ISO certification in Nigeria: how it works

Many Nigerian organisations first look into ISO certification because a customer asks for a certificate. The questions that follow are usually the same: who is allowed to issue it, whether the certificate will be accepted, how the audits work and what they cost. This guide answers those questions for ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001, with the Nigerian details made explicit.

Who certifies management systems

ISO writes the standards but does not certify anyone, and it does not accredit the bodies that do. Certification is carried out by independent certification bodies, which audit an organisation’s management system against a standard and issue a certificate if it conforms.

In Nigeria there are two broad groups of certification body.

SON’s management systems certification department. The Standards Organisation of Nigeria (SON) is Nigeria’s member body in ISO. It also runs a third-party certification department, SON Management Systems Certification (SON-MSC), which SON says began certifying in 1994 and operates to ISO/IEC 17021, the requirements standard for bodies certifying management systems. SON states that SON-MSC was accredited by the International Accreditation Service (IAS) in January 2024 for ISO 9001, ISO 14001, ISO 45001 and ISO 22000. SON-MSC also offers certification against other standards, including ISO/IEC 27001 and ISO 50001, but these sit outside that stated accreditation scope.

International and private certification bodies. A number of certification bodies headquartered elsewhere operate in Nigeria through local offices or partners, alongside Nigerian-owned bodies. They differ in which standards they are accredited for, which accreditation body accredits them, and how many local auditors they have. Treat each one on its own evidence rather than its name.

Accreditation and why it matters

Accreditation is the independent check on the certification body. An accreditation body assesses whether the certification body is competent and impartial to certify against a particular standard, in particular industry sectors. Accreditation is given for a defined scope, so a body can be accredited for ISO 9001 and not for ISO/IEC 27001.

Most national accreditation bodies belong to the International Accreditation Forum (IAF). Signatories of the IAF Multilateral Recognition Arrangement (MLA) agree to recognise certificates issued under each other’s accreditations, which is why an accredited certificate tends to be accepted by buyers abroad. IAS, for example, lists itself as an IAF MLA signatory for quality, environmental, occupational health and safety, information security and several other management system schemes.

ISO’s own advice is that accreditation is not compulsory, and that a non-accredited certification body is not necessarily a poor one. In practice, though, a buyer or tender that asks for a certificate from an approved or accredited body will usually reject one it cannot verify.

How to check a certificate is accredited

Whether you are choosing a certification body or vetting a supplier’s certificate, the checks are the same.

1. Search IAF CertSearch. This is the IAF’s database of accredited management system certifications. Certification bodies accredited by IAF MLA signatories upload their certificates to it under an IAF mandatory document, and a result shows the standard, the scope, the certified sites, validity, the issuing certification body and the accreditation body. Unregistered users can verify a small number of certificates each day; registered accounts get more, and bulk checking needs a subscription.
2. Read the scope on the certificate. The scope should describe the activities and sites the buyer cares about. A certificate for “head office administration” says nothing about a fabrication yard.
3. Check the accreditation covers the standard. Ask the certification body for its accreditation certificate and schedule, and confirm the standard on your certificate is listed.
4. Ask when the certificate is not found. CertSearch only holds accredited certifications, so absence is a reason to ask questions, not proof of fraud. The certification body or the accreditation body can confirm the status directly.

MANCAP is not management system certification

This is the commonest source of confusion in Nigeria. SON runs two quite different schemes.

Aspect	MANCAP	Management system certification
What is certified	A product manufactured in Nigeria	An organisation’s management system
Assessed against	The applicable Nigerian Industrial Standard for the product	A management system standard such as ISO 9001 or ISO 45001
Who runs it	SON, under the SON Act 14 of 2015	SON-MSC or another certification body
Mandatory?	Yes, for the locally manufactured products it covers	Generally voluntary, though customers and tenders may ask for it
What a buyer learns	The product met its standard when assessed	The organisation runs a system that conforms to the standard

A manufacturer can, and often does, hold both. A MANCAP certificate will not satisfy a tender that asks for ISO 9001, and an ISO 9001 certificate does not replace MANCAP for a product that requires it.

The certification cycle

The cycle below reflects the way accredited certification bodies typically work under ISO/IEC 17021-1. Details, such as the gap allowed between stages, vary between bodies, so confirm them in your contract.

• Application and quotation. The certification body asks about your scope, sites, headcount and processes, and uses them to calculate audit time.
• Stage 1 audit. Usually a review of documented information and readiness: whether the scope makes sense, whether internal audits and a management review have been completed, and whether you are ready for stage 2. Gaps raised here are concerns to fix, not yet nonconformities.
• Stage 2 audit. The full assessment of whether the system is implemented and effective, sampling processes, sites and records. Nonconformities are graded; a major nonconformity normally has to be closed with evidence before certification is recommended, while minor ones need an accepted action plan.
• Certification decision. Usually made by someone at the certification body who was not on the audit team, after reviewing the report.
• Surveillance audits. Typically once a year in years one and two, each sampling part of the system and checking that earlier findings were closed.
• Recertification audit. In the third year, before the certificate expires, a fuller audit renews certification for a further cycle.

Missing a surveillance audit, or failing to close a major nonconformity in time, can lead to suspension. Plan the dates into your own audit programme so they are not a surprise.

Choosing a certification body

ISO suggests evaluating more than one body, checking that it works to the relevant conformity assessment standards, and checking whether it is accredited. For a Nigerian organisation, these questions usually separate the options:

• Accreditation scope. Is the body accredited for your standard and your industry sector? Ask for the schedule, not a logo.
• Acceptance by your customers. If a key customer or an oil and gas operator names approved bodies, start from that list.
• Local auditors. Auditors based in Nigeria reduce travel cost and scheduling delays, and know local regulation.
• Sector competence. Auditors who know your industry find real issues rather than paperwork ones.
• Multi-site and integrated audits. If you have several sites, or want ISO 9001, 14001 and 45001 audited together as an integrated audit, ask how the body samples sites and combines audit time.
• Impartiality. A certification body should not also have built your management system. Treat offers of consultancy plus certification from the same organisation with caution.

Costs. Fees are quoted per audit day, plus travel, with application or certificate fees at some bodies. Accredited bodies calculate audit time under IAF mandatory documents such as IAF MD 5, mainly from the effective number of personnel and the complexity or risk of your activities, so headcount, the number of sites and the number of standards are the main drivers. Compare quotes on audit days, not just the total, and ask what surveillance and recertification will cost over the whole cycle.

Common reasons for nonconformities

First certification audits in any country tend to raise the same issues. Most are about evidence that the system runs, not about missing procedures.

• Internal audits not covering the whole scope, or done once in a rush before stage 1. Auditors look for a planned programme and records that show it ran. The guide on risk-based audit programmes covers how to build one.
• No completed management review, or minutes that do not address the inputs the standard requires.
• Corrective actions without root cause or verification. The finding is “closed” but nothing shows the cause was found or the fix worked. See root cause and corrective action.
• Uncontrolled documents, such as superseded procedures in use on site.
• Competence records missing for people whose work affects conformity, particularly contractors.
• Legal requirements not tracked, a frequent issue for ISO 14001 and ISO 45001, where auditors expect a register of applicable Nigerian requirements and evidence of compliance evaluation.
• Objectives with no measurement, or measures nobody reviews.

Most of these come down to records that are scattered or missing. In Orisynx, audits, findings, corrective actions and evidence sit in one record, and every action passes through verification before it can close, which is what certification auditors sample. Orisynx does not certify organisations or guarantee a certificate. For the weeks before the audit itself, see preparing for a certification audit.

Sources

• SON: Management System Certification (SON-MSC)
• Food Business MEA: SON’s management systems certification department attains international accreditation
• ISO: Standards Organisation of Nigeria member page
• SON: MANCAP
• Food Business MEA: SON issues MANCAP certification to 12 companies
• ISO: Certification
• ISO help: How to verify an accredited certification
• IAF CertSearch FAQ
• IAF: IAF MD 28 drives upload of over 2.5 million certifications
• IAS: About IAS
• ANSI blog: What are IAF mandatory documents MD 1, 5 and 11
• Amtivo: The three-year certification cycle