Certification
Certification / ISO Certificate
The certificate confirms that you apply the standard and its requirements — 90% of the work is implementation. Here we explain the other half of the story: accreditation, IAF and MLA recognition, choosing a body, and surveillance audits.
Implementation first — certification confirms compliance
The route to a certificate is straightforward: 90% of the work is implementation. Once the system is in place and meets every requirement of the standard, you enter the certification process and receive the certificate at the end of it. You cannot buy or "arrange" a certificate — it's simply an independent confirmation that the system you've established genuinely meets all the requirements of the standard. That's why our focus is on introducing a system that works in practice; once that job is done properly, certification is a formality with no surprises.
Separated roles protect the value of the certificate: we prepare you (implementation, documentation, training, internal audit), while the certificate is issued by an independent certification body. A consultant who "grades" their own work would not be independent — that's why these two roles must never sit in the same hands.
Accreditation, IAF and MLA — why it matters
What is accreditation? Accreditation is "oversight of the overseer": a national accreditation body checks and supervises the work of certification bodies — their impartiality, the competence of their auditors and the consistency of their procedures. Every country has its own: ATCG in Montenegro, DAkkS in Germany, Akkreditierung Austria in Austria, COFRAC in France, ACCREDIA in Italy, ATS in Serbia, BATA in Bosnia and Herzegovina, HAA in Croatia and DPA in Albania. They are linked through EA and IAF, so accreditation granted in Germany or Austria counts exactly as much as a domestic one. A certificate from a body without accreditation for the specific standard and sector carries no weight on serious tenders or with serious clients.
What is IAF? IAF (International Accreditation Forum) is the world association of accreditation bodies. It links national accreditation systems into a single global network of trust.
What is MLA? The IAF MLA (Multilateral Recognition Arrangement) is a multilateral recognition agreement: a certificate issued under one member's accreditation is recognised by all the others. The principle is "certified once — accepted everywhere." In practice: your company's accredited certificate is valid with a customer in Germany, Italy or the UAE, without further checks.
Why do clients choose internationally recognised bodies such as TÜV, Bureau Veritas, SGS or DNV? Because of a reputation built over decades — some of these brands have been checking safety and quality for over a century. When your customer sees a name they recognise on the certificate, the supplier check is over before it began. We don't depend on any single body, so we help you compare offers and choose the name that carries the most weight in YOUR target market.
Most tender disputes come down to the national prefix: the same standard carries a different designation in every country, so a bidder from Serbia or Bosnia turns up with a certificate that "does not look the same" — although it is the same standard. That is why we recommend always citing the international designation in tender documents — ISO 9001, ISO 14001, ISO/IEC 27001 — because every bidder recognises it regardless of where they come from. Official designations by national institute:
Official designations — by the national standards institutes
| Market | ISO 9001 | ISO 14001 | ISO 45001 | ISO/IEC 27001 | ISO 22000 | ISO 50001 | ISO 13485 | ISO/IEC 17025 | Standards institute | Accreditation body |
|---|---|---|---|---|---|---|---|---|---|---|
| International (ISO) | ISO 9001 | ISO 14001 | ISO 45001 | ISO/IEC 27001 | ISO 22000 | ISO 50001 | ISO 13485 | ISO/IEC 17025 | ISO | — |
| Europe (CEN) | EN ISO 9001 | EN ISO 14001 | EN ISO 45001 | EN ISO/IEC 27001 | EN ISO 22000 | EN ISO 50001 | EN ISO 13485 | EN ISO/IEC 17025 | CEN | — |
| Montenegro | MEST EN ISO 9001 | MEST EN ISO 14001 | MEST EN ISO 45001 | MEST ISO/IEC 27001 | MEST EN ISO 22000 | MEST EN ISO 50001 | MEST EN ISO 13485 | MEST ISO/IEC 17025 | ISME | ATCG |
| Serbia | SRPS ISO 9001 | SRPS ISO 14001 | SRPS ISO 45001 | SRPS ISO/IEC 27001 | SRPS ISO 22000 | SRPS ISO 50001 | SRPS ISO 13485 | SRPS ISO/IEC 17025 | ISS | ATS |
| Bosnia and Herzegovina | BAS EN ISO 9001 | BAS EN ISO 14001 | BAS EN ISO 45001 | BAS EN ISO/IEC 27001 | BAS EN ISO 22000 | BAS EN ISO 50001 | BAS EN ISO 13485 | BAS EN ISO/IEC 17025 | ISBIH | BATA |
| Croatia | HRN EN ISO 9001 | HRN EN ISO 14001 | HRN EN ISO 45001 | HRN EN ISO/IEC 27001 | HRN EN ISO 22000 | HRN EN ISO 50001 | HRN EN ISO 13485 | HRN EN ISO/IEC 17025 | HZN | HAA |
| Albania | SSH EN ISO 9001 | SSH EN ISO 14001 | SSH EN ISO 45001 | SSH EN ISO/IEC 27001 | SSH EN ISO 22000 | SSH EN ISO 50001 | SSH EN ISO 13485 | SSH EN ISO/IEC 17025 | DPS | DPA |
| North Macedonia | MKS EN ISO 9001 | MKS EN ISO 14001 | MKS EN ISO 45001 | MKS EN ISO/IEC 27001 | MKS EN ISO 22000 | MKS EN ISO 50001 | MKS EN ISO 13485 | MKS EN ISO/IEC 17025 | ISRSM | IARNM |
| Kosovo | SK EN ISO 9001 | SK EN ISO 14001 | SK EN ISO 45001 | SK EN ISO/IEC 27001 | SK EN ISO 22000 | SK EN ISO 50001 | SK EN ISO 13485 | SK EN ISO/IEC 17025 | AKS | DAK |
Designations are shown without the adoption year on purpose: that year is the year of national adoption, not the year of the ISO edition, so it differs from country to country. MEST EN ISO 9001:2016, SRPS ISO 9001:2015 and BAS EN ISO 9001:2015 are one and the same standard — ISO 9001:2015. The same applies to ISO/IEC 27001:2022, adopted in Montenegro as MEST ISO/IEC 27001:2023.
A public procurement asked for "MEST EN ISO 9001:2016" and the bidder submitted a certificate reading "ISO 9001:2015" — and the question follows immediately: is the bid non-compliant? It is not.
It is one and the same standard: 2015 is the year of the international edition, 2016 the year Montenegro adopted that same edition into its national catalogue. Not a different standard, not an older version, and not grounds for rejecting a bid.
Recertification
The certification cycle lasts three years and always looks like this:
Compliance with every requirement
The system is implemented and applied: documentation, training, internal audit and management review are complete. Without this, you don't move to certification.
Choosing a body and a three-year contract
We compare accredited bodies (accreditation for the standard and sector, recognition, price for the whole cycle) and sign a contract that covers the full three-year cycle — the certification audit, both annual surveillance audits and the recertification at the end are all defined upfront in a single contract.
Stage 1 — documentation and readiness review
Before the on-site visit, the auditor analyses your documentation (policies, procedures, records) and assesses whether the system covers every requirement of the standard. They visit the site, check legal compliance and the organisation's context, and agree with you on the plan and scope of the Stage 2 audit. Any gaps are closed before the main audit — no surprises in the second phase.
Stage 2 — on-site certification audit
The auditor checks how the system works in practice: an opening meeting, interviews with staff at every level, live observation of processes, backward sampling of records and evidence, verification of measurable objectives and the internal audit, and a closing meeting where findings are presented verbally before the written report.
Closing findings → CERTIFICATE
Only once every nonconformity has been closed is the certificate issued — valid for 3 years.
Two annual surveillance audits
The three-year contract requires TWO annual surveillance audits (once a year, in the second and third year of the cycle) — shorter audits that check the system is still alive in practice. A surveillance audit missed on schedule means suspension, and then withdrawal of the certificate.
Recertification
Before the third year expires, a recertification audit renews the certificate and the cycle starts again.
How much does the whole cycle cost?
The price depends above all on the size of the organisation, the number of sites and the complexity of the processes — not on the name of the standard. For initial certification (Stage 1 + Stage 2 audit) with an accredited body, roughly: a small firm with one employee ~€1,100–1,400, and a large organisation with over 500 employees and several branches (a bank, say) €5,000–12,000+. Each annual surveillance audit is charged separately and usually runs at about 70–80% of the certification fee — if ISO/IEC 27001 certification with a German, Swiss or Austrian body costs ~€1,500, one surveillance audit can exceed €1,000. When several standards are certified together as an integrated system (ISO 9001 + 14001 + 45001, for example), the cost of the whole cycle does not rise in proportion to the number of standards — a combined audit takes less auditor time per standard than certifying each one separately.
Standards map — everything we implement
Everything we implement and prepare for certification, in one place. We do not issue the certificate — an independent accredited certification body does; we take you to it. Click a standard for details — what it covers, who needs it and how long implementation takes.
Management & Organization9
Information & IT6
Food Safety3
Laboratories & Medicine4
Other certification and conformity services3
Don't see your standard? We also work with ones that aren't listed — send an enquiry or open the full overview with descriptions.
What the auditor actually does during the certification audit
An auditor isn't "an inspector looking for a mistake" — they gather evidence that the system genuinely works the way you described it. Concretely, on site they:
Check whether policies, procedures and records cover every requirement of the standard and whether they're genuinely kept in practice, not just on paper.
Interview people at every level — from management to operators — to check they understand their role in the system, not just management.
Watch how the work is actually carried out: production, service delivery, storage, complaint handling — comparing the procedure with practice.
Randomly select records from the past period (orders, training, measurements, corrective actions) to check consistent application over time.
At every subsequent audit they return to earlier nonconformities and check whether the root causes were genuinely resolved, not just patched temporarily.
Classify findings (observation, minor or major nonconformity), present them verbally at the closing meeting, then deliver a written report with deadlines for corrective actions.
How we help you
We bring the system to a state where the audit is a formality: documentation, application, training, internal audit.
We compare accreditations, reputation and total cycle cost — with no commissions and no strings attached. At the client's request we also attend the audit itself and stay with you through the whole process.
A dedicated service: we're with you at Stage 1 and Stage 2 audits and in communication with auditors through to closing the findings.
A dedicated service: annual internal audits and targeted preparation ahead of every surveillance audit — so the certificate is never put at risk.
Questions and answers — tender designations and requirements
The tender says MEST EN ISO 9001, but my certificate reads ISO 9001:2015 — is that the same standard?
Yes. MEST is Montenegro's national designation, EN is the European one — it's the same international standard, simply adopted into the national catalogue with a local prefix. The content, clauses and all requirements are identical, The year, however, can differ: it marks the year of national adoption, not the year of the ISO edition — which is why MEST EN ISO 9001:2016 is identical to ISO 9001:2015. A difference in the year does not make it a different standard and is not grounds for rejecting a bid.
How do I check whether a certification body is accredited?
The scope of accreditation is public information: it can be checked in the register of the national accreditation body — ATCG (Montenegro), ATS (Serbia), BATA (Bosnia and Herzegovina), HAA (Croatia), DPA (Albania), DAkkS (Germany), Akkreditierung Austria (Austria), COFRAC (France), ACCREDIA (Italy) — or the body of the country the certifier comes from, if it is an IAF member. Make sure the accreditation covers the exact standard and your field of activity — we're happy to check this for you.
Can a client refuse a non-accredited certificate?
In practice, yes — tenders generally require a valid accredited certificate, and a non-accredited one provides no guarantee of independent oversight. That's why we recommend accredited certification only.
What happens if I skip an annual surveillance audit?
Surveillance audits are a contractual obligation with every certification body. A missed surveillance audit leads to suspension, and then withdrawal of the certificate — which on a tender means you no longer have a certificate.
How long does the whole path to certification take?
Implementation takes 3–8 months (depending on the standard and the organisation) plus the certification audit itself. The certificate is issued only once the system complies with every requirement of the standard — not before.
What are the national designations of the same standard across the region?
For ISO 9001: Montenegro MEST EN ISO 9001:2016 (ISME), Serbia SRPS ISO 9001:2015 (ISS), Bosnia and Herzegovina BAS EN ISO 9001:2015 (ISBIH), Croatia HRN EN ISO 9001:2015 (HZN), Albania SSH EN ISO 9001:2015 (DPS), Kosovo SK EN ISO 9001:2016 (AKS), Europe EN ISO 9001:2015 (CEN), international ISO 9001:2015. Only the prefix changes — never the requirements. The same holds for every standard in our standards overview.
What happens if the certification body loses its accreditation?
Certificates issued under that accreditation cease to be valid and are no longer accepted in a tender — the process has to be repeated with another, accredited body. This has happened, as a rule with smaller local bodies offering the lowest price. That is why, before signing, we check how long the body has held accreditation for your standard and your scope: saving a few hundred euros is not worth the risk of the certificate becoming worthless.
I bought a certificate but I am not sure we actually apply anything — what now?
More common than people think. First we check whether the body that issued it is accredited for that standard and scope, then a short pre-audit establishes how far the system really matches the requirements. If the certificate is valid, we fill the gaps before the first surveillance audit; if it is not, we plan proper certification with an accredited body. You can also get a rough picture yourself using the self-assessment at the bottom of each standard page.
Where can I see every standard you implement?
On the ISO standards overview, where the standards are grouped by field and each has its own page with requirements, implementation phases, costs and a free self-assessment. The most requested are ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and HACCP. If several standards are required at once, see the integrated management system.
Related pages
Related:
Standards we implement
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
With us to your certificate
Tell us the standard and your sector — we will build an implementation plan and independently compare accredited certification bodies for you. Call us or send an inquiry — we reply within 24 hours.