Changing Certification Body Mid-Cycle: How Transfer of Accredited Certification Works

Your certification body raises its price at recertification. The auditor who visits does not understand your industry. Your company is acquired by a group that works with a different body. Or worse: your certification body loses its accreditation.

You are not locked in, and you do not have to wait until the end of your three-year cycle. For accredited management system certifications, this change has a name, a procedure and a reference document: transfer of certification.

What the reference document says

The text is IAF MD 2:2023 — IAF Mandatory Document for the Transfer of Accredited Certification of Management Systems (Issue 2, Version 2, issued 14 June 2023). It is mandatory for the consistent application of Clause 9.1.3 of ISO/IEC 17021-1:2015, the standard setting out requirements for bodies providing audit and certification of management systems. The Cofrac, France’s national accreditation body, publishes the French translation in its online documentation.

Its definition leaves little room for interpretation: transfer is the recognition of an existing and valid management system certification, granted by one accredited certification body — the issuing certification body — by another accredited body — the accepting certification body — for the purpose of issuing its own certification.

Two immediate consequences. This is not a new initial audit — that is the whole point. And concurrent certification by more than one body does not fall under this definition: you transfer, you do not accumulate.

One timing caveat: IAF ceased operations on 1 January 2026, its functions taken over by the Global Accreditation Cooperation Incorporated (Global ACI), and the mandatory documents are being progressively renumbered. The substantive rules remain those described here; confirm the current reference with your certification body.

A final structural point: the document sets minimum requirements. A certification body may be more stringent, but only “provided that a client organization’s freedom to choose a certification body is not unduly or unfairly constrained”. That is your best argument against artificial obstacles.

Legitimate reasons — and the one that works against you

Four families of reasons recur:

• Price. Sharp increases in surveillance or recertification quotes, disproportionate travel costs, wide gaps between competing offers — see our figures on the cost of ISO 45001 certification.
• The audit relationship. An auditor who does not know your sector, a different contact at every visit, reports you cannot use, scheduling that never works.
• A corporate event. Acquisition, merger, integration into a group with a preferred body. IAF MD 2 states that its criteria may also apply to acquisitions of certification bodies.
• Loss of accreditation by your certification body. The involuntary case, covered below.

Note carefully: clause 2.2.4 (iii) requires a review of the reasons for seeking a transfer. Your motive is part of the file. Shopping for a more lenient body to escape a nonconformity is the one reason that backfires — and it shows.

Eligibility: what transfers and what does not

Situation	Transfer possible?	Applicable rule
Accredited, valid certificate with no open major nonconformity	Yes	Existing cycle resumed (2.3.4)
Suspended certification	No	Certification known to be suspended shall not be accepted (2.1.2)
Certification issued outside accreditation	No	You are treated as a new client (2.1.1)
Audit reports not made available, or surveillance not completed as required by the programme	No	Treated as a new client (2.2.4 v)
Issuing body has ceased trading, or its accreditation has expired, been suspended or withdrawn	Yes, within a deadline	Transfer within 6 months or on expiration of the certification, whichever is sooner (2.1.3)
Outstanding major nonconformities	Blocked until closed	No certificate before corrective actions are verified (2.3.1)

So the first move is to reread your own certificate before calling anyone: our method for checking an ISO certificate — validity, scope, sites, accreditation mark — will tell you in five minutes whether you are eligible.

The pre-transfer review: eight points to document

The accepting body must carry out a pre-transfer review by means of a documentation review. Where that review identifies the need — for example where there are outstanding major nonconformities — it must add a pre-transfer visit. The document states that this visit is not an audit, while requiring that whoever conducts it hold the same competence as an audit team appropriate for the scope concerned.

The review covers at least eight points, all to be fully documented:

1. Confirmation that your certification falls within the accredited scope of both the issuing and the accepting body.
2. Confirmation that the issuing body’s accredited scope falls within its accreditation body’s recognition arrangement scope.
3. The reasons for seeking a transfer.
4. Confirmation that the site or sites concerned hold valid accredited certification.
5. The initial certification or most recent recertification audit report, the latest surveillance report, and the status of all outstanding nonconformities.
6. Complaints received and action taken.
7. The considerations needed to establish an audit plan and programme — the issuing body’s programme should be reviewed if available.
8. Any current engagement with regulatory bodies on legal compliance within the certification scope.

Item 5 is decisive. If the audit reports are not made available, or if the surveillance or recertification audit was not completed as required by the issuing body’s audit programme, you shall be treated as a new client. Gather those reports before announcing your departure.

Finally, the personnel taking the certification decision must be different from those who carried out the review.

The cycle is not reset

This is what determines whether the exercise makes economic sense. If the review identifies no problems, the certification cycle shall be based on the previous certification cycle, and the accepting body establishes the audit programme for the remainder of that cycle. Your surveillance and recertification dates are preserved: neither gained nor lost.

Two useful corollaries. The accepting body may quote your initial certification date on the certification documents, indicating that you were certified elsewhere before a given date: your track record is not erased. And it must decide before initiating any surveillance or recertification audit — the transfer is settled first, the audit comes afterwards. To place those dates in your calendar, see our articles on the differences between initial, surveillance and recertification audits, on surveillance and recertification in practice and our comparison of surveillance audit calendars.

Conversely, where the review identifies issues that prevent completion of the transfer, the accepting body shall treat you as a new client, explaining and documenting that decision. The cycle then begins with the certification decision: a full initial audit, stage 1 and stage 2, with the corresponding lead time and cost. Anticipate that scenario by reading our article on the certification application and contract review.

What your outgoing body may not do

This is the least known and most protective part. Once you have authorised the issuing body to release the requested information:

• It shall provide the accepting body, on request, with all documents and information required by the document.
• It shall not suspend or withdraw your certification after being notified of the transfer, as long as you continue to satisfy the requirements of certification.
• If it fails to provide the information, or suspends or withdraws your certification without valid reason, the accepting body and/or you shall contact its accreditation body — in France, the Cofrac.
• That accreditation body must have a process to remedy the situation, including suspending or withdrawing the accreditation of the uncooperative certification body.
• Once the new certification has been issued, the accepting body informs the issuing body.

In other words: administrative retaliation is a nonconformity on the certification body’s side, not something you have to live with.

On the contractual side, however, nothing releases you from your commitments. Certification contracts are frequently concluded for a full cycle, with notice periods and invoicing for audits already scheduled. Reread the term, the notice period and the termination conditions before writing to anyone, and get written confirmation of the prospective body’s transfer procedure and file-handling fees.

The involuntary case: a body that loses its accreditation

Imposed timetable. Where certification was granted by a body that has ceased trading or whose accreditation has expired, been suspended or withdrawn, the transfer shall be completed within six months or on expiration of the certification, whichever is sooner. The accepting body must inform its own accreditation body beforehand. We cover the French counterpart in our articles on a certification body losing its accreditation and on withdrawal of a certification body’s authorisation.

What about Qualiopi?

IAF MD 2 does not apply to Qualiopi. It governs management systems falling under ISO/IEC 17021-1 — ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001. Qualiopi certification bodies are accredited to ISO/IEC 17065, which covers certification of products, processes and services.

The overall logic is comparable — valid certificate, no suspension, major nonconformities closed, existing cycle resumed — but the precise terms depend on the certification body and the framework in force. Assume nothing: ask for the written procedure. See our articles on changing Qualiopi certification body and choosing your certification body.

What the research says

On the risk this framework neutralises: Clive Lennox published in 2000 in the Journal of Accounting and Economics (vol. 29, no. 3, pp. 321-337) “Do companies successfully engage in opinion-shopping? Evidence from the UK” (see the study). By modelling the reports auditors would have issued, he shows that UK companies do obtain a more favourable report by switching auditors. That is exactly what the pre-transfer review prevents: the new body inherits the file, the nonconformities and the complaints, not a blank page.

On the real cost of switching: Thomas Burnham, Judy Frels and Vijay Mahajan set out in 2003 in the Journal of the Academy of Marketing Science (vol. 31, no. 2, pp. 109-126) a now-classic typology of switching costs, distinguishing procedural costs (time and effort), financial costs and relational costs (see the study). Applied to a transfer: the saving announced on the quote is financial and visible, whereas reconstituting the file, bringing a new auditor up to speed and losing a contact who knows your organisation are procedural and relational — and therefore systematically underestimated.

Take action

Before any termination letter, take stock: certificate valid and not suspended, reports from the last initial or recertification audit and the last surveillance in your hands, major nonconformities closed, complaints traceable. Then ask the prospective body for its written transfer procedure and its accreditation scope, and sign with it before leaving your current one. For the schemes concerned, see our guides to ISO 45001, ISO 9001 and Qualiopi.