Guide · Certification

How to choose an ISO certification body in Australia & New Zealand

Once your management system is built, someone independent has to audit it and issue the certificate. Choose well and you get a fair, useful audit at a sensible price. Choose badly and you either overpay for years — or end up holding a certificate that tender evaluators throw straight in the bin. Here's how the industry actually works, what it costs, and the questions to ask before you sign.

What a certification body actually does

A certification body (sometimes called a CB, registrar or "the auditors") is an independent organisation that assesses your management system against the ISO standard and, if you conform, issues your certificate. The process runs in a fixed pattern:

• Stage 1 audit — a readiness review. The auditor checks your documentation, scope, internal audit and management review, and confirms you're ready for the main event. Gaps here become an action list, not a failure.
• Stage 2 audit — the certification audit proper. The auditor is on site (or partly remote), interviewing staff, sampling records and watching real work to verify the system is implemented, not just written. Pass this and the certificate is issued.
• Annual surveillance audits — shorter check-ins in years one and two to confirm the system is still alive and improving.
• Recertification — a fuller audit in year three, and the cycle starts again.

One rule matters more than any other: a certification body audits — it never consults on the same system. Accreditation rules prohibit a body from certifying a system it helped write, because an auditor marking their own homework proves nothing. Anyone offering to "build your system and certify it" as a package is offering something no legitimate body can deliver.

JAS-ANZ accreditation: the non-negotiable

Certification bodies are themselves audited — by an accreditation body that checks they are competent, impartial and following the international rules. In Australia and New Zealand that body is JAS-ANZ, the Joint Accreditation System of Australia and New Zealand, established by treaty between the two governments.

This is the single most important filter when you're comparing quotes. Government agencies, councils, water authorities and most large private clients on both sides of the Tasman only accept certificates issued by a JAS-ANZ-accredited body (or, occasionally, one accredited by an equivalent overseas signatory such as UKAS). A certificate from an unaccredited issuer might look identical on the wall, but at tender evaluation it counts for nothing.

Verifying takes two minutes and should be your first step:

• Search the body's name on the public JAS-ANZ register at jas-anz.org. If they're not there, walk away.
• Check they are accredited for your specific standard. Accreditation is granted per scheme — a body can be accredited for ISO 9001 but not ISO 45001. If you want a combined certificate across 9001, 14001 and 45001, confirm all three appear in their scope.
• While you're there, you can also verify any supplier or competitor's certificate — the register lists certified organisations too.

The unaccredited-certificate trap

There is a thriving trade in cheap "ISO certificates" from offshore certification mills — websites that will sell you a convincing-looking ISO 9001 certificate in a week for a few hundred dollars. These are the compliance equivalent of a fake degree, and procurement teams in Australia and NZ are well trained at spotting them. Red flags:

• No real audit — or a "desktop audit" where you email some documents and nobody ever speaks to your team or sees your work.
• A certificate issued in days. A legitimate Stage 1 + Stage 2 process takes weeks at minimum, because auditors have to actually attend and sample evidence.
• Prices too good to be true — hundreds of dollars, all-inclusive, when real certification costs thousands.
• Accreditation you can't verify — logos from accreditation bodies you've never heard of, that don't appear on the JAS-ANZ register or the IAF's list of recognised accreditation bodies.
• "Certification" bundled with writing your documents — the conflict of interest no accredited body is permitted to have.

The damage isn't just the wasted fee. Submit an unaccredited certificate in a tender and, best case, it's disregarded; worst case, it reads as an attempt to mislead the buyer, and that reputation follows you.

What certification costs an SME

For a small, single-site Australian or New Zealand business, budget roughly $4,000–$15,000 for initial certification — Stage 1 plus Stage 2 — depending on how many standards are in scope, your headcount, and your industry's risk profile. A 10-person office business certifying to ISO 9001 alone sits at the bottom of that range; a 40-person contractor certifying to 9001, 14001 and 45001 together sits nearer the top. After that, expect annual surveillance audits at roughly a third to a half of the initial cost, then a fuller recertification audit in year three.

Audit duration isn't really negotiable — minimum auditor-days are set by international rules based on your size and scope — so quotes mostly differ on day rates, travel and overheads. Two practical levers:

• Auditor location. A body with auditors based in your state or region charges little or no travel. A body flying someone interstate for every visit adds flights and accommodation to every audit for the whole three-year cycle.
• Combined audits. If you're certifying to two or three standards, an integrated audit of one combined management system takes fewer total days than three separate audits. Ask every body how they price a combined IMS audit.

Questions to ask before you sign

Get at least two or three quotes, and put the same questions to each body:

Beyond price, ask to understand their style. Some bodies are rigid box-tickers; the better ones audit what actually matters to your business and leave you with findings worth fixing. A quick reference call to an existing client in your industry tells you plenty.

The relationship is long-term — but not a life sentence

Certification runs on a three-year cycle, and you'll normally stay with the same body for the whole cycle: initial audit, two surveillance visits, then recertification. That continuity is genuinely useful — an auditor who knows your business audits it better. But you are not locked in forever. If service slips or fees creep, you can transfer to another accredited body, most cleanly at recertification. Transfers of a valid, accredited certificate are a defined process and don't send you back to Stage 1 — one more reason to make sure the certificate is accredited in the first place.

Frequently asked questions

Related guides

General guidance on the AU/NZ certification market, not a substitute for a certification body's own quote or the JAS-ANZ register.