If you are exploring ISO certification for the first time, the terminology can feel like its own language. QMS, ISMS, SAAC, surveillance audit, non-conformity. Each term carries specific weight in the certification process, and misunderstanding even one can slow down your audit or lead to unnecessary corrective work.
This glossary breaks down the terms that come up most often when Saudi businesses pursue ISO certification, from the standards themselves to the audit and accreditation language used by certification bodies operating in the Kingdom.
Management System Standards
Contents
QMS (Quality Management System)
A QMS is the structured set of policies, processes, and procedures an organization uses to consistently meet customer and regulatory requirements. ISO 9001 is the international standard for QMS, and it remains the most widely adopted certification among Saudi manufacturers, contractors, and service providers working with entities like Aramco and SABIC. A well documented QMS covers everything from document control to management review meetings.
Learn more on our ISO 9001 Certification.
ISMS (Information Security Management System)
An ISMS is a systematic approach to managing sensitive company and customer information so it stays secure. ISO 27001 sets the requirements for building an ISMS, covering risk assessment, access control, and incident response. As Saudi organizations digitize under Vision 2030 and face growing SFDA and regulatory scrutiny around data handling, ISO 27001 has become a common requirement in government and healthcare tenders.
Learn more on our ISO 27001 Certification.
EMS (Environmental Management System)
An EMS is a framework that helps an organization identify, monitor, and reduce its environmental impact. ISO 14001 is the governing standard, and it is increasingly requested by clients in construction, industrial, and petrochemical sectors where environmental compliance is tied to project approvals. An EMS typically covers waste management, resource use, and emergency preparedness for environmental incidents.
Learn more on our ISO 14001 Certification.
OHSMS (Occupational Health and Safety Management System)
An OHSMS is a structured approach to preventing workplace injuries and illnesses. ISO 45001 replaced the older OHSAS 18001 standard and is now the internationally recognized benchmark. For Saudi contractors bidding on Aramco or government infrastructure projects, ISO 45001 certification is often a prerequisite for tender eligibility, since it demonstrates a documented commitment to worker safety.
Learn more on our ISO 45001 Certification.
Accreditation and Governance Bodies
SAAC (Saudi Accreditation Center)
SAAC is the national accreditation body of Saudi Arabia. It accredits certification bodies, testing laboratories, and inspection bodies operating within the Kingdom to confirm they meet international competence standards. When a Saudi business chooses a certification body, checking whether that body holds SAAC accreditation (or accreditation from another IAF-recognized body) is one of the first due diligence steps, since it affects whether the resulting certificate is recognized by Etimad, government tenders, and large corporate buyers.
IAF (International Accreditation Forum)
The IAF is the global association of accreditation bodies and other organizations involved in conformity assessment. Its Multilateral Recognition Arrangement (MLRA) means that a certificate issued by an IAF-recognized certification body is accepted across all member countries. For Saudi exporters, IAF recognition is often what determines whether an ISO certificate will actually be accepted by an overseas client or regulator.
Certification Body (CB)
A certification body is the accredited third party organization that audits a business against an ISO standard and issues the certificate. It is a separate entity from a consultancy that helps prepare an organization for certification. Choosing an accredited, reputable certification body matters just as much as the preparation work itself, since an unaccredited certificate can be rejected by clients and government portals.
The Audit Process
Gap Analysis
A gap analysis is a preliminary review comparing an organization’s current practices against the requirements of a chosen ISO standard. It identifies where existing processes fall short, what documentation is missing, and how much work is needed before a formal audit. Most consultancies, including ours, recommend a gap analysis as the first step, since it prevents surprises during the actual certification audit.
Internal Audit
An internal audit is a self-assessment an organization conducts on its own management system before the external certification audit. ISO standards require organizations to carry out internal audits at planned intervals as part of maintaining certification. It is a chance to catch and fix issues internally rather than have them surface in front of an external auditor.
Stage 1 and Stage 2 Audit
Certification audits under most ISO standards happen in two stages. Stage 1 is a documentation review, where the auditor checks whether the management system is designed correctly on paper and whether the organization is ready for the next step. Stage 2 is the full on-site audit, where the auditor verifies that the system is actually implemented and functioning in daily operations.
Surveillance Audit
A surveillance audit is a follow-up audit conducted periodically, typically once a year, after initial certification is granted. Its purpose is to confirm the management system continues to meet the standard’s requirements between the three-year recertification cycles. Missing or failing a surveillance audit can result in certificate suspension, so ongoing compliance matters just as much as the initial push to get certified.
Recertification Audit
A recertification audit takes place at the end of a three-year certification cycle and is more comprehensive than a surveillance audit. It reassesses the entire management system to confirm it still meets the standard before the certificate is renewed for another three years.
Findings and Corrective Actions
Non-conformity
A non-conformity is a finding where an organization’s practice does not meet a specific requirement of the ISO standard. Non-conformities are typically classified as major or minor. A major non-conformity signals a serious breakdown in the system and can delay certification, while a minor non-conformity is a smaller gap that still needs to be addressed but usually does not block certification on its own.
Corrective Action
A corrective action is the documented response an organization takes to fix a non-conformity and prevent it from happening again. It usually involves identifying the root cause, not just the symptom, and updating processes or training so the same issue does not recur. Auditors expect to see evidence of corrective action, not just a promise to do better.
Root Cause Analysis
Root cause analysis is the investigative process used to find the underlying reason a non-conformity occurred, rather than just addressing its surface symptoms. Common methods include the “5 Whys” technique and fishbone diagrams. A corrective action built on a shallow root cause analysis tends to fail during the next audit cycle.
Ongoing Compliance
Continual Improvement
Continual improvement is a core requirement embedded in every ISO management system standard. It means the organization is expected to keep refining its processes over time, not just maintain the minimum bar set at certification. This is usually driven through the PDCA cycle (Plan, Do, Check, Act), which structures how improvements are identified, tested, and rolled into standard practice.
Scope of Certification
The scope of certification defines exactly which locations, activities, products, or services a certificate covers. A certificate for a company’s Riyadh office does not automatically extend to a Jubail branch unless that location is explicitly included in the scope. Reviewing the scope statement is one of the fastest ways to verify whether a certificate actually applies to the work in question.
Frequently Asked Questions
What is the difference between a QMS and ISO 9001?
A QMS is the general concept of a quality management system. ISO 9001 is the specific international standard that defines the requirements a QMS must meet to be certified.
Does SAAC accreditation matter more than IAF recognition?
Both matter. SAAC accreditation confirms recognition within Saudi Arabia, while IAF recognition confirms the certificate will be accepted internationally. For businesses serving both local and export markets, checking for both is worthwhile.
How often does a business need a surveillance audit?
Typically once a year during the three-year certification cycle, though the exact schedule depends on the certification body and the standard involved.
Is a major non-conformity always a certification blocker?
Yes, in most cases a major non-conformity must be resolved and verified before the certification body will issue the certificate.
