Certification process
A transparent, remote and predictable certification cycle. These are the six stages from application to recertification.
1. Application and quotation
Complete the application form indicating the standard, the desired scope, the number of people within the system and the logical sites. We analyse the information and send you a fixed written quotation — no obligation — within one business day. On acceptance, we formalise the certification agreement and assign the audit team.
2. Stage 1 audit — documentation review
The lead auditor remotely reviews the management system documentation: scope, policies, objectives, risk assessment and, for ISO/IEC 27001, the Statement of Applicability. The goal is to verify the system is designed in line with the standard and ready for the implementation audit. You will receive a report with findings and, where applicable, issues to resolve before Stage 2.
3. Stage 2 audit — implementation
A full audit of the system's operation, performed by video call in line with ISO 19011 and IAF MD 4 remote auditing techniques. It includes interviews with management and relevant staff, review of records and evidence, and remote observation of processes where applicable. The audit concludes with a closing meeting communicating findings and any nonconformities.
4. Certification decision and issuance
A certification committee independent of the audit team reviews the complete file — an impartiality principle required by ISO/IEC 17021-1 — and makes the certification decision. Any nonconformities must be resolved or properly planned before the decision. Once issued, you receive the signed certificate and a unique number verifiable at verify.borealcert.com.
5. Annual surveillance audits
During the 3-year cycle, surveillance audits — normally one per year — confirm the system continues to operate and improve. Changes, indicators, internal audits, management reviews and the treatment of previous nonconformities are examined.
6. Three-yearly recertification
Before the certificate expires, a recertification audit assesses the continued effectiveness of the system as a whole. On success, a new certificate is issued, starting another 3-year cycle.
Certificate validity
All certificates issued by BorealCert are valid for 3 years, conditional on satisfactory annual surveillance audits. Suspension or withdrawal of a certificate — for example due to an unresolved serious breach — is communicated to the holder and reflected in the public verification register.
100% remote audits
We apply internationally recognised remote auditing techniques: secure videoconferencing for interviews and meetings, documentation review over a protected exchange channel and remote access to evidence. Before accepting an engagement we assess your organisation's technological eligibility to ensure the remote audit can achieve every objective with the same rigour as an on-site audit.
Indicative timelines
| Profile | Typical timeline from application |
|---|---|
| Micro company / startup (1–15 people in scope) | 4–6 weeks |
| SME (15–100 people in scope) | 6–10 weeks |
| Larger or multi-site organisations | Per agreed audit programme |
Want a concrete timeline? Request your quotation and we will include estimated dates for Stage 1 and Stage 2.