Certification process
How certification works, step by step
From first call to published certificate, the sequence is predictable. What varies is how much of the management system already exists, and how quickly corrective actions are closed.
The sequence
Eight stages
Enquiry and fit check
You tell us the standard and the requirement behind it. We confirm whether certification is the right answer, and which standard actually satisfies the clause you have been given.
Scope and quotation
We agree the sites, processes, headcount and shifts in scope. That determines audit days under the certification body’s rules, and therefore the fee. You receive it in writing.
Gap assessment
A clause-by-clause review of what exists and what is missing, with a prioritized findings list and an implementation plan sized to your target date.
Implementation
Policies, risk registers, objectives, procedures and records are put in place. Where possible we adapt what you already do rather than adding parallel systems.
Internal audit and management review
You cannot be certified without them. We run a full internal audit against the standard and support a management review that produces real decisions and actions.
Stage 1 audit
The certification body reviews readiness and documentation. Findings here are normal; they are closed before Stage 2 is scheduled.
Stage 2 audit and decision
The certification body audits implementation and evidence. On a positive decision — theirs, not ours — the certificate is issued and entered in the public register.
Surveillance and recertification
Surveillance audits at roughly 12 and 24 months, then recertification before the three-year expiry. The register is updated only when a decision is recorded.
Indicative timeline
Timings assume a cooperative team and a single site. Multi-site organizations and standards with statutory documentation typically take longer.
| Stage | Typical duration | Who leads |
|---|---|---|
| Enquiry and scope | 2–5 business days | Northbridge |
| Gap assessment | 1–2 weeks | Northbridge |
| Implementation | 3–10 weeks | Your team, supported by us |
| Internal audit and review | 1–2 weeks | Northbridge |
| Stage 1 audit | 1 day, then findings closure | Certification body |
| Stage 2 audit | 1–4 days depending on scope | Certification body |
| Decision and issue | 1–3 weeks | Certification body |
Who does what
Northbridge
- Scope definition and quotation
- Gap assessment and implementation support
- Documentation and record templates
- Internal audit and management review support
- Scheduling and auditor liaison
- Register and QR verification
Your organization
- Named management representative
- Access to sites, people and records
- Decisions on risk treatment and objectives
- Attendance at audit opening and closing meetings
- Corrective actions within agreed dates
- Payment of certification body fees
Common questions about the process
Can we skip the internal audit?
No. Internal audit and management review are requirements of every standard listed here, and the certification body will ask for the records.
What happens if we fail Stage 2?
Major nonconformities must be closed before a certificate can be issued. The certification body decides whether that requires a follow-up visit or documentary evidence. Minor findings are usually closed through a corrective action plan.
Can audits be remote?
Partly. Most certification bodies accept remote activity for some clauses, but site-based evidence — physical controls, production, safety — generally requires attendance. The split is agreed at scoping.
What if our scope changes mid-programme?
Tell us before the Stage 2 audit. Adding sites or processes changes audit days and may require a revised quotation. Changing scope after certification requires a special audit.