What 17021-1 requires of the certification decision

In a lot of certification bodies the certification decision looks like a formality: the report comes back from technical review, someone signs, the certificate goes out. ISO/IEC 17021-1 describes something quite different — a separate act, performed by a person who did not take part in the audit, on the basis of a complete file, and documented as its own record.

Three conditions the standard actually sets

The first is independence: whoever decides must not have audited the client. This is not a suggestion, it is the separation of duties that keeps the decision from being the auditor validating their own work. In a small body this is the constraint that hurts most, and the usual answer — a second qualified person who reviews rather than audits — is exactly what the standard has in mind.

The second is competence: the decision-maker has to be competent in the scheme and in the technical area of the client. Reading a report is not enough if you cannot tell whether the findings make sense for that sector. In practice this means your competence records have to cover decision-makers too, not only auditors — a gap assessors find often.

The third is information: the decision has to rest on the complete audit file. Report, findings with their evidence, corrective actions and their verification, scope, audit days, the audit team and its qualification. If any piece is missing the decision is not yet possible — which is why a pre-check of the pack before it reaches the decision-maker is worth more than it looks. That is the whole job of the Technical Review Agent: verify completeness, consistency and traceability so the human review is a review and not a hunt.

Why the queue forms here

Because the constraint is a person, not a process. Every certificate in the body funnels through the few people who may decide, and each one has to open the file and satisfy themselves that it holds together. When packs arrive incomplete or inconsistent, that person spends their time reconstructing instead of deciding, and the backlog grows faster than the team.

Nothing about that requires the decision itself to move. It requires everything around it to arrive ready. The decision stays where the standard puts it — with a competent person of the certification body — and the hours that used to go into assembling and checking the file go back to the work only people can do.