Third-party certification, accreditation oversight and the role of the lead auditor
The chain of oversight
International Accreditation Forum (IAF) multilateral arrangements sit above accreditation bodies (ISO/IEC 17011), which assess and accredit certification bodies (ISO/IEC 17021-1), which certify client management systems. Accreditation recognises the competence and impartiality of the certification body; it is not a certificate of the client's products.
Initial certification is two-stage: Stage 1 reviews readiness, documented information, scope and resources; Stage 2 evaluates implementation and effectiveness. Certification runs on a three-year cycle with surveillance audits at least annually and a recertification audit before expiry. Special (short-notice) audits, suspension and withdrawal exist for serious or persistent issues.
Impartiality and the decision
Certification bodies must analyse threats to impartiality - self-interest, self-review, familiarity, intimidation - and must not certify a management system on which they provided consultancy, with a two-year cooling-off period. The certification decision is taken by a competent person or committee not involved in the audit. The lead auditor does not grant certification.
Lead auditor role
Leads and manages the team, allocates tasks, safeguards the plan and schedule, represents the team to client and auditee, chairs opening and closing meetings, ensures findings are agreed within the team (reporting divergent views if consensus fails), and ensures the report is issued.
Traps
"The auditor decides certification" (false); "accreditation certifies the client" (false); "certification guarantees product quality" (false).
Rule of thumb: when a question asks who decides, the answer is the certification body's independent decision-maker - never the lead auditor.