ISO/IEC Standards (ISO 9001:2015, ISO 27001:2022, ISO 14001:2015, ISO 45001:2018) / Quality Council of India (QCI) & NABCB Accreditation Framework

ISO Management System Advisory

End-to-end ISO 9001 (QMS), ISO 27001 (ISMS), ISO 14001 (EMS), and ISO 45001 (OHSMS) documentation, implementation advisory and internal audits. Certification itself is carried out by an independent accredited certification body.

CA Due Diligence

Official Portal Filing

State Stamp Advisory

ISO Management System Advisory Statutory Advisory

Statutory Filing

MCA & Tax Practice

Relevant RegulatorNational Accreditation Board for Certification Bodies (NABCB), Quality Council of India (QCI) & International Accreditation Forum (IAF)

nabcb.qci.org.in

External link to the official website of the relevant authority. H A V N & COMPANY is not affiliated with any government authority.

Visit Official Website

STATUTORY OVERVIEW

ISO Management Systems, Documentation & Internal Audits

In competitive government procurement on GeM (gem.gov.in), public infrastructure tenders, international supply chain onboarding, and enterprise vendor assessments, holding an accredited ISO certification is a mandatory qualification criterion. However, certificates issued by unaccredited 'non-IAF' certificate mills are rejected during tender technical evaluations. Under the Quality Council of India (QCI) and the National Accreditation Board for Certification Bodies (NABCB on nabcb.qci.org.in), authentic ISO compliance requires documented standard operating procedures (SOPs), mandatory internal audits, management review meetings (MRM), and a two-stage audit by an accredited certification registrar. Our firm provides ISO documentation and implementation advisory; certification is by the organisation's chosen certification body.

Statutory & Practice Summary • At-A-Glance

ICAI UDIN Authentication Mandate

Governing Framework

ISO/IEC Standards (ISO 9001:2015, ISO 27001:2022, ISO 14001:2015, ISO 45001:2018) / Quality Council of India (QCI) & NABCB Accreditation Framework

Regulatory Authority

National Accreditation Board for Certification Bodies (NABCB), Quality Council of India (QCI) & International Accreditation Forum (IAF)

Professional Assurance

Chartered Accountants Attestation under ICAI Standards & Code of Ethics

DOCUMENTATION MATRIX

Mandatory Documents Checklist

Self-attested scanned copies required

1. Promoters / Partners / Directors KYC

✓Certificate of Incorporation, Partnership Deed, or Business Registration Proof
✓Company Permanent Account Number (PAN) Card & GST Registration Certificate
✓Organizational Hierarchy Chart, Job Descriptions & Responsibilities Matrix
✓Current Process Flowcharts & Standard Operating Procedures (SOPs)

2. Registered Office & Premises Proof

✓Customer Purchase Orders, Service Level Agreements (SLAs) & Vendor Contracts
✓List of Measuring Equipment, Calibration Certificates & Software Tools (if applicable)
✓Premises Layout Drawing, Safety Equipment Logs & Environmental Approvals (for ISO 14001)
✓IT Infrastructure Inventory, Access Control Logs & Data Backup Policies (for ISO 27001)

PROCEDURAL ROADMAP

Step-by-Step Filing & Approval Process

Structured execution roadmap managed by our Chartered Accountants from pre-filing due diligence to certificate allotment.

01Standard

Gap Analysis & Scope Definition

Evaluating existing operational workflows against the target ISO standard and identifying documentation deficiencies.

02Standard

Documentation & SOP Formulation

Drafting Quality Manuals, mandatory procedures, risk assessment registers, and operational control logs.

03Standard

Implementation & Internal Audit

Conducting staff training, performing mandatory internal audits, and facilitating the Management Review Meeting (MRM).

04Standard

External Audit Readiness

Reviewing readiness before the organisation's Stage 1 and Stage 2 audits by its chosen certification body.

ISO 9001:2015 Quality Management Systems (QMS)

Practice Scope & Statutory Guidance

The global benchmark for operational excellence. We draft custom quality manuals, establish risk-based process maps, define key performance indicators (KPIs) across departments, and train internal auditors to ensure consistent product and service delivery that satisfies procurement evaluators.

ISO 27001:2022 Information Security Management (ISMS)

Practice Scope & Statutory Guidance

Mandatory for IT, SaaS, fintech, and data processing firms. We establish comprehensive Information Security Management Systems aligned with the Digital Personal Data Protection (DPDP) Act, 2023, conducting risk assessments across data assets, access controls, cryptography, incident response, and vendor security.

Preparing for the Certification Audit

Practice Scope & Statutory Guidance

Certification is granted by a certification body accredited by an accreditation board such as NABCB (India). The organisation chooses and contracts the certification body directly. We help prepare the documentation and records reviewed in the Stage 1 and Stage 2 audits.

STATUTORY MATRIX

Statutory Provisions & Regulatory Comparative Matrix

Comparative analysis of governing sections under the new framework alongside legacy statutory references.

ISO Standard	Core Governance Focus	Target Business Sectors	Statutory Accreditation / Portal
ISO 9001:2015	Quality Management System (QMS)	Manufacturing, Trading, Services, GeM Tender Bidders	NABCB / IAF / https://nabcb.qci.org.in/
ISO 27001:2022	Information Security Management (ISMS)	IT/ITeS, SaaS, Fintech, BPO, Data Centers	NABCB / IAF / DPDP Act Compliant
ISO 14001:2015	Environmental Management System (EMS)	Chemicals, Construction, Heavy Manufacturing, Green Tenders	Pollution Control Board Standards
ISO 45001:2018	Occupational Health & Safety (OHSMS)	Factories, Infrastructure, Mining, Logistics, Warehousing	Central Labor Standards & DGMS
ISO 22000:2018	Food Safety Management System (FSMS)	Food Processors, Packaging, Commercial Kitchens, Exporters	FSSAI / Codex Alimentarius Standards

ONGOING GOVERNANCE

Mandatory Post-Registration Compliances

Failing to complete statutory post-incorporation actions carries steep daily penalties. Our CA firm manages continuous compliance:

CompliancePeriodic

Annual Surveillance Audit (Year 1 & 2)

Mandatory annual surveillance audits conducted by the registrar to maintain certificate validity over the 3-year cycle.

CompliancePeriodic

Quarterly Internal Quality Audits

Conducting recurring internal audits to ensure standard operating procedures are strictly followed by team members.

CompliancePeriodic

Management Review Meetings (MRM)

Documenting bi-annual leadership review meetings analyzing customer satisfaction scores and process non-conformances.

CompliancePeriodic

Triennial Recertification Audit

Comprehensive recertification audit prior to the end of the 3-year validity period for seamless certificate renewal.

FREQUENTLY ASKED QUESTIONS

Statutory FAQs & Practical Guidance

Frequently asked questions and procedural guidance regarding ISO Management System Advisory.

What is the difference between an IAF and non-IAF ISO certificate?

An IAF (International Accreditation Forum) accredited certificate is issued by a certification body recognized by national accreditation boards like NABCB in India (https://nabcb.qci.org.in/) or UKAS in the UK. It is globally recognized, verifiable on international databases, and legally accepted in government tenders and corporate bids. A non-IAF certificate is issued by unaccredited private entities and is routinely rejected by tender evaluation committees and enterprise clients.

How long is an ISO certificate valid and what is a surveillance audit?

An ISO certificate is valid for a period of 3 years from the date of issuance. However, to maintain its validity, the accredited certification body must conduct mandatory annual surveillance audits (at the end of Year 1 and Year 2) to ensure the organization continues to adhere to the standard's requirements. Failure to complete surveillance audits results in certificate suspension.

Why is ISO 27001 mandatory for IT, SaaS, and technology companies?

ISO 27001:2022 provides an internationally validated framework for Information Security Management Systems (ISMS). Enterprise clients and overseas customers in the US and Europe require vendors to hold ISO 27001 certification to prove that customer proprietary data, source code, and personal information are protected against cyber threats and compliant with data privacy laws such as the DPDP Act and GDPR.

What does an ISO 9001 implementation involve?

The time taken depends on the organisation's size and existing processes, and on the certification body's schedule. Implementation includes conducting a gap analysis, drafting SOPs, training staff, running internal audits, holding a Management Review Meeting, and completing the Stage 1 and Stage 2 audits with the accredited registrar.

STATUTORY ADVISORY DESK • PRACTICE INQUIRIES

Statutory Inquiries & Practice Advisory

Information on ISO Management System Advisory is provided for general reference. Office addresses and contact details are listed on the Contact page.

Contact Practice Office +91 99140-14949