Holding Your UKAS Certification Body to Account: What ISO/IEC 17021-1 Says About Audit Findings

You have done the work, the assessor has been on site, and at the closing meeting a nonconformity lands on the table that just does not feel right. Maybe it is not clear which requirement it relates to. Maybe it is graded as a major when it looks like a paperwork slip. For many construction SMEs the instinct is to accept it quietly and move on. You do not have to.

Certification bodies (CBs) accredited by UKAS are themselves audited against a standard: ISO/IEC 17021-1:2015, the requirements for bodies providing audit and certification of management systems. That standard sets out how findings must be written, how disagreements must be handled and what the CB must do when a client appeals or complains. Knowing those rules is the best way to make sure your UKAS certification is fair, accurate and worth having.

Every nonconformity must cite a requirement and objective evidence

Clause 9.4.5.3 of ISO/IEC 17021-1 is very clear. A finding of nonconformity shall be recorded against a specific requirement, and shall contain a clear statement of the nonconformity, identifying in detail the objective evidence on which it is based. It also says nonconformities shall be discussed with you to make sure the evidence is accurate and the finding is understood.

So a good finding answers three questions:

• Which requirement? For example, a named clause of ISO 9001, ISO 14001 or ISO 45001, or one of your own documented procedures if that is the audit criterion.
• What is the gap? A plain statement of what does not meet that requirement.
• What evidence? The record, observation or interview that shows it, such as a specific job file, permit or training record.

If any of these is missing, you are entitled to ask for it. Clause 9.4.5.3 also says the auditor shall refrain from suggesting the cause of a nonconformity or its solution, so the finding should describe the problem, not prescribe your fix.

Major or minor: the definitions that matter

Grading drives your timescales and, in some cases, whether certification can be recommended, so it is worth knowing the exact wording.

• Major nonconformity (clause 3.12): a nonconformity that affects the capability of the management system to achieve the intended results. The note to this definition gives examples: where there is significant doubt that effective process control is in place, or that products or services will meet specified requirements, or where a number of minor nonconformities against the same requirement or issue show a systemic failure.
• Minor nonconformity (clause 3.13): a nonconformity that does not affect the capability of the management system to achieve the intended results.

The test is about capability to achieve intended results. A single missing signature on a toolbox talk record is rarely the same thing as having no control over subcontractor competence. If a grading seems out of proportion, ask the auditor to explain how the finding meets the 3.12 definition.

Your right to query a finding with the lead auditor

The standard expects conversation, not just a report. Under clause 9.4.5.4, the audit team leader shall attempt to resolve any diverging opinions between the audit team and the client about audit evidence or findings, and unresolved points shall be recorded.

The closing meeting reinforces this. Clause 9.4.7.3 says you shall be given the opportunity for questions, that diverging opinions shall be discussed and resolved where possible, and that any not resolved shall be recorded and referred to the certification body. Clause 9.4.7.2 also requires the closing meeting to include information about the CB’s complaint and appeal handling processes.

In practice:

• Raise your concern on the day, calmly, and show any evidence the auditor may not have seen.
• If it is not resolved, ask for your disagreement to be recorded. That record is your starting point for anything that follows.
• Keep notes of what was said and what evidence was offered.

The CB’s appeals and complaints process

If the conversation on site does not settle it, every accredited CB must have formal routes for you to use.

Appeals (clause 9.7). The CB shall have a documented process to receive, evaluate and make decisions on appeals. The people handling an appeal must be different from those who carried out the audit and made the certification decision (9.7.2), and the decision communicated to you must be made, or reviewed and approved, by people not previously involved (9.7.7). The CB must acknowledge your appeal, give you progress reports and the result (9.7.6), and making an appeal shall not result in any discriminatory action against you (9.7.3).

Complaints (clause 9.8). Complaints are handled separately, again with the requirement that submitting one shall not result in discriminatory action against the complainant (9.8.2), and the CB should give formal notice when the process ends (9.8.10).

Most CBs publish their complaints and appeals procedure on their website or in their certification terms. Read it before you submit, follow its format and deadlines, and put everything in writing.

Escalating to UKAS

UKAS is the UK’s national accreditation body, and it oversees whether accredited CBs keep meeting the standards they are accredited to. Its guidance is clear that you must complain to the accredited body first and give it the opportunity to investigate and respond. If you have done that and believe the requirements of the accreditation standard may not have been met, you can escalate to UKAS.

UKAS asks for complaints in writing, including a summary of who and what the complaint is about, a brief timeline, a copy of your complaint to the CB and any relevant correspondence. It also explains what it cannot do: it is not a regulator or an arbitration service, and financial disputes, contract matters and refund claims fall outside its remit. Keep your escalation focused on whether the CB followed ISO/IEC 17021-1, not on fees.

Where AI helps: an objective sense-check

This is where things have genuinely changed. You no longer need a consultant in the room to ask, “does this finding actually fit the clause?” A modern AI assistant can help you put a finding side by side with the requirement it cites and the evidence described, and highlight where they do not line up.

A simple approach:

1. Write down the finding exactly as recorded, the clause it cites and the evidence it refers to.
2. Ask the AI to compare the wording of the finding against the requirement you have in front of you, and to point out any gap between what the clause asks for and what the finding says is missing.
3. Ask it to test the grading against the major and minor definitions above.
4. Use the output to prepare clear, specific questions for the lead auditor.

A few sensible guardrails:

• Human judgement comes first. AI can misread a clause or miss context the auditor saw on site. Treat its answer as a prompt for thinking, not a verdict.
• Work from the real text. ISO standards are copyright, so use your own licensed copy and check any clause wording the AI gives you against it.
• Protect confidential information. Remove client names, personal data and commercially sensitive detail before using any AI tool, and follow your own data policy.
• Stay respectful. Assessors do a demanding job and most findings are fair. The aim is accuracy, not winning an argument. A polite, evidence based query is far more likely to get a finding corrected than a confrontation.

A quick checklist for your next assessment

• Does each nonconformity name a specific requirement?
• Is the objective evidence identified in detail?
• Does the grading match the clause 3.12 or 3.13 definition?
• Were your diverging opinions discussed and, if unresolved, recorded?
• Do you know where the CB’s complaints and appeals procedure is published?
• Have you kept written notes and copies of everything?

How Accendo can help

As an ISO consultant in the UK working closely with construction SMEs, we help clients prepare for UKAS certification audits, review findings after the event and, where needed, put together a clear, well evidenced query or appeal. If you are looking for an ISO 9001 consultant in Scotland or anywhere in the UK and want a second pair of eyes on a finding, get in touch for a friendly, no pressure chat.

Had an audit finding you are not sure about? UKAS CB NC (ISO/IEC 17021-1), OFI, Observation Process Check. We will look at the finding, the clause it cites and the evidence behind it, and give you a straight, practical view on whether it stands up.

Accendo Consultants: lean ISO, UKAS-credible, built for how you work.