The name ISO appears in product specifications, company documents and customer requirements. But what does it mean? ISO is an international organization that develops and publishes standards, rather than the name of one certificate. We begin with its purpose, then explain what its standards offer and how organizations use them. Finally, we explore internal auditing, conformity assessment and certification.
1. What is the ISO organization?
The International Organization for Standardization, known as ISO, is an independent, nongovernmental international organization. Its members are national standards bodies. It enables experts from different countries to work together on shared standards.
ISO is a common short name, rather than an acronym formed from its English name. It derives from the Greek word “isos,” meaning “equal,” so the organization has the same short name across languages.
Knowing its name and structure does not explain why it is needed. To understand that, consider the problem it helps address.
2. What does ISO do, and why is it needed?
Imagine two manufacturers testing the same product characteristic using different methods. Their results may look similar without measuring the same thing in the same way. A buyer could struggle to make a meaningful comparison.
This hypothetical example illustrates the need for a shared reference. Agreed terminology, test methods and requirements help people understand and assess something on a common basis.
ISO organizes the cooperation that produces these international references. The work brings together relevant expertise, including producers, users, researchers and government representatives. Experts discuss needs and solutions to reach consensus, rather than expecting everyone to adopt one organization’s rules.
The results become published documents, most notably International Standards. What do these documents contain?
3. What does ISO publish, and what is a standard?
A standard is a document setting out rules, guidance or characteristics for activities or their results. Put simply, it provides a reference for what should be achieved or how a particular subject should be addressed.
Standards serve different purposes. One may specify product characteristics, another may describe a test method, and another may provide management system requirements or guidance. A management system connects policies, responsibilities and processes to achieve organizational objectives.
ISO also publishes other types of documents. Technical Specifications may address subjects still under development, while Technical Reports present information or findings. Read a document’s title, scope and type: ISO publications do not all perform the same function.
- ISO 9001: specifies requirements for a quality management system. It concerns how work is managed, rather than the specifications of a single product.
- ISO/IEC 27001: specifies requirements for an information security management system, addressing the management of information security risks.
- ISO 26000: provides social responsibility guidance. It does not set requirements for certification.
How do management system standards support continual improvement?
Management system standards connect implementation with evaluation and improvement. One method used for this is Plan–Do–Check–Act (PDCA), a repeating cycle that helps organizations manage their activities and learn from results.
Management system standards such as ISO 9001 use this approach to support continual improvement. This does not mean every ISO standard or publication follows the same model.
| Stage | What does the organization do? |
|---|---|
| Plan | Defines objectives, requirements, working methods, responsibilities, resources and how results will be measured. |
| Do | Implements the plan, provides training and support, and retains evidence of implementation. |
| Check | Monitors performance and evaluates results against objectives and requirements to identify achievements and gaps. |
| Act | Addresses causes of shortcomings, improves working methods and feeds lessons into the next planning cycle. |
The cycle continues as work progresses. Improvement does not end when an action is completed or an objective is achieved. It also extends beyond correcting errors: performance can improve even when requirements are already met.
Internal auditing, explained in section 7, contributes to the Check stage alongside performance monitoring and measurement. Its findings then inform corrective action and improvement.
A standard therefore provides a framework whose value emerges through implementation, evaluation and repeated improvement. What benefits can this create?
4. How can standards benefit us?
Benefits depend on the subject. Test standards support consistent assessment, quality management standards help organize work, and information security standards address information protection. Other areas include the environment, energy, food safety, and occupational health and safety.
Consider a hypothetical maintenance company receiving repeated complaints about late visits. Some employees record requests in emails, while others use phone messages. Responsibility for following up appointments is unclear.
Organizing the work could establish one method for recording requests, assigning responsibility and confirming appointments with customers. The company can then monitor punctuality and investigate delays.
Management can compare what customers were promised with what actually happened. If delays recur, it can examine whether the cause is limited resources, poor scheduling or incomplete information.
This example illustrates structured thinking; it is not a complete implementation of any particular standard. Nor does it establish a guaranteed outcome. Benefits require practice and follow-up, rather than simply buying a document or preparing files bearing its name.
To remain useful, the standards themselves also need structured development and review as knowledge and needs change.
5. How are standards developed and reviewed?
Development begins by identifying a need. Experts prepare a draft, discuss and revise it, and take it through commenting, voting and approval before publication. The precise route varies with the document type and project.
Published standards undergo periodic review to determine whether they need updating. A review does not automatically produce a new edition; it assesses whether the content remains suitable.
When using a standard, check its edition, status and amendments. Do not rely on an old file simply because its title looks familiar.
With the source and development process understood, we can turn to using a standard within an organization.
6. How does an organization implement a suitable standard?
Start with the actual need. Does the organization want to reduce recurring errors, protect information or manage its environmental impacts? It can then identify the standard addressing that need.
Implementing a management system standard means organizing the policies, responsibilities and processes that support organizational objectives. A management system manages these interconnected parts. Its complexity should suit the organization’s nature, size and risks; it does not necessarily require a large collection of documents.
As a practical starting point, this article suggests the following sequence:
- Read the standard’s scope and confirm its relevance to the activity.
- Compare the requirements with actual practice.
- Identify gaps and assign responsibility for addressing them.
- Implement changes and train the people involved.
- Retain implementation evidence and review results.
In our hypothetical maintenance company, writing a request-handling procedure is insufficient. The company needs to establish whether people use it, record complete information and follow up appointments.
ISO standards are voluntary in origin, but a regulation or contract may refer to a standard. Review the obligations relevant to the activity. Neither assume every standard is mandatory nor assume implementation replaces legal requirements.
The accompanying illustration shows a broader journey, from identifying the need to choosing external assurance when required.
Once implementation begins, a natural question follows: how do we know it meets the requirements?
7. How is implementation checked, and what do internal audit and certification contribute?
An organization needs evidence that its practices meet requirements. This is where conformity assessment comes in: demonstrating that specified requirements are fulfilled. Depending on the subject, assessment can involve testing, inspection or auditing. It is not limited to certification.
Internal audit: are we actually meeting the requirements?
In management systems, internal auditing helps assess conformity with the standard and the organization’s own requirements. It also helps evaluate whether the system is effectively implemented.
An audit is a structured examination based on evidence, such as records, employee interviews and observation of work. Finding a written procedure is insufficient; the auditor looks for evidence of its implementation. Auditor selection and the audit process should support competence, objectivity and impartiality.
Returning to the hypothetical maintenance company, an audit could examine a sample of customer requests. Were the required details recorded? Were responsibility and appointment times assigned? Was the process for handling delays followed? Evidence-based answers reveal conformity and gaps.
If a requirement is not fulfilled, a nonconformity is recorded, identifying the requirement and supporting evidence. For example, the sample might include requests closed without documented service completion, despite an internal requirement to record it.
The company would first establish the requests’ actual status and correct the records. It would then investigate and address the cause, checking later requests to evaluate the action’s effectiveness. Filling in missing information alone may not prevent recurrence.
Internal auditing therefore gives the organization an evidence-based view of implementation. It does not award a certificate or guarantee that all work is error-free. Findings depend on the audit scope, evidence and samples examined.
When does certification enter the picture?
An organization can benefit from a management system without certification, unless an applicable obligation requires otherwise. When it needs independent confirmation of conformity, it can engage an external certification body.
Certification provides written assurance from an independent body that specified requirements are met. For management systems, the certification body audits implementation and makes its certification decision based on the assessment. ISO itself does not certify organizations.
Internal auditing helps the organization examine its system and address gaps. Certification auditing provides independent assessment for certification purposes. Neither replaces the other.
After management system certification, the organization continues operating the system, conducting internal audits and management reviews, and addressing nonconformities. Maintaining certification includes periodic surveillance audits and a recertification assessment under the applicable programme. Surveillance checks continuing fulfilment of requirements; recertification assesses whether certification can continue into a further cycle. Neither is achieved simply by paying a fee.
Agree the audit schedule, expiry date and requirements for reporting significant changes with the certification body. Assign responsibility for deadlines, evidence and corrective actions. Check the programme rules and certificate scope instead of assuming that every type of certification has the same duration or follow-up arrangements.
How does accreditation differ from certification?
Knowing who issues the certificate leads to another question: how is that body’s competence recognized?
Accreditation concerns recognition of a conformity assessment body’s competence. When choosing a certification body, check its accreditation and whether its scope covers the required service. Accreditation concerns the body’s competence; the organization’s certificate concerns conformity within a defined scope.
For our maintenance company, the sequence starts with implementation, internal auditing and addressing gaps. Independent certification follows if needed. A certificate does not guarantee more customers or higher revenue.
Do not assume every standard can be used for certification. ISO 26000, for example, provides social responsibility guidance and is not a certification standard.
8. How do these concepts fit together?
Having explained each role, we can summarize the relationships:
| Concept | Role |
|---|---|
| ISO | Organizes the development of International Standards and publishes them. |
| Standard | Provides the relevant reference, requirements or guidance. |
| Implementation | Turns applicable requirements or guidance into actual organizational practice. |
| Conformity assessment | Uses evidence to demonstrate fulfillment of specified requirements. |
| Internal audit | Examines system conformity and effective implementation, helping identify gaps for action. |
| Certification | Provides written, independent assurance of conformity where this route applies. |
| Accreditation | Concerns the competence of the body performing conformity assessment. |
Conformity assessment is a broad concept, and auditing is one of the assessment techniques used within it. Implementation is the organization’s work; assessment activities examine it. Start by understanding the need and the standard, then implement it and determine the appropriate checks and need for certification.
Conclusion
Understanding ISO begins with the organization, then its standards, and finally their relevance to an organization’s actual needs. Implementation creates value when requirements become part of everyday work and practices and results are evaluated using evidence.
Internal auditing helps establish conformity and identify gaps requiring action. Certification adds independent assurance when needed, without replacing implementation or ongoing evaluation.
Before asking, “How do we obtain a certificate?”, start with a clearer question: what do we need to organize or improve, and which standard can help?