ISO/UNDP 53001 certification and audit cycle: frequently asked questions

Third-party certification means that an independent certification body, with no ties to the audited organisation or its customers, assesses the management system for the Sustainable Development Goals (SDGs) against ISO/UNDP 53001. It audits under the rules of ISO/IEC 17021-1, and people who took no part in the audit then decide whether to grant the certificate.

First, second and third party

Auditing practice distinguishes three situations. A first-party audit is carried out by the organisation on itself: this is the internal audit required in clause 9 of the standard. A second-party audit is conducted by a customer at a supplier's premises, against the customer's own expectations. A third-party audit is entrusted to a body with no stake in either side.

Only the third kind leads to a certificate that others can rely on. The ISO/UNDP 53001 standard was written with this in mind: its requirements, set out in clauses 4 to 10, are worded so that they can be verified. Certification remains voluntary; no regulation makes it compulsory.

What independence brings, and where it stops

Independence has to be demonstrated, not merely claimed. ISO/IEC 17021-1 sets requirements for competence, consistent decisions and impartiality: the certification body does not advise the organisation it certifies, it identifies and handles anything that could sway its judgement, and the decision rests with people who did not audit.

The certificate attests that a management system meeting the requirements is in place and working within a stated scope. It does not measure how much the organisation contributes to the SDGs and is not a ranking. The full sequence is described on the certification process page.

The ISO/UNDP 53001 certification cycle lasts three years. It opens with a two-stage initial audit followed by a certification decision. Surveillance audits take place at least once per calendar year, the first within 12 months of the decision. A recertification audit is held before the certificate expires, and a new cycle then begins.

Milestones of the cycle

The cycle follows the pattern ISO/IEC 17021-1 lays down for every management system standard:

• initial audit, in two stages: stage 1 reviews how the system is designed and whether the organisation is ready, stage 2 assesses implementation and effectiveness;
• certification decision, taken by people who did not conduct the audit;
• surveillance audits, at least one per calendar year, the first within 12 months of the decision;
• recertification, carried out before the expiry date so that coverage is not interrupted.

Each audit produces a report and, where relevant, findings the organisation has to address.

Why a cycle rather than a one-off check

An SDG management system changes over time: priorities shift, indicators are revised, top management makes trade-offs. A single audit would say nothing about whether the system holds up. The cycle lets the auditor follow, year after year, how the organisation keeps its commitments and corrects its gaps.

Across the three years, every requirement of the ISO/UNDP 53001 standard is covered, even though each surveillance audit looks at only part of them. Some topics come back at every visit: management review, internal audit, handling of nonconformities, progress on objectives linked to the chosen SDGs, and use of the certificate.

At stage 1, the auditor examines how the SDG management system is designed and whether the organisation is ready for stage 2. Partly remotely, they review documented information and check the scope, the context analysis, the choice of priority SDGs, and whether an internal audit and a management review have been held or credibly scheduled.

A design review

Stage 1 does not yet try to prove that the system works. It establishes whether the system is built in a way that allows it to work. The auditor reads documented information, talks to those responsible and, depending on the case, visits the premises. They seek to establish:

• that the scope is defined and matches the activities actually carried out;
• that the analysis of context and interested parties has led to a reasoned choice of priority SDGs;
• that objectives and monitoring indicators have been set;
• that the internal audit and management review have taken place, or are realistically scheduled before stage 2.

The auditor also looks at how the organisation addresses SDGs 5, 8 and 13, which the ISO/UNDP 53001 standard requires every organisation to cover, according to BSI, publisher of the British edition.

What comes out of stage 1

Stage 1 ends with a report that flags issues likely to be graded as nonconformities at stage 2. These are warnings about design, not yet findings about effectiveness. Stage 1 also fixes the duration and plan of stage 2: which sites to visit, whom to interview, which processes to sample.

If the system is clearly not ready, stage 2 can be postponed. What follows is described in the question on the stage 2 audit.

At stage 2, the auditor assesses whether the SDG management system is actually implemented and effective. On site, and partly remotely, they meet top management and staff, sample records, observe practices and check that objectives linked to the priority SDGs are monitored, analysed and taken into account in decisions.

From design to evidence

Stage 2 answers a different question from stage 1: does the system deliver what it claims? The auditor starts from the issues raised at stage 1 and checks, requirement by requirement of the ISO/UNDP 53001 standard, that the arrangements described are applied. They look for dated, mutually consistent traces: an indicator tracked over several periods, a top management decision that refers to SDG results, an internal nonconformity followed through to closure.

Interviews cover several levels, not just the person who runs the system. An employee unaware of the chosen priorities, when the policy describes them as shared, is a lead the auditor follows up.

How stage 2 concludes

Stage 2 ends with a closing meeting at which the audit team presents its findings: conformities, major or minor nonconformities, observations. The report records them, together with the team's recommendation.

The auditor does not decide. The decision is taken afterwards by people who were not involved in the audit, once major nonconformities have been corrected and verified and the action plan for minor ones has been accepted. The two grades are explained in the question on major and minor nonconformities.

The surveillance audit checks, at least once per calendar year, that the SDG management system remains compliant and effective between initial certification and recertification. The first takes place within 12 months of the certification decision. Shorter than the initial audit, it covers part of the requirements plus a set of topics examined every time.

Topics reviewed at every surveillance audit

A surveillance audit does not repeat the initial audit. The certification body draws up a programme that covers every requirement of the ISO/UNDP 53001 standard over the whole cycle. Some subjects nonetheless come back each year:

• the internal audit and management review for the period;
• how nonconformities from the previous audit were handled, and whether the corrective actions worked;
• changes to objectives and indicators linked to the chosen SDGs;
• changes in structure, sites, activities or priorities;
• how the certificate and references to certification have been used;
• complaints received about the system.

What a surveillance audit can trigger

A surveillance audit produces the same kinds of findings as an initial audit. A minor nonconformity leads to an action plan, which is verified later. A major nonconformity not resolved within the set deadline can lead to suspension of the certificate, or even withdrawal: the rules are on the suspension and withdrawal page.

A surveillance audit that cannot take place in the planned calendar year because of the organisation carries the same consequences. Keeping the certificate depends on the regularity of follow-up as much as on its content.

Recertification takes place before the three-year certificate expires. The recertification audit examines the SDG management system as a whole and across the entire cycle: results achieved, changes in priorities, how successive nonconformities were handled. A new certification decision then opens a fresh three-year cycle.

A look back over the whole cycle

The recertification audit covers all requirements of the ISO/UNDP 53001 standard and resembles a full stage 2, enriched by history. The auditor rereads earlier reports, findings and their follow-up. They seek to establish that the system has matured. Were indicators tracked without gaps? Were the priority SDGs reconsidered when the context changed? Did management reviews lead to decisions?

An organisation that shows the same nonconformities at every visit, each time fixed on the surface, shows that the cause was never addressed. The auditor records this pattern, and it can justify a major nonconformity if the system's effectiveness is at stake.

Timing and continuity

Both the audit and the decision must come before the expiry date so that the new certificate takes over without a break. Major nonconformities must be corrected, and the correction verified, before that decision. If recertification is not completed in time, the certificate lapses; any conditions for restoring it are set out in the certification rules.

Recertification is also the moment to adjust the scope when activities have changed.

The scope of an ISO/UNDP 53001 certificate states the activities, sites and, where relevant, legal entities covered by the audited SDG management system. It is printed on the certificate. The auditor checks that it matches the scope the organisation defined and that it does not suggest wider coverage than actually exists.

From system scope to certificate wording

The ISO/UNDP 53001 standard asks the organisation to determine the scope of its own system, taking account of its context and interested parties: this is part of clause 4. The certification body then drafts the wording that will appear on the certificate, based on that scope and on what it actually audited.

The wording names activities, locations and, if needed, legal entities. Vague phrasing, or the name of a whole group when only one subsidiary was audited, is not accepted.

What the auditor checks

The auditor seeks to establish that the boundaries are justified. Leaving out an activity with a heavy bearing on the chosen SDGs, such as production when only head office is included, calls for a sound explanation. The auditor also checks that interfaces with excluded parts are controlled and that decisions taken outside the scope do not empty the system of substance.

The scope then drives audit duration, sampling and what the organisation may say publicly. It can change during the cycle, through scope extension or reduction.

For a multi-site organisation, the ISO/UNDP 53001 audit covers the central function that runs the SDG management system and a sample of sites. Sampling is allowed only if every site operates under the same system and a common authority. The auditor checks this central control and the consistency of local practice.

Conditions for sampling sites

A multi-site certificate requires a single management system that meets the ISO/UNDP 53001 standard across all sites: the same SDG priorities, objectives cascaded to each site, a shared management review, an internal audit that reaches every site, and a central function able to impose corrective action locally. The auditor checks these conditions first. Where each site runs independently, sampling is not justified and every site must be audited.

The organisation does not choose which sites are visited. The certification body combines a reasoned selection (size, activities, sites where SDG issues are most acute, previous nonconformities) with a random element.

When one site's finding affects all

In a multi-site system, a nonconformity found at one site raises questions about all of them. The auditor tries to determine whether it is isolated or reveals a weakness in central control. The organisation must then show that the cause has been examined at every site concerned, not only where the problem was seen.

The certificate lists the sites covered. A group made up of separate companies raises a different question: see certifying a group and its subsidiaries.

The duration of an ISO/UNDP 53001 audit depends mainly on the number of people within scope, the number of sites, the complexity of activities and the scope itself. The certification body sets it using a documented method, as ISO/IEC 17021-1 requires, then turns it into a quote. Cost follows from audit time, reporting and travel.

Factors taken into account

Audit time is not negotiated like a commercial package. It has to be enough to assess the system genuinely against the ISO/UNDP 53001 standard. The main parameters are:

• the number of people working within scope, including part-time staff and regular subcontractors;
• the number of sites and the nature of the activities at each;
• the range of processes that bear on the chosen SDGs;
• an existing system certified to another standard, which may justify a combined audit;
• working languages and any need for an interpreter.

Cutting audit time below what the scope demands would weaken the certificate's value.

How the quote is presented

The quote sets out audit time for each step of the cycle: stage 1, stage 2, surveillance audits and recertification. Travel and, where needed, interpreting costs are shown separately. Gardiant Certification's fees are set on a quotation basis: audit time is calculated for each organisation and stated in the quote.

A quote request receives a reply within 2 working days, and the quote remains valid for 3 months. A wide gap between two quotes for the same scope often comes from different estimates of headcount or number of sites.

Yes. An organisation certified to ISO/UNDP 53001 can ask for its scope to be extended to new sites, activities or entities during the cycle. The certification body reviews the request, carries out an extension audit, on its own or alongside a surveillance audit, then takes a new decision. The amended certificate normally keeps the current expiry date.

What the extension audit checks

The auditor focuses on what is entering the scope. They check that the new site or activity is genuinely part of the existing system and meets the requirements of the ISO/UNDP 53001 standard: an updated context analysis, priority SDGs reconsidered in light of the new issues, objectives and indicators cascaded, and inclusion in the internal audit programme and the management review.

A recent acquisition attached on paper but still run under its former rules does not meet these conditions. The auditor finds this out by interviewing the teams concerned and looking for records produced under the shared arrangements.

Duration and decision

The length of an extension audit depends on the size of the addition. A modest extension can be handled during a surveillance audit already planned; a large one justifies a dedicated audit. As with any certification decision, the decision to extend is taken by people who did not audit.

Scope reduction follows the opposite logic: the organisation asks for it, or the certification body decides on it when part of the scope no longer meets the requirements. See also the scope of a certificate.