A certificate on a website, a mark on a product box, a seal next to a job ad: all of them claim that someone checked something. What they rarely say is who checked, against what, and who checked the checker. Those three questions are the core of conformity assessment, the discipline that turns a written quality standard into a statement people can rely on.
This guide explains the vocabulary that certification bodies, regulators and procurement teams use every day. It is written for managers in U.S. companies who want to understand what a certificate actually proves before they pay for one, ask a supplier for one, or display one. Each term is explained in plain language.
In short: Conformity assessment is the demonstration that specified requirements are fulfilled. Testing, inspection and certification are the main techniques. Accreditation sits one level higher: it confirms that the body doing the testing, inspection or certification is competent and impartial. A certificate is only as strong as the standard behind it, the independence of the issuer and the accreditation (or lack of it) behind the issuer.
What conformity assessment means
The international vocabulary standard for this field is ISO/IEC 17000, prepared by ISO’s Committee on Conformity Assessment (CASCO). The U.S. National Institute of Standards and Technology quotes its definition in its glossary: conformity assessment is the demonstration that specified requirements relating to a product, process, system, person, or body are fulfilled. NIST adds that it may include testing, inspection and certification, as well as the accreditation of the bodies that perform them.
Two details in that definition matter more than they first appear.
- “Specified requirements.” There is no conformity assessment without a reference document. That can be an international standard such as ISO 9001, a government regulation, a customer specification or a privately published set of criteria. If an organization cannot show you the requirements its certificate refers to, you are not looking at conformity assessment in the technical sense.
- “Demonstration.” The result has to be based on evidence that someone else could, in principle, review. An opinion, a ranking based on votes or a paid listing does not meet that bar.
The current edition, ISO/IEC 17000:2020, replaced the 2004 version. According to the ANSI National Accreditation Board, the terms in the standard are built on a single concept system, so that words like “certification body” and “accreditation body” mean the same thing in every CASCO standard that uses them.
First, second and third party: who does the assessing?
Every conformity assessment answers the question of who is making the statement. The classic distinction has three levels:
- First-party assessment is carried out by the organization that provides the object itself. A manufacturer testing its own products or a company declaring that its own processes meet a standard is doing first-party assessment. A supplier’s declaration of conformity is a typical example.
- Second-party assessment is carried out by someone with a user interest in the object, usually a customer. A retailer auditing a supplier’s factory is a second party.
- Third-party assessment is carried out by a body that is independent of both the provider and the user. Certification is, by definition, a third-party activity.
None of these levels is “wrong.” A first-party declaration can be perfectly adequate for low-risk products. But the higher the stakes for buyers, employees or the public, the more weight the independence of the assessor carries. That is why many tenders, insurers and regulators ask for third-party certification instead of self-declaration.
The main techniques: testing, inspection, certification
Conformity assessment is an umbrella term. Under it sit several techniques, which are often combined in a single scheme. BSI lists them as testing, inspection, validation, verification, certification and accreditation.
Testing
Testing determines one or more characteristics of an object according to a procedure. It is the most widespread technique: a laboratory measures tensile strength, a lab checks food for contaminants, a software tool checks code against a security baseline. Laboratories that do testing and calibration are assessed against ISO/IEC 17025.
Inspection
Inspection examines an object and determines its conformity with requirements, and it often relies heavily on expert judgment. ISO’s CASCO points out that a key feature of inspection is that the determination of conformity is made on the basis of professional judgment, which makes the competence of the inspector central. Inspection bodies work under ISO/IEC 17020.
Validation and verification
Validation checks whether a claim about the future is plausible (for example, a projected greenhouse gas reduction). Verification checks whether a claim about the past is truthful (for example, a reported emissions figure). Both are increasingly common in sustainability reporting.
Certification
Certification is a third-party attestation that requirements have been fulfilled. It can apply to products, processes and services, to management systems, or to persons. Each has its own requirements standard for the body that does the certifying:
| What is certified | Example | Standard for the certification body |
|---|---|---|
| Products, processes and services | A product safety mark, a service certification, an employer certification scheme | ISO/IEC 17065 |
| Management systems | ISO 9001 quality management, ISO 14001 environmental management, ISO 45001 occupational health and safety | ISO/IEC 17021-1 |
| Persons | Professional credentials such as auditor or inspector certifications | ISO/IEC 17024 |
| Testing and calibration (not certification, but often part of it) | Accredited laboratories | ISO/IEC 17025 |
| Inspection | Equipment or facility inspection | ISO/IEC 17020 |
The difference between the first two rows is a frequent source of confusion. An ISO 9001 certificate says that an organization operates a quality management system that meets the standard. It does not say that every product the company sells has been tested. A product certification, by contrast, makes a statement about the product, process or service itself.
Accreditation: who checks the checker?
Accreditation is the formal recognition that a conformity assessment body is competent to carry out specific tasks. It is the layer that keeps the system honest. ANSI’s accreditation board explains the naming convention plainly: an organization that performs accreditation is called an “accreditation body,” and any other organization performing a conformity assessment activity is called a “conformity assessment body.”
In the United States, accreditation is mostly private rather than governmental. The ANSI National Accreditation Board (ANAB), for example, describes itself as a non-governmental organization that is a wholly owned subsidiary of the American National Standards Institute. ANAB accredits, among others, management system certification bodies to ISO/IEC 17021-1, product certification bodies to ISO/IEC 17065 and laboratories to ISO/IEC 17025. Other U.S. accreditation bodies that belong to the International Accreditation Forum include A2LA, IAS and IOAS, as listed on ANSI’s StandardsPortal.
Three practical points follow from this:
- Accreditation is always scoped. A body accredited to certify ISO 9001 is not automatically accredited for ISO 27001 or for a product scheme. Always check the scope on the accreditation body’s directory.
- Not every legitimate certificate is accredited. Many private schemes, including employer and service certifications, operate without accreditation. That is not illegal, but buyers should then look harder at transparency, independence and verification.
- Accreditation is not a quality seal for the certified company. It confirms the competence of the certifier. The certified organization should refer to its certificate, not to the accreditation body’s logo.
How big is the certification market?
The best-known data source is the annual ISO Survey. Since its move to IAF CertSearch, it counts certificates issued by certification bodies accredited by IAF members. The 2024 edition reported more than 1.47 million ISO 9001 certificates worldwide, a figure SGS also cites in its ISO 9001 overview.
One caution: the jump from earlier years is largely a change in data collection, not a sudden boom in quality management. Earlier surveys relied on voluntary reporting by certification bodies, so year-to-year comparisons across that change are not meaningful. The more useful takeaway is that accredited management system certification is a mature, global infrastructure, and that unaccredited private schemes exist next to it.
A quick test for any certificate
Our separate checklist on how to tell a credible quality seal from a marketing badge goes into more detail, including the FTC rules on seals.
Whether you are a buyer, an applicant or a company thinking about getting certified, these questions sort serious conformity assessment from marketing:
- Which standard or criteria? Can you read the requirements, or at least a detailed summary, before or after the assessment?
- Who assessed? Is the issuer independent of the certified organization? Does it publish how it handles conflicts of interest?
- What evidence? Was there testing, an audit, a survey of customers or employees, document review? Or only a questionnaire filled in by the company itself?
- What scope and period? Which sites, products or business units are covered, and until when?
- Can it be verified? Is there a public register or a verification page per certificate? Can certificates be suspended or withdrawn?
- Is it accredited? If yes, by whom, and does the scope of accreditation cover this certificate? If not, are the points above answered convincingly?
Where employer and service certifications fit
Most of the vocabulary above was developed for physical products and management systems. Certifications for employers or for customer service are newer. Conceptually, they are product or service certifications: the “object” is the workplace or the service experience, and the evidence comes from structured surveys, interviews and document review.
A well-designed scheme in this area borrows the discipline of classic conformity assessment. It publishes its criteria and scoring rules, sets minimum response rates so that a handful of answers cannot carry the result, separates the assessor from any consulting work, limits the validity period and lets anyone check a certificate’s status online. The USIQ Top Employer methodology is an example of this approach: it combines an employee survey and an evidence-based HR assessment, publishes minimum scores for each tier, and gives every certificate a unique verification link. USIQ, the United States Institute for Quality, is a partner in our network; its programs are private and employer-funded rather than government accreditation, and it says so openly.
If you want to understand how such schemes compare with ISO-type certificates, our overview of quality standards explains the main types, and USIQ’s article on business certification types looks at which certificates U.S. companies typically need.
Frequently asked questions
Is certification the same as accreditation?
No. Certification is about the company, product, service or person being assessed. Accreditation is about the body that does the certifying. A company is certified; a certification body is accredited.
Is ISO a certification body?
No. ISO develops and publishes standards. It does not certify organizations. Certificates are issued by independent certification bodies, some of which are accredited for the standard in question.
Does a certificate prove that a product is safe or that a company is a good employer?
A certificate proves conformity with the specific requirements it refers to, within its scope and period. It does not make claims beyond that. Reading the criteria is the only way to know what exactly has been confirmed.
Can a company certify itself?
A company can declare conformity (first-party declaration). It cannot issue itself a third-party certificate, because certification requires an assessor who is independent of the organization being assessed.