Glossary
Certification and audit glossary
The terms you will meet in audit plans, reports and certificates, in plain language.
- Accreditation
- Independent confirmation by an accreditation body that a certification body is competent, impartial and operates consistently to international standards such as ISO/IEC 17021-1. Accredited certificates carry more weight because the body issuing them is itself assessed.
- Accreditation body
- An organisation that assesses and accredits certification bodies, such as ANAB in the United States or UKAS in the United Kingdom. Accreditation bodies that sign the IAF Multilateral Recognition Arrangement recognise each other's accredited certificates.
- Annex SL (harmonised structure)
- The common clause structure, core text and terms shared by ISO management system standards, first published as Annex SL and now called the harmonised structure. It is why ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 use the same clause numbers and can be combined into one integrated system.
- Appraisal
- In CMMI, an examination of an organisation's processes against the CMMI model by a certified lead appraiser and appraisal team. Appraisals identify strengths and weaknesses and, when benchmarked, result in a maturity level rating.
- Audit programme
- The planned set of audits for a certified organisation over its three-year cycle, covering initial or recertification audits and the surveillance audits in between. It sets out timing, scope and focus so that all requirements and sites are covered over the cycle.
- Benchmark appraisal
- A CMMI appraisal that results in a maturity level rating which can be published. Benchmark results are recorded by the CMMI Institute and are valid for a defined period.
- CERT-In empanelment
- Listing by the Indian Computer Emergency Response Team as an organisation authorised to carry out information security audits. Government bodies and many regulated organisations in India require audits by an empanelled organisation.
- Certification body
- An organisation that audits management systems against a standard and issues certificates when the requirements are met. An accredited certification body is assessed by an accreditation body and must remain independent of the organisations it certifies.
- Certification decision
- The decision to grant, maintain, renew, suspend or withdraw certification, made by people who did not take part in the audit. It is based on the audit report and the evidence that any nonconformities have been addressed.
- Corrective action
- Action to remove the cause of a nonconformity so that it does not recur. It differs from a correction, which fixes the immediate instance without addressing why it happened.
- Hash value
- A fixed-length fingerprint calculated from a file or set of files with a cryptographic function such as SHA-256. Changing even one byte of the input changes the value, which is why a safe-to-host certificate records the hash of the audited build.
- IAF CertSearch
- A global database operated for the International Accreditation Forum where accredited management system certifications can be looked up. It complements the online register that each certification body maintains.
- IAF MLA
- The International Accreditation Forum Multilateral Recognition Arrangement, under which signatory accreditation bodies recognise each other's accreditations. It allows a certificate issued under one signatory's accreditation to be accepted in other countries.
- Impartiality
- Objectivity in certification decisions, free from commercial, financial or other pressures. A certification body must not provide consultancy on the management systems it certifies, and it must identify and manage any threats to impartiality.
- Internal audit
- An audit an organisation carries out on its own management system, by people who do not audit their own work. Every ISO management system standard requires a planned internal audit programme.
- Lead appraiser
- A person certified by the CMMI Institute to lead CMMI appraisals. The lead appraiser plans the appraisal, leads the team and is responsible for the accuracy of the results.
- Lead auditor
- The auditor who leads a certification audit team, agrees the audit plan, assigns work and is responsible for the audit report. Lead auditors must be competent in the standard being audited and in auditing practice.
- Major nonconformity
- A nonconformity that affects the capability of the management system to achieve its intended results, such as a missing required process or a systemic failure. Certification cannot be granted or renewed until it has been corrected and the correction verified.
- Management review
- A review by top management, at planned intervals, of whether the management system remains suitable, adequate and effective. It considers inputs such as audit results, performance and changes, and records decisions on improvements and resources.
- Maturity level
- A rating on the CMMI scale from 1 to 5 that describes how well defined, managed and improved an organisation's processes are. Maturity levels 3 and 5 are the ratings most often sought by software and services organisations.
- Minor nonconformity
- A nonconformity that does not affect the capability of the management system to achieve its intended results, such as a single lapse in following a procedure. The organisation submits a plan for correction and corrective action, which is checked at the next audit.
- Nonconformity
- Non-fulfilment of a requirement of the standard or of the organisation's own management system. Nonconformities are graded as major or minor.
- Opportunity for improvement
- An observation in an audit report where the requirement is met but the auditor sees scope to do better. It does not require a response, and the organisation decides whether to act on it.
- PARS
- The Published Appraisal Results System, the CMMI Institute's public record of benchmark appraisal results. Anyone can use it to check an organisation's claimed maturity level and the scope it applies to.
- Recertification audit
- The audit at the end of the three-year cycle that assesses whether the management system remains effective as a whole, so that certification can be renewed. It must be completed before the current certificate expires.
- Safe-to-host certificate
- A certificate stating that a specific build of a web application was audited by a CERT-In empanelled organisation and no open vulnerabilities remained in scope. It records the hash of the audited build and the hosting path.
- Scope of certification
- The activities, products, services and sites covered by a certificate, together with the standard it is issued against. A certificate only applies to what its scope describes, so check the scope as well as the status.
- Stage 1 audit
- The first part of an initial certification audit, which checks readiness: documented information, scope, sites, legal requirements and whether internal audit and management review are in place. It identifies concerns to resolve before stage 2.
- Stage 2 audit
- The second part of an initial certification audit, which evaluates whether the management system is implemented and effective across the full scope. Its findings form the basis of the certification decision.
- Statement of Applicability
- The ISO/IEC 27001 document that lists every Annex A control, states whether each is included and implemented, and justifies inclusions and exclusions. Auditors use it to trace controls back to the risk assessment.
- Surveillance audit
- A periodic audit between initial certification and recertification that confirms the management system continues to meet the standard. Surveillance takes place at least once a calendar year and samples the scope and requirements.
- Suspension
- A temporary invalidation of certification when its conditions are not being met, for example when surveillance is not allowed to take place or major nonconformities are not addressed. A suspended certificate shows as suspended in the public register and must not be promoted.
- Transfer of certification
- Moving an accredited certification from one certification body to another under IAF MD 2, without restarting the certification cycle. The receiving body carries out a pre-transfer review before issuing its own certificate.
- VAPT
- Vulnerability assessment and penetration testing: identifying security weaknesses in applications, networks or infrastructure, then attempting to exploit them in a controlled way to show their real impact.
- Withdrawal
- The cancellation of certification, for example after an unresolved suspension or at the organisation's request. A withdrawn certificate is shown as withdrawn in the register, and a new initial certification is needed to become certified again.
Still have a question?
Our auditors are happy to explain what a term means for your audit.