An ISO consultant builds your management system, a certification body independently audits it and issues the certificate, and impartiality rules keep the two roles separate. ISO/IEC 17021-1, the standard that governs certification bodies, bans a body from certifying a management system it helped build. It also bars any auditor who consulted for a client from that client's audits for a minimum of two years after the consultancy ends. Any provider that offers to write your documents and issue your certificate is breaking the rule that gives the certificate its value. Start with our guide to how to choose a trusted ISO certification body in Iraq, or see ISO certification services.
In Iraq the distinction matters because the market blurs it. That holds for ISO 9001 and every other standard. IraqCert works on the preparation side: gap analysis, documentation, training, internal audits, and managing the process through to certification. The certification audit and the certificate come from AQSR, a partner certification body accredited by UAF, an accreditation body and IAF MLA signatory. Certificates are verifiable on IAF CertSearch.
What an ISO Consultant Does
An ISO consultant builds and prepares your management system so it can pass an independent audit. The work starts with a gap analysis that compares your current operation against the standard. The consultant then writes the documentation with your team: policies, procedures, and records. Staff get trained on what those documents require of them.
Before the certification body arrives, the consultant runs the internal audit and the management review, then closes the gaps both of them expose. The consultant works for you. The deliverable is a management system that conforms, not a certificate.
What a Certification Body Does
A certification body independently audits your management system against the standard and issues the certificate when it conforms. The audit runs in two stages: Stage 1 reviews your documentation and readiness, Stage 2 audits how the system works in practice. The auditor records major and minor nonconformities and requires correction before the certification decision.
The certificate is valid for three years, with annual surveillance audits during the cycle and recertification at the end. The certification body is itself checked by an accreditation body. That accreditation, under the IAF MLA, is what makes the certificate recognized outside Iraq.
| Task | Consultant | Certification body |
|---|---|---|
| Gap analysis | Runs it and maps what your system lacks | No role |
| Documentation | Writes it with your team | Reviews it in the Stage 1 audit |
| Internal audit | Runs it or trains your team to run it | Verifies its records during the audit |
| Certification audit | Prepares you for it, cannot conduct it | Conducts Stage 1 and Stage 2 |
| Issuing the certificate | Never issues it | Makes the decision and issues it |
Why the Same Body Cannot Consult and Certify
ISO/IEC 17021-1 prohibits a certification body from certifying a management system on which it, or a related body, provided consultancy. Any auditor who consulted for a client is barred from that client's audits for a minimum of two years after the consultancy ends. The logic is plain: no one can impartially judge a system they built.
A provider that writes your documents and then issues your certificate has audited its own work. That certificate fails accreditation scrutiny and fails the checks international buyers run before awarding contracts. In a market where unaccredited certificates circulate, the separation of roles is the fastest test of whether an offer is legitimate.
Where IraqCert Fits
IraqCert prepares your management system and manages the process through to certification. The audit and the certificate come from AQSR, an independent partner certification body. AQSR is accredited by UAF, an accreditation body and IAF MLA signatory, and every certificate can be verified on IAF CertSearch.
In practice, IraqCert handles the gap analysis, the documentation, the training, the internal audit, and the coordination of audit dates. AQSR conducts the Stage 1 and Stage 2 audits and makes the certification decision. The two roles never mix. That separation is what makes your certificate hold up in tenders and in front of international clients.