Key takeaways
- 1the certified management system has persistently or seriously failed to meet certification requirements, including those on its effectiveness;
- 2the client does not allow surveillance or recertification audits at the required frequencies;
- 3the client has asked for a suspension itself.
A certificate that was valid when you approved a supplier can be suspended, reduced in scope or withdrawn before its expiry date, and the copy you hold does not change when that happens. ISO/IEC 17021-1:2015 sets out when a certification body takes each decision. To keep up, re-check status at moments you fix in advance: at the certification body's own register first, IAF CertSearch second.
Three decisions a certification body can take during the cycle
A certification body maintains certification on evidence that the client continues to meet the standard's requirements (§9.6.1). Clause 9.6.5 covers what happens when it does not. The body must have a policy and documented procedures for suspension, withdrawal and reduction of scope, and must specify the actions that follow (§9.6.5.1).
Suspension. §9.6.5.2 gives examples of cases in which the certification body shall suspend:
- the certified management system has persistently or seriously failed to meet certification requirements, including those on its effectiveness;
- the client does not allow surveillance or recertification audits at the required frequencies;
- the client has asked for a suspension itself.
Under suspension, the certification is "temporarily invalid" (§9.6.5.3).
Withdrawal. If the issue behind a suspension is not resolved in the time the certification body has set, the result is withdrawal or reduction of scope (§9.6.5.4). Misuse of certification documents, marks or audit reports can also lead to suspension or withdrawal (note to §8.3.5).
Reduction of scope. Where the client has persistently or seriously failed to meet the requirements for part of its scope, the certification body reduces the scope to exclude those parts, in line with the standard used for certification (§9.6.5.5). The rest stays certified.
These are decisions, not audit results, taken by people other than those who carried out the audits (§9.5.1.1).
How long a suspension lasts
The standard does not fix a period. The certification body restores the certification once the issue is resolved, and it sets the time allowed for resolving it (§9.6.5.4). A note to the clause says that in most cases a suspension would not exceed six months. It is a note, not a limit. Meanwhile the body may audit the client at short notice or unannounced as follow-up (§9.6.4.2).
A suspension therefore ends in one of three ways: restored, reduced or withdrawn.
What the certified organization may and may not do
The standard's own rule is §9.6.5.3: temporarily invalid. The detail is set by each certification body, in its policy on suspension (§9.6.5.1) and in its requirements for references to certification. Through legally enforceable arrangements, the certification body requires the client to follow those requirements when it refers to its certification status, and not to make or permit any misleading statement about its certification (§8.3.4 a and b). After a withdrawal it stops using advertising that refers to certification, as the body directs (§8.3.4 d); after a reduction it amends its advertising (§8.3.4 e).
CAS's certification rules state the suspension case directly: the client stops all use of the certificate and the certification mark and stops referring to the certification, and CAS makes the suspended status publicly accessible.
What the organization can do is resolve the issue, so that the certification is restored (§9.6.5.4), or appeal the decision (§9.7.1).
What a certification body makes known about status
Its process, without being asked. §8.1.1 b) requires public information on how the body suspends, restores and withdraws certification and reduces scope, among its other processes. A buyer can read in advance what a given body does. CAS publishes its rules at cas.com.eg/policies/certification-rules.
The status of a given certificate, on request (§8.1.2 b), which the body may also publish, for example on its website (Note 2). The principle of openness (§4.5.1) covers certification status too, including suspension, restoration and withdrawal, and what a body provides to the marketplace shall be accurate and not misleading (§8.1.3).
Where the status shows, and when
The certification body's register is its own current record. CAS's register at cas.com.eg/certsearch shows four states: valid, suspended, withdrawn and expired. Each result shows the time of the check, and the verification record you can download is dated.
IAF CertSearch holds certification status as active, suspended or withdrawn (IAF MD 28:2023 §4.2.1 x). Certification bodies upload at least once a month (§4.2.4), and the date of their last update is displayed (note to §4.2.5). A decision taken after that date may not be there yet.
The certificate. After a reduction of scope, the certification documents show the effective date of the reduction (§8.2.2 b), and revised documents must be distinguishable from obsolete ones (§8.2.2 i). A suspension or a withdrawal changes the record, not the copy you were sent.
When to check again
Fix the moments in advance:
- At contract award, for the status on the day you commit.
- At each renewal of the supplier approval. If your organization is certified to ISO 9001:2015, clause 8.4.1 already requires criteria for the re-evaluation of external providers, so that review is a moment you have already fixed.
- Before you rely on the certificate for a tender, or pass it on to your own customer.
- Once a year, between the other checks. Surveillance audits take place at least once a calendar year outside recertification years (§9.1.3.3), and not allowing them is one of the listed grounds for suspension.
- When the printed expiry date passes, to obtain the renewed certificate.
Keep the date and the source of each check in the supplier file.
What this means for you
If you are a buyer: put these checks in your supplier calendar. Use the certification body's own register for the decision, and treat IAF CertSearch as a second source, current to its last-update date.
If you are certified: under suspension your certification is temporarily invalid, and a customer who asks your certification body is told the status (§8.1.2 b). Your certification body's rules say what you must stop using.
If you hold a suspended CAS certificate: CAS confirms the conditions for lifting the suspension, and resolving the issue within the time set restores the certification.
This is generic information about the requirement, not advice on any particular management system.
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next