ISO/UNDP 53001 and other frameworks: frequently asked questions

ISO 14001 covers environmental management: environmental aspects, compliance obligations, pollution prevention. ISO/UNDP 53001 covers an organisation's contribution to the Sustainable Development Goals (SDGs), which also span social, economic and governance dimensions. Both follow the ISO harmonized structure and can be audited together, but neither certifies the other.

Two different audit subjects

An ISO 14001 auditor seeks to establish that the organisation controls its environmental impacts and meets its environmental obligations. An ISO 53001 auditor seeks to establish that it has chosen priority SDGs in light of its context, set objectives to contribute to them, and that its governance takes them into account. The environment may be part of this, for instance through SDG 13, but alongside equality, decent work or partnerships.

ISO 14001 certification therefore does not imply conformity with the ISO/UNDP 53001 standard, nor the reverse.

What can be shared

The harmonized structure makes many mechanisms common: context analysis, management review, internal audit, control of documented information, handling of nonconformities. An ISO 14001-certified organisation already has these arrangements; the auditor checks that they have been extended to SDG topics and are not confined to the environment.

Environmental data tracked for ISO 14001 can feed SDG indicators; the auditor then checks their relevance to the objectives set. See how the standard fits with other standards and the combined audit.

ISO 9001 targets the ability to deliver conforming products and services and to satisfy customers; ISO/UNDP 53001 targets the contribution to the SDGs. At audit, they share the harmonized structure: management review, internal audit, corrective action. The auditor checks that these mechanisms, already well established for quality, also deal with SDG priorities.

A shared process logic

ISO 9001 has made many organisations familiar with the process approach and continual improvement. The ISO/UNDP 53001 standard builds on that foundation but changes its subject. The question is no longer only how to satisfy the customer, but how the organisation's activities contribute to the chosen SDGs, or work against them.

An ISO 53001 auditor can use the existing process map. They check that the processes with a bearing on the priority SDGs, such as purchasing, design or human resources, include matching criteria and tracked indicators.

Common gaps

In an ISO 9001-certified organisation, the risk is adding the SDGs as one more chapter of the quality manual without changing decisions. The auditor spots this: a management review agenda that mentions the SDGs with no decision following, SDG objectives without an owner or deadline, an internal audit that has never covered them.

Likewise, the interested parties identified for quality, mainly customers and suppliers, are no longer enough: the SDGs widen the circle to employees, local communities and future generations. For the environment, see ISO 14001.

ISO 45001 covers occupational health and safety; ISO/UNDP 53001 covers the contribution to the SDGs. They meet on working conditions, which relate in particular to SDG 8 and SDG 3. They share the harmonized structure and can be audited together, but ISO 45001 certification does not amount to conformity with ISO 53001.

An overlap on decent work

According to BSI, publisher of the British edition, SDG 8, decent work and economic growth, is among the goals that the ISO/UNDP 53001 standard requires every organisation to address. An ISO 45001-certified organisation has control of occupational risks, worker consultation and workplace accident indicators. These can feed its SDG system.

The ISO 53001 auditor nonetheless checks that the subject is not reduced to safety. Decent work also covers employment, pay, social dialogue and the subcontracting chain. The auditor seeks to establish that the organisation has examined these dimensions.

What a combined audit changes

When both standards are audited together, common elements (context, leadership, internal audit, management review, corrective action) are examined once, from the angle of both standards. Specific requirements are still assessed separately and give rise to separate findings.

A health and safety nonconformity can also affect the SDG system if it shows that commitments on SDG 8 are not reflected in practice. The auditor then grades the finding against each standard. See the combined audit and ISO 9001.

ISO 26000 is a guidance standard on social responsibility: it makes recommendations, with no verifiable requirements. It therefore cannot serve as a basis for certification. ISO/UNDP 53001 is a management system requirements standard, written to be audited by a third party. The two remain compatible in substance, and one can inform the other.

Recommendation versus requirement

A guidance standard says what it is advisable to do; a requirements standard says what must be done and makes it possible to verify that it has been done. An auditor can raise a nonconformity only against a requirement. An assessment based on ISO 26000 remains possible, but it does not lead to certification within the meaning of ISO/IEC 17021-1.

The ISO/UNDP 53001 standard sets out what an organisation must establish to manage its contribution to the SDGs. Every requirement can be tested against evidence, which is what makes it certifiable.

What ISO 26000 brings to an ISO 53001 system

The core subjects of ISO 26000 (organisational governance, human rights, labour practices, the environment, fair operating practices, consumer issues, community involvement) overlap widely with the SDGs. An organisation that has drawn on it has often already identified its stakeholders and key issues.

The ISO 53001 auditor does not give credit for that approach as such. They check whether its results have been built into the system: context analysis, choice of SDGs, objectives. See related standards and the difference from a CSR label.

Not as an audit criterion. The auditor assesses conformity with the requirements of ISO/UNDP 53001 alone; ISO/UNDP PAS 53002:2024 remains a guidance document. No finding can be based on it. When an organisation has drawn on it, the auditor examines what it has produced in the system, as with any other source.

The audit criterion: the certifiable standard, and nothing else

A nonconformity must cite a requirement. PAS 53002 makes recommendations and imposes nothing. An organisation that has not followed one of them therefore commits no nonconformity, as long as the requirements of the ISO/UNDP 53001 standard are met. Conversely, applying the PAS to the letter does not prove conformity: the auditor checks each requirement against documents and in interviews.

The same rule applies to UNDP's SDG Impact Standards, with which the PAS is aligned, and to the future ISO/UNDP 53002 guidance: they are aids, not certification criteria.

What the auditor looks at in a PAS-inspired approach

Many elements of a system can come from the PAS: a method for ranking SDGs, a way of involving senior leaders, a shared vocabulary. The auditor does not judge them by their origin. They seek to establish that these elements deliver what the standard requires: a reasoned choice of priority SDGs given the context, monitored objectives, governance decisions that take them into account.

Nor does an audit report recommend using the PAS: that would be advice. For more on the guidance itself, see the page on ISO/UNDP PAS 53002.

Yes. Thanks to the ISO harmonized structure, an ISO/UNDP 53001 audit can be combined with an ISO 9001, ISO 14001 or ISO 45001 audit when the same certification body covers those standards. Common elements are examined once, the requirements specific to each standard separately. Each standard leads to its own findings and its own certificate.

What is shared and what is not

A combined audit covers an integrated system, or several systems that share arrangements. Items typically examined jointly are:

• the analysis of context and interested parties;
• leadership and management review;
• internal audit and handling of nonconformities;
• control of documented information.

Requirements specific to the ISO/UNDP 53001 standard, such as the choice of priority SDGs and the monitoring of matching objectives, are assessed by an auditor competent for this standard. Combining does not lower the bar: the auditor checks that each standard is fully covered.

Duration and cycles

A combined audit can take less time than the sum of separate audits, since some elements are examined only once. The reduction depends on the actual degree of integration, which the certification body assesses before drawing up its quote.

Certification cycles can be aligned so that surveillance audits and recertifications coincide. If the standards are certified by different bodies, combining is not possible. See the duration and cost of an audit and the links with ISO 14001.

No, not directly. The EU Corporate Sustainability Reporting Directive (CSRD) requires sustainability reporting, limited since the Omnibus I directive to companies with more than 1,000 employees and turnover above €450 million. ISO/UNDP 53001 certifies an SDG management system. Certification is not a sustainability report, but it can strengthen the processes that feed one.

Two different logics

The CSRD is a legal obligation to disclose information. The ISO/UNDP 53001 standard is voluntary and requires active management: choice of priorities, objectives, governance decisions. One concerns what a company publishes, the other how it governs itself.

Directive (EU) 2026/470, known as Omnibus I, published in the Official Journal of the European Union on 26 February 2026 and applicable since 18 March 2026, refocused the CSRD on the largest companies. Member States must transpose it before 19 March 2027. For companies still in scope, the ISO 53001 audit does not replace assurance of their report.

What the ISO 53001 auditor looks at

For a company subject to the CSRD, the auditor checks that the SDG system and the reporting are not run separately. The analysis of material issues carried out for the report is context information: if it reveals significant impacts absent from the chosen SDGs, the auditor asks why. They also check that SDG indicators and published data do not contradict each other.

For companies now outside the scope, certification remains a voluntary step. See the VSME and what ISO 53001 certification proves.

The VSME is a voluntary sustainability reporting standard designed for smaller companies. ISO/UNDP 53001 is a certifiable management system standard. The first organises what a company discloses, the second how it manages its contribution to the SDGs. Neither replaces the other, but they can complement each other within the same organisation.

The role of the VSME since Omnibus I

Since the Omnibus I directive, a company subject to the EU's Corporate Sustainability Reporting Directive (CSRD) cannot require a partner with 1,000 employees or fewer to provide more information than the voluntary standard based on the VSME sets out. That framework thus becomes the ceiling on what a large customer can ask a smaller supplier to report.

ISO 53001 certification falls outside that calculation: it is not a request for information but a voluntary step taken by the organisation. A supplier can present it on its own initiative to show that its data come from a managed, audited system.

When the two coexist

When an organisation reports under the VSME, the auditor applying the ISO/UNDP 53001 standard does not verify that report. They do look at consistency. Are the topics it presents as important reflected in the context analysis and the choice of SDGs? Are the figures tracked in the SDG system the ones that are published?

An inconsistency is not in itself a nonconformity, but it may reveal weak control of documented information. See the CSRD after Omnibus and suppliers and their customers.

A corporate social responsibility (CSR) label is awarded against criteria owned by its issuer, often as a score or level. ISO/UNDP 53001 certification rests on an international requirements standard and on an audit by a certification body bound by ISO/IEC 17021-1. It attests a conforming management system, with no ranking or score.

Criteria, assessor, result

Three points distinguish the two approaches:

• the criteria: a label follows criteria defined by its owner, who can change them; certification follows a standard developed by ISO and UNDP, public and identical for all;
• the assessor: a label may be awarded by the entity that designed the criteria, which sometimes also sells support services; certification is granted by a body that is not allowed to advise the organisation it audits;
• the result: a label often expresses graded performance; a certificate states whether the requirements are met within a defined scope, and is re-examined every year.

These models do not answer the same question.

The two can coexist

A labelled organisation can seek certification. The ISO 53001 auditor does not treat the label as evidence of conformity. They may read the label's assessment report as context information, then check independently that the requirements of the ISO/UNDP 53001 standard are met.

Presenting a label as a certification, or the reverse, is an inaccurate claim. See what a certified organisation may claim and ISO 26000.

An organisation certified to ISO/UNDP 53001 may state that its SDG management system is certified as conforming to the standard, within the scope shown on the certificate. It may not present certification as proof of measured impact, a ranking or a contribution to every SDG, nor apply it to products.

What the certificate says, and what it does not

The certificate attests a precise fact: a certification body has verified that the management system meets the requirements of the ISO/UNDP 53001 standard, and continues to verify it. It does not vouch for any level of results on a given SDG. Phrases such as “SDG-certified company” or “certified contribution to all 17 SDGs” go beyond what the certificate establishes.

Quantified claims about results, such as a cut in emissions, remain the organisation's responsibility. They do not become certified because they are published next to the certificate.

What the auditor checks

At every surveillance audit, the auditor reviews references to the certification: website, annual reports, sales documents, responses to tenders. They check that the scope is cited and that no wording suggests product certification or attested performance.

Misleading communication breaches the certification commitments. It may lead to a request for correction, or even suspension. Graphic and usage rules are covered in the certificate and certification mark and on the certificate and logo use page.