IAF MD 2 – Certificate transfers

Transfers of accredited management system certifications (e.g. ISO 9001 or ISO/IEC 27001) between certification bodies may be possible in a wide variety of scenarios and are intended to maintain the integrity of accredited management system certifications. The following reasons may lead to a transfer:

Change of certification body in the course of a recertification
Change of certification body in the course of a surveillance audit
Change of certification body because the certification body that issued the certificate has lost its accreditation

There are minimum requirements for the transfer of certificates that must be complied with during this transfer process. The relevant requirements can be found in the IAF MD 2 document.

General requirements

The following summarises the general requirements that must be taken into account:

Formally: "Only certifications covered by accreditation from an IAF or local signatory at Level 3 and, where necessary, Levels 4 and 5 shall be eligible for transfer." This means that certification bodies which are not accredited for ISO/IEC 27001, for example, may not take over ISO/IEC 27001 certificates.
Only certificates that are active – and therefore not suspended or expired – can be transferred.
If a certification body loses its accreditation, the transfer must be completed within six months or by the expiry of the certification, whichever occurs earlier.

Process for transferring a certificate

In the following, we distinguish between the issuing certification body (CERT-Old) and the accepting certification body (CERT-New). Aside from technical requirements, CERT-New must carry out an assessment of the procedure and the certificate. This assessment includes at least a document review of the management system. It can be supplemented by a visit to the sites within the scope, as well as an effectiveness review of the implemented measures, if effectiveness cannot be established from the document review or in the case of evident major deficiencies. The assessment must cover at least the following aspects, and its findings must be fully documented:

confirmation that the client's certification falls within the accredited scope of both the issuing and the accepting certification body,
reasons for requesting a transfer,
that the site or sites requesting the transfer hold a valid accredited certification,
the audit reports of the initial certification or the most recent recertification, as well as the latest surveillance report, and
the status of any outstanding non-conformities arising from previous audits, as well as all other relevant documentation on the certification process.

If the audit reports are not made available, or the surveillance or recertification audit was not completed as required by the previous certification body's audit programme, the accepting certification body must carry out a new initial certification audit for the management systems concerned.

Clause 2.2.4 of the IAF MD 2 document sets out which criteria must be assessed in detail.

When is a transfer not possible?

There can be several reasons why certificates may not or cannot be transferred. The main reasons usually do not concern formal aspects, but rather that the assessment cannot be completed successfully.

Cooperation between CERT-Old and CERT-New is also important in this context. On request, CERT-Old must provide CERT-New with the necessary documents and information so that the assessment can be carried out. If CERT-New has not been able to establish communication with the issuing certification body, the reasons must be recorded and all necessary efforts must be made to obtain the required information from other sources (e.g. directly via the client).

What happens after the transfer?

If no issues were identified during the assessment, the certification cycle is based on the previous certification cycle and the accepting certification body takes over the audit programme for the remainder of the certification cycle.

As an accredited certification body, RSM Certification GmbH can take over existing certificates for ISO/IEC 27001 and ISO 9001 (EAC codes 33 and 35), among others.

This entry does not claim to cover all individual requirements of IAF MD 2:2023 in full. Rather, it is intended as a summary of the key requirements – particularly from a customer perspective.

Go back

IAF MD 11 – Audits of integrated management systems to ISO/IEC 17021-1

How can organisations with several management systems – for example for quality and information security – make their audit processes more efficient? The IAF MD 11:2023 guidance provides answers to the key questions on auditing integrated management systems. In our article you will learn exactly what the "degree of integration" is, how it affects audit time, and why a high level of integration can save real money. We show you which requirements conformity assessment bodies must meet, how the audit effort is calculated, and give a concrete worked example for practice. A must for anyone looking to optimise audits and avoid unnecessary duplicate assessments.

IAF MD 1 – Auditing and certification of management systems in multi-site organisations

How does certification work for organisations with multiple sites – and what needs to be considered in multi-site audits? The IAF MD 1:2023 guidance sets out clear requirements, which we examine more closely in this article. From the definition of key terms such as "head office" and "sites", through the requirements for matrix certifications, to the question of when a sampling procedure makes sense and when it does not: we provide a comprehensive overview of the factors that influence audit effort and audit duration. Discover the key prerequisites and find out how best to prepare the certification process for your multi-site organisation. An indispensable guide for organisations looking to structure their certification effort clearly.

IAF MD 4 – Use of information and communication technology (ICT) in audits

Digital technologies in audits – yes or no? IAF MD 4:2023 sets out clear rules on how information and communication technology (ICT) can be used for audit purposes and when remote delivery is possible. This article gives you an overview of the fundamental requirements a certification body must meet when audits are carried out using ICT. Find out how virtual sites are defined, which conditions apply to the use of ICT, and how factors such as security, confidentiality and procedural requirements are taken into account. A must for organisations considering ICT for more efficient audits.

IAF MD 26 – Transition from DIN EN ISO/IEC 27001:2017 to ISO/IEC 27001:2022

The transition to the new ISO/IEC 27001:2022 is unavoidable for certified organisations. The IAF MD 26:2023 document defines clear requirements and deadlines to ensure the transition from DIN EN ISO/IEC 27001:2017 to the new standard. Certified organisations have a transition period until 31 October 2025 to maintain their certification. This article summarises the key points of the transition – from the requirements for updating the ISMS and the Statement of Applicability through to the minimum effort involved in the audit. An essential guide for anyone looking to master the changeover successfully.

IAF MD 29 – Transition to ISO/IEC 27006:2024

With the publication of ISO/IEC 27006:2024, certification bodies face an important transition. IAF MD 29 governs the changeover to this new standard for information security management systems and primarily affects certification and accreditation bodies, with no direct impact on certified organisations. Certification bodies such as RSM Certification GmbH have two years to complete the transition, from the gap analysis through to the final audit by DAkkS. Find out here which steps are needed for a successful transition to ISO/IEC 27006:2024.