What is ISO certification?

ISO certification is a statement from an independent certification body that your organization's management system meets the requirements of a specific ISO standard, such as ISO 9001 for quality management. The statement is based on an audit. It applies to a defined scope, and it is kept valid by follow-up audits. It is not a licence, a legal approval or a prize, and the body that issues it is not ISO.

Who does what

Three kinds of organization are involved. Mixing them up is the most common source of confusion, and of misleading claims.

ISO develops standards

ISO, the International Organization for Standardization, brings experts together to write standards. It publishes the text of ISO 9001, ISO 14001 and the rest. ISO does not audit companies, does not issue certificates and does not approve anyone. That is why we say "certified to ISO 9001" and avoid "ISO certified" or "certified by ISO".

Certification bodies audit and decide

A certification body is an independent organization that audits your management system against a standard and makes the certification decision. It issues the certificate. Requirements for these bodies are set in ISO/IEC 17021-1, which covers their competence, consistency and impartiality. In Iraq, as elsewhere, you choose which certification body to work with, and you can ask several for a quote. Our guide on how to choose a certification body covers the questions to ask.

Accreditation bodies accredit certification bodies

An accreditation body checks that a certification body is competent to do its work for a defined scope. Accreditation is a separate step from certification. Internationally, accreditation bodies cooperate through Global Accreditation Cooperation (Global ACI), which took over the work of the International Accreditation Forum (IAF) and the International Laboratory Accreditation Cooperation (ILAC) on 1 January 2026. For a plain explanation of why this matters to buyers, see accreditation explained.

What is being certified

The thing certified is a management system: the way your organization plans, runs, checks and improves its work. ISO 9001 certification does not apply to a product, or to a person. A certificate says that your system, for the activities and sites in its scope, met the standard at the time of the audit and has been maintained since.

For example, a contractor with three sites might be certified to ISO 9001 for "civil works and building maintenance" at two of them. The third site is simply outside the certificate scope. That is permitted, but it must be described accurately wherever the certificate is quoted.

What a certification journey usually involves

The details depend on the standard and the certification body, but the pattern is similar:

1. You decide which standard fits your goal. The Find my standard tool can help.
2. You gather basic information and request quotes from independent certification bodies.
3. You build or tidy the management system, with or without outside help.
4. The certification body audits in two stages. The first looks at readiness and documentation, the second at how the system works in practice.
5. If the audit shows the requirements are met, the body decides on certification and issues a certificate.
6. The certificate is kept valid through surveillance audits and renewed by recertification. See surveillance and recertification.

Nothing in this list is a promise of a result or a timeline. Outcomes depend on your organization and the certification body's decision. For typical cost drivers and timing factors, read certification cost and certification timeline.

What certification does not do

It does not guarantee better sales, contract wins or tender acceptance. It does not prove that you comply with the law. It does not mean a product is safe or high quality, only that the system behind it is managed to a recognized standard. Some buyers or tenders ask for it; the certification for tenders page explains what to check. For legal or regulatory requirements in Iraq, check with the buyer, the regulator or the tender document.

Where MIYAAR CONNECT fits

MIYAAR CONNECT is an independent discovery and inquiry platform. We help you understand which standard may fit and connect your inquiry with relevant independent certification bodies. We do not audit, certify, accredit or issue certificates. You can read more on how it works.

Common first questions

• Is ISO certification compulsory? Not as a general rule. Some buyers, tenders or regulators may ask for it. Check the specific requirement.
• Do all standards lead to a certificate? No. Some, such as ISO 26000 and ISO 31000, give guidance only. Laboratories are accredited to ISO/IEC 17025 rather than certified. See the standards catalogue.
• Where do I start? With a clear goal. Read which ISO standard does my company need, then what to prepare before requesting a quote.