Skip to content

We use necessary technical cookies and measure only if you accept. Accept turns on our own measurement, Google Analytics, Google Ads and the Meta pixel; Reject keeps everything off, and you can change it at any time. See the details

Knowledge to decide better

All the material is on this page: sectors, regulation, market data, coverage, articles, press, glossary and questions. Each figure states where it comes from.

65 articles30 terms35 questions
Data presentation before an audience
Data presentation at a conferenceG-CERTI archive

Each sector asks for something different

Eight chains with published situations. Choose one to see its cases, what its market asks for and the standards that respond.

Sector

Technology and software

SaaS, fintech, cloud and digital service companies that need to demonstrate security and governance maturity.

Standards that answer
When the request comes up
  • A software vendor demonstrates its information security system to an enterprise customer
  • A SaaS company prepares evidence for a tender
What this market asks for
  • Information security requirements in enterprise procurement
  • Evidence of service continuity in critical contracts

What regulation requires today

Five public frameworks in force and the management system standard that helps you arrive prepared for each one.

Artificial intelligence

Governance of AI systems

The European Union AI Act (Regulation 2024/1689), the first comprehensive regulatory framework on artificial intelligence.

What it requires
The AI Act classifies AI systems by risk level and requires those who develop or deploy high-risk systems to provide risk management, data governance, human oversight, technical documentation and traceability throughout the life cycle.
How the standard helps
ISO/IEC 42001:2023 defines an artificial intelligence management system with a risk-based, life-cycle approach that is very close to the spirit of the AI Act. Operating this system helps an organization organize its AI governance and arrive better prepared when it must demonstrate control over its models.
Personal data and privacy

Personal data protection

The GDPR in the European Union (Regulation 2016/679), the LGPD in Brazil (Law 13.709/2018) and a growing set of national data protection laws in Latin America.

What it requires
These frameworks require a legal basis for processing personal data, the principles of data minimization and purpose limitation, data subject rights, breach management and demonstrable accountability for how privacy is governed.
How the standard helps
ISO/IEC 27701:2025 defines a certifiable privacy information management system (PIMS), with controls for controllers and processors; it operates on its own or integrated with an ISO/IEC 27001 ISMS. Adopting this structure helps an organization organize its privacy practices and back its accountability with evidence.
Information security

Cybersecurity and digital resilience

The NIS2 Directive in the European Union, sector-specific cybersecurity regimes and contractual requirements from customers and supply chains that call for demonstrable controls.

What it requires
These frameworks call for security risk management, access control, incident response, continuity and evidence that the controls exist in operation and are maintained over time.
How the standard helps
ISO/IEC 27001:2022 establishes a risk-based information security management system with a catalog of auditable controls. Operating it helps an organization structure its security posture and respond with evidence when a customer, a regulator or an audit requires it.
Compliance and anti-corruption

Bribery and corruption prevention

Anti-corruption frameworks with extraterritorial reach such as the FCPA (United States) and the UK Bribery Act, together with national integrity and compliance legislation in the region.

What it requires
These frameworks expect the organization to demonstrate due diligence, third-party controls, reporting channels, training and a living integrity program overseen by top management.
How the standard helps
ISO 37001 defines an anti-bribery management system with the components these frameworks expect to see. Implementing it helps an organization structure its integrity program and show regulators or partners that the control exists and is carried out.
Sustainability and climate

Environmental and carbon reporting

The European Union's CSRD on corporate sustainability reporting and a growing set of ESG and carbon footprint reporting requirements across global value chains.

What it requires
These frameworks call for reliable and comparable environmental information: impact management, emissions measurement and measured data that can stand up before a third party.
How the standard helps
ISO 14001 organizes environmental management with a life-cycle perspective, and the ISO 14064 family provides the framework for quantifying and verifying greenhouse gas emissions. Relying on these standards helps an organization produce defensible environmental data for its sustainability reports.

Where certification happens today

Valid management system certificates worldwide, by region and by standard.

2,963,855valid certificates worldwideISO Survey 2024 · IAF CertSearch
86,232in Latin America and the Caribbean · 2.9 %ISO Survey 2024 · IAF CertSearch
1,474,113ISO 9001 certificates worldwideISO Survey 2024 · IAF CertSearch

By region

Asia2,081,67270.2 %
Europe671,77422.7 %
Latin America and the Caribbean86,2322.9 %
North America52,2181.8 %
Oceania39,5071.3 %
Africa32,4521.1 %

By standard

ISO 90011,474,113
ISO 14001676,232
ISO 45001542,526
ISO 2200059,521
ISO 5000138,482
ISO 1348531,214

Source: ISO Survey 2024 · IAF CertSearch · Data year: 2024 · World total: 2,963,855 · In every region, the standard with the most certificates is ISO 9001.

Where audits take place and with what arrangement

One international operation with a presence in 97 countries. In the Americas, each country is served directly, with a local audit team, or by consultation, assessed case by case.

18 countries

Direct service

Local audit team and assigned account executive.

  • ArgentinaBuenos Aires · Córdoba · Rosario · Mendoza
  • ChileSantiago · Antofagasta · Concepción · Valparaíso
  • UruguayMontevideo · Punta del Este
  • ParaguayAsunción · Ciudad del Este
  • ColombiaBogotá · Medellín · Cali · Barranquilla
  • EcuadorQuito · Guayaquil · Cuenca
  • BoliviaSanta Cruz de la Sierra · La Paz · Cochabamba
  • VenezuelaCaracas · Valencia · Maracaibo
  • PanamaPanama City · Colón
  • GuatemalaGuatemala City · Quetzaltenango
  • HondurasTegucigalpa · San Pedro Sula
  • El SalvadorSan Salvador · Santa Ana
  • NicaraguaManagua · León
  • Dominican RepublicSanto Domingo · Santiago de los Caballeros · Punta Cana
  • CubaHavana · Santiago de Cuba
  • Puerto RicoSan Juan · Ponce
  • Trinidad and TobagoPort of Spain · San Fernando
  • JamaicaKingston · Montego Bay
12 countries

Consultation

Request assessed case by case.

  • PeruLima · Arequipa · Trujillo · Callao
  • Costa RicaSan José · Alajuela · Cartago
  • BelizeBelize City · Belmopan
  • MexicoMexico City · Monterrey · Guadalajara · Querétaro · Tijuana
  • BrazilSão Paulo · Rio de Janeiro · Belo Horizonte · Curitiba · Porto Alegre
  • GuyanaGeorgetown
  • SurinameParamaribo
  • BahamasNassau · Freeport
  • BarbadosBridgetown
  • HaitiPort-au-Prince · Cap-Haïtien
  • ArubaOranjestad
  • CuraçaoWillemstad

Coverage communicates scope and availability. The accredited scope by standard is published in the Trust Center.

Technical articles

Applied explanations on certification, auditing and management systems.

Glossary of ISO terms

The words you will find in a proposal, an audit report or a certificate, with their definition, the clause they come from and an example.

  • Accreditation

    Third-party attestation that a conformity assessment body is competent to perform specific tasks. It is granted by an accreditation body, independent of the certifier.

    ISO/IEC 17000:2020, 7.7
  • Certification

    Third-party attestation related to a conformity assessment object, in this case a management system.

    ISO/IEC 17000:2020, 7.6
  • Certificate scope

    Description of the activities, products, services and sites covered by the certification. What is not included in the scope is not certified.

    ISO/IEC 17021-1:2015, 9.1.2
  • Certification decision

    Resolution adopted by a person or committee other than those who performed the audit, on granting, maintaining, renewing, extending, reducing, suspending or withdrawing certification.

    ISO/IEC 17021-1:2015, 9.5
  • Impartiality

    Presence of objectivity: absence of conflicts of interest, or their resolution in a way that does not influence the body’s activities.

    ISO/IEC 17021-1:2015, 3.2
  • Surveillance audit

    Periodic audit, at least annual, that verifies the certified system remains compliant during the cycle.

    ISO/IEC 17021-1:2015, 9.6.2
  • Recertification

    Audit performed before the certificate expires to confirm continued conformity and renew the cycle.

    ISO/IEC 17021-1:2015, 9.6.3
  • Certification transfer

    Recognition of a valid accredited certification issued by another body, to continue the cycle with the receiving body.

    IAF MD 2
  • Audit

    Systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria.

    ISO 19011:2018, 3.1
  • Audit evidence

    Records, statements of fact or other information relevant to the audit criteria and verifiable.

    ISO 19011:2018, 3.8
  • Audit finding

    Result of evaluating the evidence gathered against the criteria. It can indicate conformity, nonconformity or an opportunity for improvement.

    ISO 19011:2018, 3.10
  • Nonconformity

    Failure to meet a requirement. In certification it is classified as major (affects the system’s capability) or minor (isolated deviation).

    ISO 9000:2015, 3.6.9
  • Corrective action

    Action to eliminate the cause of a nonconformity and prevent its recurrence. It is not the same as an immediate correction.

    ISO 9000:2015, 3.12.2
  • Stage 1 audit

    First part of the initial audit: reviews documentation, context and the organization’s readiness for stage 2.

    ISO/IEC 17021-1:2015, 9.3.1.2
  • Stage 2 audit

    Evaluation of the implementation and effectiveness of the management system, on-site or remote, with evidence for each requirement.

    ISO/IEC 17021-1:2015, 9.3.1.3
  • Remote audit

    Audit that uses information and communication technologies to obtain evidence without physical presence, when feasible and justified.

    IAF MD 4
  • Annex SL · Harmonized structure

    Common structure of ISO management system standards: the same clauses 4 to 10, base terms and core text, to facilitate integration.

    ISO/IEC Directives, Part 1, Annex SL
  • Context of the organization

    External and internal issues relevant to the organization’s purpose that affect its ability to achieve intended results.

    Clause 4.1 (Annex SL)
  • Interested parties

    Person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity.

    ISO 9000:2015, 3.2.3
  • Documented information

    Information the organization must control and maintain, and the medium that contains it. It replaces “documents” and “records”.

    ISO 9000:2015, 3.8.6
  • Management review

    Periodic evaluation by top management of the system’s performance, with defined inputs and recorded decisions.

    Clause 9.3 (Annex SL)
  • Continual improvement

    Recurring activity to improve performance. It is evidenced by measurable actions and results.

    ISO 9000:2015, 3.3.2
  • Quality policy

    The organization’s intentions and direction regarding quality, formally expressed by top management.

    ISO 9001:2015, 5.2
  • Quality objectives

    Results to be achieved, consistent with the policy, measurable, with an owner, deadline and follow-up.

    ISO 9001:2015, 6.2
  • Control of nonconforming outputs

    Identification and control of products or services that do not meet requirements, to prevent their unintended use or delivery.

    ISO 9001:2015, 8.7
  • ISMS

    Information security management system: part of the overall system that establishes, implements, maintains and improves information security.

    ISO/IEC 27000:2018, 3.62
  • Annex A · Controls

    Reference list of information security controls that the organization compares against its risk treatment.

    ISO/IEC 27001:2022, Annex A
  • Statement of applicability

    Document stating which controls apply, their justification and status, and which are excluded and why.

    ISO/IEC 27001:2022, 6.1.3 d)
  • Environmental aspect

    Element of an organization’s activities, products or services that interacts or can interact with the environment.

    ISO 14001:2015, 3.2.2
  • Hazard

    Source with the potential to cause injury and ill health.

    ISO 45001:2018, 3.19

No definition replaces the official text of the standard.

The most frequently asked questions

Short answers. Each links to the page that resolves the case.

What accreditation does G-CERTI hold?

G-CERTI's accreditation chain and its current scope are published under accredited scope, together with the source and date of the data. The scope must be checked there before presenting a certification to clients, tenders or authorities, and every certificate issued is verified by its code in the verifier.

Which ISO standards do you certify?

G-CERTI certifies management systems within its current accredited scope and, as a third party, other standards published in its catalogue, including ISO/IEC 42001. Each standard's page states its certification route.

Can a certificate be transferred from another certification body?

Yes. The transfer process is assessed against IAF MD 2. G-CERTI reviews the current certificate, the issuing body, the scope, the audit reports, any open nonconformities and the applicable conditions before confirming whether the transfer is viable. It is not approved automatically.

What happens if I do not pass the audit?

A report is issued listing the nonconformities found, classified as applicable. The organization implements corrective actions and provides closure evidence. The closure is then reviewed and, if appropriate, the process continues with the certification decision and the issuance of the certificate.

Does G-CERTI provide consulting?

Certification is independent of consulting. In accordance with ISO/IEC 17021-1, a certification body maintains strict separation from consulting to the organizations it certifies, to protect the impartiality of the process. Any implementation support is provided by independent third parties, separate from the certification process.

How do I verify a certificate?

The certificate number is entered on the verification page. The automated lookup searches for the code in G-CERTI's registry; if no result appears or context is needed, assisted verification confirms it in writing within 48 business hours.

Does G-CERTI certify ISO/IEC 42001 (AI)?

Yes. G-CERTI certifies ISO/IEC 42001 as a third party: an audit of artificial intelligence governance and a certificate verifiable by its code.

Can several ISO standards be certified together?

Yes. Integrated audits allow two or more standards to be reviewed under a single program when the scope, technical compatibility and applicable rules allow it. Common combinations include ISO 9001 + ISO 14001 + ISO 45001, or ISO/IEC 27001 + ISO 22301.

How long does certification take?

The audit and issuance timeline is set out in the proposal, based on the standard, the size of the organization, the number of sites, complexity, documentation maturity and availability. Prior implementation of the management system is additional; there is no universal timeframe for all cases.

What are the stages of the process?

Six stages: 1) application and scope, 2) documentation review, 3) stage 1 audit (documentary), 4) stage 2 audit (on-site or remote), 5) file review and decision by a competent function separate from the audit team, 6) issuance of the verifiable certificate when applicable.

What documentation do I need?

It depends on the standard. In general: a management policy, measurable objectives, a system manual (if applicable), the documented procedures required by the standard, and the records evidencing implementation. A checklist specific to the chosen standard is provided when the process begins.

Can audits be conducted remotely?

Yes. In accordance with IAF MD 4, remote or information-technology-based audits are used when they are technically feasible and justified for the scope involved. The remote proportion depends on the standard, sites, processes, risk and applicable rules.

How long is the certificate valid?

The certificate is valid for 3 years. During that period, annual surveillance audits are carried out to verify the maintenance of the management system. At the end of the cycle, a recertification audit is performed.

How is the scope of a certificate validated?

By reading the certificate issued, the applicable public registry and the requirements of the client or authority requesting it. Looking only at the name of the standard is not enough: the holder, activity, sites, validity, standard and scope must all match.

What underpins international recognition?

Recognition depends on the accreditation chain, the scope of the certificate and the rules applicable to the target market. It is presented as a reference framework, with case-by-case verification of its acceptance.

Is the certificate valid for public tenders?

It may be valid when the tender specifications accept the standard, the scope, the issuing body and the corresponding accreditation chain. Acceptance is checked against the text of the tender, the certificate issued and the target market.

What coverage does G-CERTI operate with?

Applications and audits are coordinated by qualified personnel, and G-CERTI Co., Ltd. keeps the review, the final decision and the issuance control separate. The acceptance of each certificate depends on its scope, validity, accreditation chain and target market.

How much does ISO certification cost?

The cost is per project and depends on the standard, the size of the organization, the number of sites and the complexity of the processes. The proposal is defined after reviewing the scope, mode, country, sites and required cycle.

What does the certification proposal include?

The proposal details the items included and the applicable additional conditions — audit mode, annual surveillance, scope changes, taxes and services not included. The financial scope is documented before the process begins.

Do you offer payment options?

Payment terms are defined by contract and country. Published amounts are expressed in USD, and the formal proposal documents the payment method, taxes and applicable conditions.

Is it worth certifying more than one standard at a time?

Integrated audits optimize time when the standards share structure, processes, sites and a compatible audit team. The optimization is defined according to the scope and applicable rules.

What payment methods do you accept?

Available methods are stated in the corresponding proposal or invoice. They may include bank transfer, card or local options depending on country, legal entity and applicable conditions.

Do you issue a tax invoice?

Yes. An invoice is issued in accordance with the corresponding legal entity and the tax regulations applicable in each country.

Are there any undisclosed costs?

The proposal details all items included and any applicable additional conditions. Every item is documented before proceeding.

What underpins G-CERTI's work?

Impartiality in accordance with ISO/IEC 17021-1 and a traceable documentary review. The schedule is defined by contract according to scope, and acceptance of the certificate is interpreted against the applicable accredited scope; inconclusive cases go to assisted confirmation.

How do I file a complaint or appeal?

In accordance with ISO/IEC 17021-1, G-CERTI maintains a formal complaints and appeals procedure. The complaint is sent to info@gcerti.org or through the corresponding form. Each case is assessed through the defined path and answered according to the applicable procedure.

What do I do if I disagree with the audit result?

The certification decision may be appealed in accordance with the applicable procedure. The appeal is assessed by a body independent of the original audit team, with an objective and impartial review under ISO/IEC 17021-1.

What training does G-CERTI offer?

Specialized diploma programs on ISO standards (9001, 14001, 45001, 27001, 42001, among others), Lead Auditor and Internal Auditor programs, and technical events. All include a training credential issued by G-CERTI; a training credential is not equivalent to the accredited certification of a company's management system.

Are the training programs online or in person?

Both modes are available. Online classes are live, with direct interaction. In-person classes are held in Buenos Aires. In-company training is also offered for teams.

Do you issue a credential for the training programs?

Yes. The programs include an academic credential issued by G-CERTI Formación. It is verified by its code at gcerti.org. It is a training credential: it documents the person trained, while accredited certification is reserved for an organization's management system.

Is a training credential the same as certifying the company?

No, they are different. The credential documents the training completed by a person; certification assesses an organization's management system through third-party audit. They are separate processes.

Where is G-CERTI located?

G-CERTI is one international operation with a presence in 97 countries and service in the local language; one of its service locations is in Buenos Aires (Argentina). G-CERTI Co., Ltd. retains the final decision and issuance control, subject to the applicable standard and scope.

Who is accountable for G-CERTI?

Operations are handled by G-CERTI's authorized representation, with separate functions: whoever audits does not decide, and the certification decision is made by the issuer (G-CERTI Co., Ltd.).

What is G-CERTI's approach?

Third-party certification remains independent of consulting and training. Its authority rests on traceable accreditation and on documentary verification mechanisms with assisted confirmation when applicable.

Where can I find questions not listed on this page?

If your question is not on this page, the way forward is to write to the team: a technical conversation defines scope, timing and the next step.

Working meeting around a table
Work meetingG-CERTI archive

Do you need an answer for your case?

Tell us the standard, the scope and your deadline. We reply in writing with what is assessed and how long it takes.