Getting Cofrac accreditation: the steps of the process

Getting your body accredited is not one more administrative file: it is a process spanning several months, whose longest part happens before the application is filed. Many applicants discover too late that a system described on paper is not enough — the initial assessment rests on evidence of real application. Here is the full sequence, step by step, and the points where applications most often stumble.

Step 0: check that accreditation is the right tool

First, a matter of principle. Accreditation is for conformity assessment bodies: laboratories, inspection bodies, certifiers, verifiers. If your activity is to produce, to train, to advise or to sell, what you need is not accreditation but a certification, a qualification or an administrative approval — the distinction is set out in our article on the differences between accreditation, certification and qualification.

This clarification saves months. A training provider, for instance, is never accredited for its training activity: it is certified by a certification body, which is itself accredited.

Step 1: identify the standard and the programme

Accreditation is always granted against a precise standard and within an accreditation programme specific to a field. Two actions at this stage:

• Identify the applicable standard for your trade: NF EN ISO/IEC 17025 for a testing or calibration laboratory, NF EN ISO 15189 for medical laboratories, NF EN ISO/IEC 17020 for inspection, NF EN ISO/IEC 17065 for certification of products, services and processes, NF EN ISO/IEC 17021-1 for management systems, NF EN ISO/IEC 17024 for persons. The full table is in our guide to the ISO/IEC 17000 accreditation standards.
• Obtain the requirement documents Cofrac publishes for that programme. They translate the standard into concrete requirements specific to the field, and where relevant incorporate the applicable regulatory requirements. Reading them before building your system, rather than after, saves months of rework.

This is also when the requested scope is defined: which activities, under which methods or schemes, on which sites. Too broad a scope multiplies the evidence to produce and the assessment cost; too narrow a scope limits commercial development. It is a strategic trade-off, not a box to fill.

Step 2: build the system and let it run

This is the longest step, and the one that decides everything. It is not just about writing procedures, but about running the organisation long enough to hold evidence.

Concretely, by the time of the assessment you must be able to show:

• Real files produced within the requested scope: tests performed, inspections carried out, audits conducted, certification decisions taken.
• Traced competence management: staff qualification, authorisations to practise, field monitoring, periodic requalification. This is the leading source of findings, across all standards.
• Internal audits actually performed, covering all requirements, with findings addressed.
• A management review held, with decisions and follow-up.
• A documented analysis of risks to impartiality, and the measures taken.

The classic mistake is to apply as soon as the documentation is ready. A system with no history cannot demonstrate competence: assessors look at what you have done, not at what you have written that you would do.

Step 3: apply and be assessed

The application is first examined for admissibility: is the file complete, is the requested scope coherent, does a programme exist for this activity? This phase settles the perimeter before the assessment begins.

Then comes the initial assessment, in two parts. A document review first, checking that requirements are covered. Then an on-site assessment, run by a team combining assessors and technical experts in the field. The techniques used are concrete:

• examination of files and records;
• interviews with staff, at every level;
• observation of the activities presented for accreditation, in real conditions;
• traceability audits, following a technical operation end to end, from the customer request to the final report.

At the end of the on-site assessment, the team presents the body with its strengths, weaknesses and the findings raised against the accreditation requirements. That moment is not a verdict: it is the start of the dialogue.

Step 4: address the findings, then the decision

Findings are the rule, not the exception. What distinguishes applications that succeed is the quality of the response: analysis of the real cause, proportionate corrective action, evidence of implementation, verification of effectiveness. A finding “closed” by rewriting a procedure without changing practice comes back at the next cycle.

The assessment report, together with the body’s responses, is then examined before the decision is taken and notified. The certificate issued states the scope and the term of the accreditation, with its technical annex — the document your future customers will need to know how to read, as our article on the scope of accreditation explains.

Step 5: maintain the accreditation

Accreditation belongs to a cycle, never to an end point. Three obligations shape the life of an accredited body:

• Periodic surveillance assessments, checking that the system is still applied and competence maintained.
• Notification of significant changes: scope modification, departure or arrival of key staff, change of sites, reorganisation, changes in ownership liable to affect impartiality.
• Reassessment at cycle renewal, more comprehensive, re-examining all requirements.

An accreditation can be reduced, suspended or withdrawn. That is not theoretical — and it is precisely what gives the scheme its value.

Why so demanding, rather than a simple declaration

The process can seem heavy. It answers a well-identified economic problem: when an assessor is chosen and paid by the party being assessed, incentives push towards leniency. Esther Duflo, Michael Greenstone, Rohini Pande and Nicholas Ryan demonstrated this experimentally in a study published in 2013 in the Quarterly Journal of Economics: by changing the market structure for environmental audits in the Indian state of Gujarat — payment from a central pool, random assignment of auditors, backchecking — they sharply reduced the share of plants falsely reported as compliant, and the plants concerned genuinely cut their emissions (see the study). Accreditation is the institutional answer to that risk: someone checks the assessor, against written rules, with consequences.

The five costliest mistakes

1. Applying too early, with no history of application.
2. Requesting too broad a scope “so as not to be limited”, then being unable to produce evidence everywhere.
3. Underestimating competence management, the leading source of findings.
4. Treating impartiality as a declaration rather than a documented risk analysis.
5. Mixing advice and assessment in your own business model: accreditation standards strictly frame that combination.

Take action

If accreditation is relevant to your activity, start with the one truly decisive move: identify the applicable standard and programme, obtain the corresponding requirement documents and make an honest gap analysis, requirement by requirement, before committing. You will then know how many months of real application separate you from filing. For a full overview of the scheme — Cofrac’s status, scope, surveillance, frequently asked questions — see our page on Cofrac accreditation.