What this is
What is a certification body performance review?
What is a certification body performance review?
It is an annual assessment of the organisation that certifies the site: whether its auditors are competent and consistent with one another, whether its service (scheduling, reporting, responsiveness) is reliable, and whether its terms remain transparent and competitive.
Why review the certification body at all?
Because it is a supplier like any other, and its output carries real weight. A body whose auditors disagree with each other, or whose reports arrive late, is degrading the value of the certificate it issues, invisibly unless someone reviews it deliberately.
Does this replace responding to individual audit findings?
No. Individual findings still go through the site's own nonconformance response process. This review looks across a period at the body itself, asking whether the pattern reflects a competent, consistent supplier.
Scope
When is a certification body performance review required?
This review is a supplier assessment aimed at the certification body itself. Using it to record an individual audit's findings sends the content to the wrong register.
Use this template when
- The annual review point for the current certification body has arrived
- A pattern across several audits suggests inconsistency between auditors, not a single bad visit
- The certificate is coming up for renewal and a genuine continue-or-switch decision is needed
- A linked record needs this one to exist: links external audits, findings
- Recurring service issues, such as late reports or broken notice periods, need a formal record
Do not use it for
- Customer Audit Record, which records a customer or second party audit and its findings, not the performance of a certification body.
- Unannounced Audit Readiness Check, which tests whether the site itself would pass an audit today, the opposite direction of assessment to this review.
- Audit Non Conformance Response Record, which holds the formal response to a specific external finding, with correction and root cause.
- External Audit Record, which documents one audit visit and its findings, not the body's performance across a period.
- Anything outside KnowComply, which belongs in the workspace that owns that process
Compliance mapping
Which ISO 17021 requirements does this satisfy?
ISO/IEC 17021-1 sets out what a certification body must do to be accredited, and this review is the site's own evidence of whether the body actually meets that standard in practice.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 17021-1 cl.4.1 | Contractual arrangement with the client covering scope, obligations and fees, defined and honoured | Header |
| ISO 17021-1 cl.4.2 | Certification decisions and findings kept free of undue commercial or auditor-specific influence | Auditor quality |
| ISO 17021-1 cl.6.2 | Personnel involved in certification activities technically competent and consistent in the findings they reach | Auditor quality |
| ISO 17021-1 cl.8.2 | Audit programme scheduled, notice periods honoured, and audit time appropriately determined | Service |
| ISO 17021-1 cl.7.2 | Certification documents and audit reports issued in a timely, accurate and usable form | Service |
| ISO 17021-1 cl.7.1 | Costs, scope and contract terms communicated transparently to the client | Commercial |
| ISO 17021-1 cl.8 | Certification decision and the audit record behind it traceable for each visit reviewed | Related records |
| ISO 17021-1 cl.9.1 | Certification body maintains a management system that reviews its own performance and acts on client feedback | Outcome |
What it does not cover
- External Audit Record, which documents an individual audit visit and its findings, not the body's performance across a period.
- Auditor Competency Record, which tracks the competence of the site's own internal auditors, not the certification body's external assessors.
- Unannounced Audit Readiness Check, which tests whether the site itself would pass an audit today, the opposite direction of assessment to this review.
- Certification Gap Analysis, which assesses the site's distance from a standard, not the service quality of the body auditing against it.
- A formal complaint or appeal to the certification body's own impartiality process, which this review may trigger but does not itself constitute.
Global
Certification Body Performance Review requirements by country
ISO/IEC 17021-1 is the same standard worldwide; what differs is which accreditation body stands behind the certification body being reviewed, and where a complaint can be escalated.
ANAB accreditation against ISO/IEC 17021-1
Certification bodies operating in the US are typically accredited by ANAB, which requires them to meet ISO 17021-1 on competence and impartiality.
A documented pattern of auditor inconsistency can be escalated to the accreditor, not only raised with the certification body itself.
UKAS accreditation against ISO/IEC 17021-1
UKAS accredits certification bodies operating in the UK and periodically audits their impartiality and competence arrangements.
A pattern of poor auditor consistency is exactly the kind of evidence UKAS surveillance visits look for, and site records support that case.
IAF Multilateral Recognition Arrangement
Accreditation bodies that are IAF MLA signatories mutually recognise each other's accredited certificates across borders.
A poorly performing certification body's problems are visible wherever the certificate needs to be recognised by an overseas customer.
How to complete it
How to complete a certification body performance review, step by step
The form scores a period, not a visit. Whether that score reflects anything real depends on judgement the fields alone cannot supply.
A single strong visit does not offset a pattern of disagreement between assessors on the same scope. The pattern is the finding, not either individual visit, and it is what Findings Consistent Between Auditors exists to force a view on.
A body that is punctual but technically weak, and one that is expert but chronically late, need different responses. Scoring them the same way under a single impression of 'good' or 'bad' loses the information that would actually drive the fix.
An auditor who checks exactly what is required is doing the job adequately, not exceptionally. A body being paid at a premium for sector expertise should be surfacing findings a generic checklist would not, and the review should say plainly when it isn't.
Raising this question only when renewal is imminent removes any real leverage to negotiate, calibrate auditors, or consider an alternative body. The decision belongs at the start of the renewal window, not the end of it.
What auditors find
Most common certification body performance review findings
Because this review looks at a supplier rather than the site's own compliance, its findings are usually about inconsistency and drift, not a single missed requirement.
| Finding | Clause | What fixes it |
|---|---|---|
| Different auditors return materially different findings for the same scope, with no evidence of calibration. | ISO 17021-1 cl.6.2 | Request the body's evidence of auditor calibration or witnessed audits; raise formally if it cannot be shown. |
| Notice periods or scheduling commitments not honoured. | ISO 17021-1 cl.8.2 | Record each instance of slippage and escalate through the body's stated complaints route once a pattern appears. |
| Reports issued late or inconsistent in quality between auditors. | ISO 17021-1 cl.7.2 | Track report turnaround by auditor and raise the pattern, not a single late report. |
| Costs recorded as neither transparent nor competitive, with no market comparison ever carried out. | ISO 17021-1 cl.7.1 | Benchmark cost and scope against at least one alternative body before the next renewal decision. |
| Overall Performance and Continue With This Body recorded inconsistently, for example Poor alongside Yes. | ISO 17021-1 cl.9.1 | Require the reviewer to reconcile the performance score and the continuation decision before sign-off. |
| Issues identified during the period were never raised formally with the certification body. | ISO 17021-1 cl.4.2 | Make Issues Raised Formally mandatory whenever any Auditor quality item scores below full marks. |
Case in point
Case in point: three years, three routes through the same site
A site had used the same certification body for six years, rotating between three auditors who each covered the same scope on paper. Staff had long since decided one auditor was 'strict on paperwork' and another 'thorough on the floor', treating the difference as personality rather than anything worth raising. Annual scores on this review stayed in the Adequate band throughout, never quite triggering a formal conversation.
A new plant manager, comparing three years of external audit records while preparing this review, found each auditor had followed a near-identical route through the site, each unknowingly copying their predecessor's route rather than the scope actually required. The allergen changeover check, present on paper in every audit plan, had not actually been sampled on the floor in three consecutive visits. The gap was not one missed item; it was three years of auditors calibrating against each other's habits instead of the standard.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- CMP-047
- Archetype
- Review
- Record ID
- CBP-2026-000
- Scoring
- Performance rating
- Direction
- High is good
- Singleton
- Yes
- Basis
- ISO 17021
- Links
- Links External audits, Findings
- Tags
- Audits, Certification
- Sections
- 6
- Fields
- 51
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 3
Header
13 fieldsReview ID*
Auto sequence. Format CBP-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Certification Body*
Period Reviewed*
Reviewed By*
Audits In Period*
Different Auditors Used*
Total Cost
Auditor To Auditor Variation Is A Real Cost
Two auditors from the same body finding entirely different things is a certification body problem. Raising it formally is legitimate and usually welcomed.
Auditor quality
6 fieldsAuditors Technically Competent*
- Yes3 pts
- Partly1 pt
- No0 pts
Sector Experience Adequate*
- Yes3 pts
- Partly1 pt
- No0 pts
Findings Consistent Between Auditors*
- Yes3 pts
- Partly1 pt
- No0 pts
Findings Evidence Based*
- Yes3 pts
- Partly1 pt
- No0 pts
Professional Conduct Acceptable*
- Yes3 pts
- Partly1 pt
- No0 pts
Added Value Beyond Compliance*
- Yes3 pts
- Partly1 pt
- No0 pts
Service
6 fieldsScheduling Reliable*
- Yes3 pts
- Partly1 pt
- No0 pts
Notice Periods Honoured*
- Yes3 pts
- Partly1 pt
- No0 pts
Reports Issued On Time*
- Yes3 pts
- Partly1 pt
- No0 pts
Report Quality Acceptable*
- Yes3 pts
- Partly1 pt
- No0 pts
Query Response Adequate*
- Yes3 pts
- Partly1 pt
- No0 pts
Certificate Administration Correct*
- Yes3 pts
- Partly1 pt
- No0 pts
Commercial
6 fieldsCosts Transparent*
- Yes3 pts
- Partly1 pt
- No0 pts
Costs Competitive*
- Yes3 pts
- Partly1 pt
- No0 pts
Scope Correctly Defined*
- Yes3 pts
- Partly1 pt
- No0 pts
Unannounced Requirements Explained*
- Yes3 pts
- Partly1 pt
- No0 pts
Portal And Systems Usable*
- Yes3 pts
- Partly1 pt
- No0 pts
Contract Terms Reasonable*
- Yes3 pts
- Partly1 pt
- No0 pts
Related records
1 fieldExternal Audit ID
An audit carried out by this body in the period.
Links to CMP-021 Record ID
Outcome
19 fieldsOverall Performance*
- Strong4 pts
- Adequate2 pts
- Poor0 pts
Continue With This Body*
- Yes3 pts
- With conditions1 pt
- No0 pts
Issues To Raise
Issues Raised Formally*
- Yes3 pts
- Not needed3 pts
- No0 pts
Alternative Bodies Considered*
- Yes3 pts
- No1 pt
Next Review Due*
Items Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Compliance Lead*
Signature*
Site Manager*
Second Signature*
CMP-047 · record IDs look like CBP-2026-000 · Links External audits, Findings
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The review is a once-a-year exercise. Noticing the pattern across visits, and making sure a raised issue reaches the certification body rather than staying a private note, is what actually changes the relationship.
Holds this review against the external audit record, flags when auditor findings diverge across visits, and tracks whether issues raised were actually followed up.
Applies the same supplier-performance discipline to the certification body as to any other external party the site depends on, including cost and terms review on schedule.
Surfaces the pattern across several years of external audits when a single annual review would miss it, and holds any escalation to the certification body for approval before it is sent.
This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.
Meet KnowComply→Glossary
Certification Body Performance Review definitions and key terms
- Impartiality
- The certification body's requirement to keep its certification decisions free of undue commercial or auditor-specific influence.
- Accreditation
- Independent recognition, for example by UKAS or ANAB, that a certification body itself meets ISO/IEC 17021-1.
- Auditor calibration
- The certification body's own practice of aligning findings and severity judgements across different auditors covering the same scope.
- Certification decision
- The decision to grant, maintain, extend, suspend or withdraw certification, which ISO 17021-1 requires be kept separate from the audit team itself.
- Multilateral Recognition Arrangement (MLA)
- The IAF arrangement under which signatory accreditation bodies mutually recognise each other's accredited certificates across borders.
FAQ
Frequently asked questions about certification body performance review
Can a site actually challenge a certification body's findings?+
Yes, through the body's own appeals and complaints process, which ISO 17021-1 requires it to operate. This review is what generates the specific, dated evidence that makes such a challenge credible rather than a general complaint.
What's the difference between this review and appealing a specific finding?+
An appeal contests one finding from one visit. This review looks across a period at consistency, competence, service and cost, and can surface a pattern, such as recurring inconsistency, no single appeal would capture.
Why does auditor consistency matter more than any one visit going well?+
Because the certificate is meant to mean the same thing regardless of which auditor issued it. If findings depend heavily on who turns up, the certificate's value to a customer reading it is weaker than it appears.
Should switching certification bodies actually be on the table?+
Yes, and treating it as unthinkable removes the site's only real leverage. Alternative Bodies Considered exists precisely so the option is evaluated on schedule, not only after a serious failure.
What counts as value beyond compliance?+
A finding or observation the site would not have reached on its own, offered because the auditor has genuine sector expertise. Confirming what a checklist already covers is the baseline service, not evidence of added value.
Who should complete this review, and how often?+
The compliance lead, yearly, and after any trigger event such as a serious service failure or change of assigned auditor. An annual-only cadence misses problems that should be raised as soon as the pattern appears.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Internal Audit and Certification
Internal Audit Programme
Sets out what will be audited, when, by whom and against which standard, across the year
Internal Audit Report
Records an internal audit against a standard or process, with findings and evidence
Audit Plan
Sets out the scope, criteria, schedule and people involved for a single audit
Audit Finding Record
Records a single audit finding with its evidence, clause reference and classification
Audit Follow Up Record
Checks whether audit findings have actually been closed and the fixes work
Auditor Competency Record
Records an internal auditor's training, experience and audits performed
More in Customer and Scheme Audits
Customer Audit Record
Records a customer or second party audit, its findings and the response given
Unannounced Audit Readiness Check
Checks whether the site would pass an audit arriving today, covering records, standards and area condition
Audit Non Conformance Response Record
Holds the formal response to an external finding, with correction, root cause, corrective action and evidence
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems
- IAF Mandatory Document MD5, Determination of Audit Time
- UKAS accreditation requirements for management systems certification bodies
- ANAB accreditation criteria for management systems certification bodies
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.