your answer?
Questions about your particular line of business are answered fastest in a short conversation. Get in touch through our contact page or send a quote request saying which standard you’re interested in — we’ll reply with an estimate of the scope and timescale.
If you’re not yet sure which standard you need, start with the overview of all standards or the overview of our services.