Background: Some CABs are issuing management system certificates with a one-year validity/expiry, without including an expiry or recertification date consistent with the 3-year certification cycle. This is done to ensure the client pays for the following surveillance or recertification, and to reduce the risk of them misusing a 3-year certificate. The CABs maintain that they are consistent with the recertification cycle, as the 1-year certificate does not exceed 3 years.
Question: Is this approach consistent with the recertification cycle and therefore conforming with clause 8.2.2 part c) of ISO/IEC 17021-1:2015?
March 2026
NO. Clause 8.2.2c) of ISO/IEC 17021-1 explicitly stipulates that the certification document(s) shall identify the expiry date or recertification due date consistent with the recertification cycle. According to the given case, the certification cycle is three years (see clause 9.1.3.2, plus NOTE for scheme-specific certification cycle other than three-years).
Therefore, the three-years certification cycle shall be clearly denoted on the certification document(s) by indicating the date of completion of the certification cycle. This date may be referenced on the certification document(s) as either recertification due date or expiry date. NOTE: Other information such as the annual performance of surveillance audits as a precondition for the maintenance of the validity of the certification may be included on the certification document(s) and a reissue of the certification document(s) may be acceptable as an indication of fulfilment of the preconditions for the maintenance of certification. However, these arrangements shall not be used in a way that consistency of the duration of the certification with the three-years recertification cycle is disregarded.