A certification body becomes part of your tender and regulator story for three years. The right questions expose whether the certificate will be accepted when it matters.
- Check accreditation, scope and sector approval before comparing prices.
- Audit duration should be calculated from sites, headcount, shifts and processes.
- Avoid any body that mixes consultancy with certification or promises a guaranteed pass.
Certification is a three-year relationship, and the certificate carries your company's name next to the certification body's.
Choose well and the certificate opens tenders and satisfies regulators; choose badly and you discover, usually mid-tender, that you paid for paper nobody accepts.
1. Are you accredited, and by whom?
The foundational question. Legitimate CBs operate under ISO/IEC 17021-1 and are accredited by a recognised accreditation body. In Saudi Arabia, the national accreditation body is the Saudi Accreditation Center (SAAC) (saac.gov.sa), an IAF MLA signatory; international accreditors such as IAS are also recognised through the IAF framework (iaf.nu).
Don't accept a logo on a brochure. Ask for the accreditation certificate number and verify it in the accreditor's public directory. If the "accreditor" is not an IAF member, walk away: you would be buying an unaccredited certificate with extra steps.
2. Does your accreditation scope cover this standard?
Accreditation is granted per scheme. A CB accredited for ISO 9001 is not automatically accredited for ISO 22000 or ISO 45001. Check that the standard you need appears in the CB's accreditation scope, and if your certificate must serve a specific purpose (a tender, a regulator file), confirm with the end user which accreditations they accept, before you sign.
3. Are you approved for my regulated sector?
In regulated sectors, accreditation alone may not be enough. The clearest Saudi case is food: if your HACCP or ISO 22000 certificate needs to support SFDA facility licensing or product registration, the CB should hold the relevant SFDA approval for food-sector certification (sfda.gov.sa). Ask directly, and ask for the approval reference. A food factory certified by a body SFDA does not recognise has bought a certificate its own regulator won't read.
4. Who exactly will audit us, and what is their industry competence?
Under ISO/IEC 17021-1, CBs must assign auditors competent in your technical area: certification schemes classify industries into technical clusters, and auditors are qualified per cluster. Ask: does the CB have auditors qualified for your sector? Have they audited companies like yours: same processes, similar scale? An auditor who understands your industry finds the issues that matter; one who doesn't audits the paperwork and misses the plant.
For Saudi operations, also ask about language. Audits involving shop-floor interviews in Arabic-speaking or multilingual workforces go materially better with auditors who can work in the languages your people actually speak.
5. How did you calculate the audit duration?
Accredited CBs calculate audit days from your headcount, sites, shifts and complexity using IAF mandatory rules: the duration is derived, not invented. A CB quoting a complex, multi-shift site at a fraction of the expected days is either planning a superficial audit or not planning to follow the rules; both end badly at accreditation review. You are entitled to ask how the days were determined.
6. What does the full three-year cycle cost?
Certification pricing has recurring parts: initial audit (stage 1 + stage 2), annual surveillance audits, and recertification in year three, plus possible fees for certificate issue, follow-up visits or scope changes. Insist on a quote covering the whole cycle with every fee named. The classic trap is a low headline price for initial certification with surveillance priced after you are committed. Compare cycle-total against cycle-total, never initial-audit against initial-audit.
7. Will you also consult, train our team on implementation, or write our documents?
The correct answer is no. ISO/IEC 17021-1 prohibits a certification body from providing management system consultancy to companies it certifies: auditing your own advice is the definition of a conflict of interest, and accreditation bodies police it. A CB offering to "prepare your documents and then certify you" is advertising that its certificates are not independent. Use separate providers for consultancy and certification, and expect your CB to ask about your consultant precisely to manage this risk.
8. How do we, and our customers, verify the certificate?
Legitimate CBs maintain a way to confirm certificate status (valid, suspended, withdrawn): a public register, a verification service, or participation in IAF CertSearch (iafcertsearch.org). Tender committees and customers increasingly check. If a CB has no verification mechanism, your certificate's credibility depends on nobody asking questions: a poor foundation for a sales document.
9. What are your rules on nonconformities, suspension and appeals?
Before signing, read the CB's certification rules: a professional body publishes them. You want clear answers on deadlines for responding to and closing minor and major nonconformities; grounds and process for suspension and withdrawal; how scope extensions and site additions work; and the complaints and appeals process (a formal appeals mechanism is an ISO/IEC 17021-1 requirement, and its absence is a red flag).
This is also where you test professionalism culture: a CB that guarantees you'll pass is not selling certification, it's selling printing.
10. What is your local presence and responsiveness in the Kingdom?
Certification is not one visit. Over three years you will need audits scheduled around your production reality, follow-ups handled without flying someone across the world, scope changes processed, and a person who answers the phone when a tender committee questions your certificate on a Thursday. Ask where the CB's offices and auditors are based, its realistic scheduling lead times, and who your ongoing contact is. For companies operating across the Kingdom (Riyadh, Jeddah, the Eastern Province industrial cities of Dammam and Jubail), local audit capacity translates directly into lower cost and faster response.
Red flags summarised
- Certificate promised in days, or "100% pass guarantee"
- Price quoted without asking headcount, sites or processes
- No verifiable accreditation, or an accreditor outside the IAF
- Consultancy and certification from the same hands
- No published certification rules, complaints or appeals process
- Remote-only "audits" of physical operations
The decision, weighted properly
Most companies over-weight the initial price and under-weight everything above. The certificate's entire value lies in acceptance, by tenders, regulators, and customers, and acceptance flows from accreditation, sector approval and audit credibility. Get questions 1 through 3 verified in writing, pressure-test 4 through 7 in the proposal, and read the rules in 8 and 9 before you sign. The cheapest certificate that gets rejected is the most expensive one you can buy.
QSI Cert is a SAAC-accredited, SFDA-approved certification body based in Riyadh and Al Khobar.
Common questions from this guide.
The foundational question. Legitimate CBs operate under ISO/IEC 17021-1 and are accredited by a recognised accreditation body. In Saudi Arabia, the national accreditation body is the Saudi Accreditation Center (SAAC) (saac.gov.sa), an IAF MLA signatory; international accreditors such as IAS are also recognised through the IAF framework (iaf.nu). Don't accept a logo on a brochure. Ask for the accreditation certificate number and verify it in the accreditor's public directory. If the "accreditor" is not an IAF member, walk away: you would be buying an unaccredited certificate with extra steps.
Accreditation is granted per scheme. A CB accredited for ISO 9001 is not automatically accredited for ISO 22000 or ISO 45001. Check that the standard you need appears in the CB's accreditation scope, and if your certificate must serve a specific purpose (a tender, a regulator file), confirm with the end user which accreditations they accept, before you sign.
In regulated sectors, accreditation alone may not be enough. The clearest Saudi case is food: if your HACCP or ISO 22000 certificate needs to support SFDA facility licensing or product registration, the CB should hold the relevant SFDA approval for food-sector certification (sfda.gov.sa). Ask directly, and ask for the approval reference. A food factory certified by a body SFDA does not recognise has bought a certificate its own regulator won't read.
Under ISO/IEC 17021-1, CBs must assign auditors competent in your technical area: certification schemes classify industries into technical clusters, and auditors are qualified per cluster. Ask: does the CB have auditors qualified for your sector? Have they audited companies like yours: same processes, similar scale? An auditor who understands your industry finds the issues that matter; one who doesn't audits the paperwork and misses the plant. For Saudi operations, also ask about language. Audits involving shop-floor interviews in Arabic-speaking or multilingual workforces go materially better with auditors who can work in the languages your people actually speak.
Accredited CBs calculate audit days from your headcount, sites, shifts and complexity using IAF mandatory rules: the duration is derived, not invented. A CB quoting a complex, multi-shift site at a fraction of the expected days is either planning a superficial audit or not planning to follow the rules; both end badly at accreditation review. You are entitled to ask how the days were determined.
Certification pricing has recurring parts: initial audit (stage 1 + stage 2), annual surveillance audits, and recertification in year three, plus possible fees for certificate issue, follow-up visits or scope changes. Insist on a quote covering the whole cycle with every fee named. The classic trap is a low headline price for initial certification with surveillance priced after you are committed. Compare cycle-total against cycle-total, never initial-audit against initial-audit.