A standard is a document, not a seal
ISO (the International Organization for Standardization, based in Geneva) publishes documents that describe requirements. ISO 9001 is one of them: about 30 pages saying what a quality management system must have, without saying how. ISO certifies nobody, audits nobody and sells no seals. It sells the document.
In Colombia that document is adopted as a Colombian technical standard through ICONTEC, with the NTC prefix (for example, NTC-ISO 9001:2015). It is the same text, translated. To implement a standard you need to buy your licensed copy: the text is the intellectual property of ISO and ICONTEC, which is why no serious tool (The Ark of ISO included) reproduces it literally.
The certificate is issued by a certification body
When a company says “we are ISO 9001” it means a certification body audited it and issued a certificate valid for three years, with a surveillance audit every year and a recertification at the end. In Colombia the well-known bodies are ICONTEC, SGS, Bureau Veritas, Cotecna or Applus, among others.
The body charges by auditor-days. The number of days depends on the company's size (people in scope), the risk of the activity and how many sites it has. An SME of 30 people usually needs between 3 and 5 auditor-days for the initial certification, split into two stages.
And the body is overseen by an accreditation body
Here is the most common trap. Anyone can print a piece of paper that says “ISO certificate”. What gives it value is that the certification body is accredited: in Colombia by ONAC (the National Accreditation Body), which verifies that the body audits properly. A certificate from a non-accredited body is worthless for a serious tender or a corporate customer.
Ask for the certificate number and look up the body in the ONAC directory. If the body is foreign, look for its accreditation body in the IAF (International Accreditation Forum) member list. If it appears in neither, the paper is decorative.
So what do you buy when you certify?
- The standard: the document with the requirements. Bought once (ICONTEC or ISO).
- The implementation: building the management system that meets those requirements. This is where the consultant, the template or a tool like The Ark of ISO goes. It is the costliest and slowest part.
- The certification audit: the accredited body's days, in two stages, then the annual surveillance audits.
- Maintenance: the system must stay alive for three years. A system that only exists during audit month shows at the second surveillance audit.
The Ark of ISO works on the second and the fourth: implementing and maintaining. You buy the standard; the audit is done by the body you choose.