Frequently asked questions

For a first-time (initial) certification, the typical timeline is 3–6 months from application to certificate, depending on the size and complexity of your organisation and the readiness of your management system. The process has two stages: Stage 1 (document review and readiness assessment, usually 1–2 days on-site or remote) and Stage 2 (full implementation audit, typically 1–5 days depending on your organisation size, calculated under the audit-time rules for the standard, such as Global ACI TECH-3-004 (formerly IAF MD 5) for ISO 9001, 14001 and 45001). After both stages, CAS conducts an independent technical review before issuing the certificate. Each step and its length are set out in How long does ISO certification take.

Stage 1 (Readiness Assessment) reviews your documentation, confirms the scope of certification, and checks whether your management system is ready for Stage 2. It identifies any gaps that must be addressed before the full audit.

Stage 2 (Certification Audit) is the full on-site audit that evaluates whether your management system is effectively implemented and meets all requirements of the standard. Nonconformities identified must be corrected before the certificate is issued.

Audit time is calculated under the rules for each standard: Global ACI TECH-3-004 (formerly IAF MD 5) for ISO 9001, 14001 and 45001; ISO 22003-1:2022 for ISO 22000; ISO 50003:2021 for ISO 50001. The calculation is based on: the effective number of personnel in scope, the complexity/risk category of your activities, the number of sites, and any applicable adjustments for integrated management systems. CAS provides the full audit time calculation with your formal proposal.

Yes. CAS conducts integrated audits covering several ISO management system standards at the same time, in accordance with Global ACI TECH-3-008 (formerly IAF MD 11). The audit time of each standard is calculated first; TECH-3-008 then adjusts the combined time according to how far your management system is integrated and how far the audit team can audit the standards together. The combined audit time can be reduced by up to 20%, and it can also increase where the integrated audit is more complex — it is an audit-time rule applied to every client, not a discount. You receive separate certificates for each standard.

After a successful Stage 2 audit, the audit findings are independently reviewed by a CAS technical reviewer who was not involved in the audit. If the review is satisfactory, CAS issues the certificate (valid for 3 years). The certificate includes a unique QR code for online verification. The initial certification is year 1 of the three-year cycle; surveillance audits in years 2 and 3, the first no later than 12 months after the certification decision, maintain the certificate, and a recertification audit before the certificate expires opens the next cycle. What keeps a certificate valid, and what ends it early, is explained in How long is an ISO certificate valid, and how is it renewed?

A surveillance audit is a shorter, targeted audit held in years 2 and 3 of the three-year certification cycle — at least once each calendar year, the first no later than 12 months after the certification decision. It verifies that your management system continues to meet the requirements of the standard and that previously identified nonconformities have been addressed. Surveillance audits are usually 1–2 days depending on your organisation size.

A nonconformity (NC) is a finding where your organisation has not met a specific requirement of the standard. Minor NCs require a documented corrective action plan submitted within a defined timeframe. Major NCs require evidence of correction before the certificate can be issued. CAS auditors clearly explain each NC and the requirement not met; analysing the root cause and deciding the corrective actions remain the organisation's responsibility, because CAS does not provide consultancy.

Yes, if it is a valid accredited certificate. Choose “Transferring from another certification body” when you request certification, and give that body's name, its accreditation body, the certificate number and its expiry date. CAS then carries out a transfer review under Global ACI TECH-3-002 (formerly IAF MD 2) before accepting the certification: it considers the reason for transfer, the validity and scope of the existing certification, and any outstanding nonconformities or complaints, so that the certification cycle continues. An expired, suspended or non-accredited certificate cannot be transferred — in that case, apply as a “New client”.

Yes. CAS is accredited by the Egyptian Accreditation Council (EGAC) under ISO/IEC 17021-1:2015 as a Management System Certification Body (CAB #012418, schedule 012418 B). EGAC is a signatory to the IAF Multilateral Recognition Arrangement (MLA), which means accredited CAS certificates for ISO 9001, 14001, 45001, 22000 and 50001 are recognised by signatory accreditation bodies in over 100 economies; ISO 22301 is EGAC-accredited but outside EGAC's IAF MLA scope. CAS is also registered with the Egyptian Organization for Standardization (EOS) as CB176. The six standards, and who usually needs which, are set out in Types of accredited ISO certificates.

The IAF (International Accreditation Forum) Multilateral Recognition Arrangement (MLA) is a network of accreditation bodies from more than 100 economies that mutually recognise each other's accreditations. Because EGAC is a signatory, a CAS certificate issued under EGAC accreditation for a standard within EGAC's IAF MLA scope (ISO 9001, 14001, 45001, 22000 and 50001) is recognised as equivalent to those of accredited bodies in any signatory economy — including the EU, UK, USA, GCC and Southeast Asia — for voluntary schemes. Where a standard or specification requires accreditation under Regulation (EC) 765/2008 (Accredia or another EA MLA signatory), check the requirement with whoever asks you for the certificate.

Yes. Every CAS certificate includes a unique QR code. Scanning it (or visiting cas.com.eg/certsearch/) allows instant online verification of the certificate number, scope, standard, and validity dates. Accredited CAS certificates can also be verified on the IAF CertSearch database at iafcertsearch.org.

CAS's EGAC accreditation (schedule 012418 B) covers 32 IAF technical sectors for ISO 9001, ISO 14001 and ISO 45001 — including manufacturing, construction, food and beverage, chemicals, healthcare, information technology, education and transport. ISO 22000 is accredited across the food-chain categories of ISO 22003-1:2022, and ISO 50001 and ISO 22301 are accredited without IAF technical-code restriction. The full per-standard scope is published on our Accreditation page. Contact us to confirm coverage for your specific sector.

Amendment 1:2024 (Climate action changes) was published in February 2024 and applies to ISO 9001:2015 and to a large number of other ISO management system standards. It adds two requirements: (1) §4.1 — The organisation shall determine whether climate change is a relevant issue. (2) §4.2 — A new NOTE stating that relevant interested parties can have requirements related to climate change. CAS applies these requirements in all certification audits.

No. ISO 21001:2025 is the Second Edition (published July 2025) and cancels/replaces ISO 21001:2018. The main change is that assessment-related text has been revised to reflect current best practices in educational assessment. Organisations certified to ISO 21001:2018 should plan transition audits to the 2025 edition. CAS can advise on transition timelines.

ISO 37001:2025 is the Second Edition (published February 2025), cancelling and replacing ISO 37001:2016 (First Edition). Key changes: (1) Climate change subclauses added. (2) Compliance culture requirements strengthened. (3) Conflicts of interest explicitly addressed. (4) The anti-bribery function concept clarified. (5) Updated to the latest ISO Harmonized Structure. All new certifications are now to the 2025 edition.

ISO 55001:2024 is the Second Edition (published July 2024), cancelling and replacing ISO 55001:2014. Key changes: (1) Adoption of ISO Harmonized Structure for easier integration with other ISO standards. (2) New subclauses on the Strategic Asset Management Plan (SAMP) and asset knowledge management. (3) Lifecycle management explicitly included in operational planning. (4) Clear distinction between addressing risk vs. opportunities. (5) "Preventive action" renamed to "predictive action" (§10.3). (6) Stronger leadership requirements.

ISO 28000:2022 is the current Second Edition (March 2022), published by ISO/TC 292 (Security and resilience); it specifies requirements for a security management system. ISO 28001:2007 (Supply Chain Security) is a different standard: it sets out best practices for implementing supply chain security, assessments and plans. Compared with the first edition (ISO 28000:2007), the 2022 edition adopts the PDCA management system model, adds alignment with ISO 31000 (risk management) in Clause 4, and strengthens Clause 8 with security strategies, security plans including response and recovery structures aligned with ISO 22301 (business continuity). CAS offers certification against both standards.

ISO 37001 addresses anti-bribery management systems specifically. ISO 37301:2021 is broader — it covers all types of compliance obligations including legal, regulatory, contractual, and ethical requirements across the whole organisation. ISO 37301:2021 replaced ISO 19600:2014, making compliance management certifiable for the first time. CAS audits ISO 37301 per ISO/IEC TS 17021-13:2021.

CAS is the exclusive Egypt partner of Global Halal Control Office (GHC); the certificate is issued by GHC and Halal certification is outside CAS's EGAC accreditation scope. Our GHC Halal certificate covers four standards simultaneously: (1) OIC/SMIIC 1:2019 — the standard of the Standards and Metrology Institute for Islamic Countries, adopted across 57 OIC member states. (2) GSO 2055-1:2015 — Gulf Standardization Organization, required for GCC market access. (3) UAE.S 2055-1:2015 — UAE National Standard, required for UAE imports. (4) BPJPH Decree Nr. 20 of 2023 — Indonesian BPJPH regulations for Indonesia market access. GHC also certifies against the full OIC/SMIIC halal series: cosmetics (OIC/SMIIC 4), food service (6), halal tourism and wellness spa (9, 8), halal supply chain (17-1, 17-2, 17-3), halal quality management (18), edible gelatine (22), animal feed (23), food additives (24), pharmaceuticals (50-1) and hygiene and sanitation management (51).

GHC Halal certification through CAS covers: Food and beverages (all categories), Meat and poultry (Zabiha/Halal slaughter verification), Cosmetics and personal care products, Pharmaceuticals and dietary supplements, Food ingredients and additives, and Logistics/cold chain operations storing or transporting Halal products.

CAS is the exclusive North Africa partner of KCJ — Kosher Certification Jerusalem, operating since 1989; the certificate is issued by KCJ and is outside CAS's EGAC accreditation scope. The KCJ symbol is generally recognised by kosher-observant communities and buyers in the USA and Europe; check the requirements of your individual buyer. It covers Pareve, Meat (Fleishig), Dairy (Milchig), and Passover designations as applicable to your products.

The GHC Halal certification process typically takes 4–8 weeks from application to certificate, depending on the complexity of your product range and number of ingredients requiring review. The process: (1) Ingredient review and supplier declarations, (2) Site audit by a GHC-qualified auditor, (3) GHC technical approval, (4) Certificate issuance. Certificates are valid for 12 months with annual renewal. Who issues the certificate and which standards it covers are explained in Halal certification in Egypt.

SA8000:2026 is the current edition (published January 2026) of the social accountability standard developed by Social Accountability International (SAI). It covers nine elements: child labour, forced labour, health & safety, freedom of association, discrimination, disciplinary practices, working hours, remuneration, and management systems. It is applicable to any organisation regardless of size, sector, or location. CAS issues SA8000 certificates By CAS, outside its EGAC accreditation; they are verifiable on CAS CertSearch. They are not issued under SAAS accreditation: where a buyer asks specifically for an SA8000 certificate issued under SAAS accreditation, a certificate issued By CAS does not meet that requirement, so check your buyer's requirement before applying.

SA8000 is a certification standard — CAS issues a 3-year certificate By CAS, outside its EGAC accreditation, verifiable on CAS CertSearch; it is not issued under SAAS accreditation and does not appear in the public SA8000 list of certified facilities. SMETA is an audit methodology (not a certification) — it produces an audit report shared on the Sedex platform, with no pass/fail certificate. Both evaluate social accountability, but SA8000 requires formal corrective actions and involves ongoing surveillance, while SMETA is used for buyer supply chain visibility and transparency.

SMETA 7.0 (published August 2024) is the current version of the Sedex Members Ethical Trade Audit methodology. Key changes: (1) Issue titles were refined with fixed criticality levels (Critical, Major, Minor). (2) New "Collaborative Action Required (CAR)" finding type for systemic issues that require buyer-level intervention (e.g. living wage, freedom of association in restricted environments). (3) Enhanced focus on identifying root causes of non-compliances rather than just documenting them.

CAR is a new finding type introduced in SMETA 7.0. It identifies systemic issues where the supplier facility alone cannot remediate without support from buyers, brands, or other stakeholders in the supply chain — for example, living wages, freedom of association where legally restricted by national law, or structural working hours issues. A CAR finding triggers buyer engagement rather than solely supplier corrective action.

For brands that are SLCP signatories (including H&M, Levi's, PVH, Patagonia, and 200+ others), the SLCP Converged Assessment Framework (CAF) data can replace SMETA audit reports. However, some brands require SMETA specifically, and SLCP is a data collection tool rather than an audit — not a certificate or pass/fail assessment. CAS advises on which is required based on your specific buyer requirements.

CAS certificates can be verified in two ways: (1) Scan the QR code printed on the physical or digital certificate — it links directly to the CAS CertSearch portal. (2) Visit cas.com.eg/certsearch/ and enter the certificate number. The system confirms the certificate number, certified organisation, standard, scope, issue date, and expiry date in real time. For any ISO certificate, not only ours, see Three steps to verify any ISO certificate before accepting a supplier.

Yes. CAS certificates issued under EGAC accreditation can be verified on the IAF CertSearch database at iafcertsearch.org. This global database lists certificates from certification bodies whose accreditation bodies are IAF MLA signatories, confirming the validity and accreditation status of the certificate.

Every CAS certificate shows: Organisation name and registered address, Scope of certification (activities/products/services covered), Applicable standard and edition (e.g. ISO 9001:2015 + Amd.1:2024), Certificate number, Date of initial certification, Date of issue, Expiry date, Audit cycle (surveillance/recertification schedule), and a unique QR code for online verification. Accredited certificates also carry the EGAC accreditation mark and, for ISO 9001, 14001, 45001, 22000 and 50001, the IAF MLA mark (ISO 22301 carries the EGAC mark without the IAF MLA mark). Certificates issued “By CAS”, outside the accreditation scope, carry the CAS mark only.

If you believe a certificate is fraudulent, has been misused, or is presented after its expiry date, please contact CAS immediately at info@cas.com.eg or via our Complaints form. You can also file a complaint directly through the CAS CertSearch system. CAS will investigate all reports and take appropriate action in accordance with ISO/IEC 17021-1:2015 §9.8.

CAS charges per audit: an administrative fee and a technical review fee, once for each audit however many standards it covers, plus the audit man-days. Each certificate also carries a certification fee every year — the full fee in year 1 of each cycle and a reduced fee in each surveillance year. The man-days are not a commercial choice: they are calculated under the rules for each standard (Global ACI TECH-3-004, formerly IAF MD 5, for ISO 9001, 14001 and 45001; ISO 22003-1:2022 for ISO 22000; ISO 50003:2021 for ISO 50001) from the effective number of personnel in scope, the complexity or risk of your activities and the number of sites, so the same facts always give the same man-days. CAS sends a written proposal, usually within 2 business days of your application, showing every fee and the audit-time calculation. The method is set out on our Certification fees page, and what drives audit time is explained in What actually determines the cost of ISO certification.

No. Your written proposal lists every fee, line by line, for each audit: the administrative and technical review fees, the audit man-days, the certification fee for each certificate and any travel days. What is not included is stated in the proposal wherever it applies: tickets and local transport, visas, accommodation and meals of the audit team, a technical expert or translation where the audit needs one, bank and money-transfer charges (paid by the sender), and VAT where it applies. The man-days change only if your facts change (personnel, sites, scope or shifts), when they are recalculated and a revised proposal is issued; extra audit time the standards require during an audit is charged at your agreed rates.

Where travel and accommodation apply, they are handled exactly as the proposal states, and anything CAS charges for them is invoiced in writing. They are never settled privately with an auditor, and no fee or expense is ever paid to an individual auditor: every payment is made to CAS itself — by bank transfer, cash or cheque — against an official CAS invoice and receipt. See our Gifts, Hospitality & Anti-Bribery policy.

No. Certification runs in a three-year cycle, and each audit of the cycle is charged on its own. Year 1 is the initial certification (Stage 1 + Stage 2); years 2 and 3 are the two surveillance audits, the first no later than 12 months after the certification decision; the recertification audit, held before the certificate expires, opens the next cycle and is year 1 of that cycle. Each audit carries its administrative and technical review fees and its man-days, and each certificate a certification fee every year — the full fee in year 1 and a reduced fee in each surveillance year. You may contract year by year or for the whole cycle; either way, payment is due within 7 days of signing the agreement (or before the audit, if sooner), and audits are scheduled once it is received. Your proposal sets out every audit it covers, line by line (the whole cycle if you contract for the whole cycle), so you can plan your budget.

No. CAS gives no discounts: to protect integrity, impartiality and non-discrimination, every client invoiced by CAS pays the prices of the CAS fees policy, set by the same rules for everyone; clients of CAS offices and agencies outside Egypt pay that office's approved prices. When several standards are audited together, Global ACI TECH-3-008 (formerly IAF MD 11) adjusts the combined audit time according to how integrated your management system is and how far the audit team can audit the standards together: the combined time can be reduced by up to 20%, or it can increase where the integrated audit is more complex. That is an audit-time rule applied to every client, not a discount, and an integrated audit is one audit, with one administrative fee and one technical review fee. The only exception to “no discounts” is a charitable contribution for government bodies and NGOs, reviewed by CAS's impartiality committee and decided by the CEO; it never reduces the audit man-days. See Certification fees.