A change to your organization does not reach your certificate by itself. If you take on a new site, change legal entity, or add an activity to what you do, tell us before your next audit rather than at it. Some changes are recorded and the certificate re-issued, some have to be audited before the certificate can name them, and some leave you doing work the certificate does not cover. ISO/IEC 17021-1 requires us to have arrangements for certified organizations to inform us of changes that affect their conformity, and the certification agreement carries that obligation across to you.
The reason is narrow. A certificate is a statement about one management system, operated at named sites, covering named activities, held by a named legal entity. Any of those four can change without anyone in the organization treating it as a certification matter, and once one of them has changed, the certificate describes an arrangement that no longer exists in that form.
What counts as a change
Legal and commercial status. A new trade name, a replacement licence, a merger, a move from an establishment to an LLC. The certificate carries your legal name because that is what a buyer matches against your trade licence, and a name they cannot match is a name they treat as a different company.
Sites. A second workshop, a head office move, a warehouse taken on for a season, a project site that will outlast the audit cycle. The certificate lists the sites at which the certified activities take place, and it covers those sites. Work carried out at an address that is not on the list falls outside it, however closely the processes there resemble the ones we audited.
Scope of operations. This is the change most often missed, because it happens commercially rather than administratively. A fabrication contractor that starts designing what it fabricates has added design and development, which brings ISO 9001 clause 8.3 into a system that had legitimately determined it was not applicable. Bringing previously outsourced work in-house does the same thing from the other direction. Whether the new activity can appear on your certificate at all depends on our own accreditation scope covering the sector it falls in, which we read before quoting for an extension.
The system itself. A change of top management, a change in who holds the management representative role, a reorganization that reassigns ownership of a certified process, or a headcount change large enough to change the audit duration. Duration follows from the standard, the headcount, the number of sites and the processes in scope, so an organization that has doubled since its last audit is holding an audit plan built for the company it used to be. A serious safety incident, an enforcement notice or a regulator's decision against you belongs on the same list, because each of them goes to whether the certified system is doing what it was certified to do.
What each change does to the certificate
Some changes are administrative. A legal name change where the entity, the activities and the sites are all unchanged is recorded, and a corrected certificate is issued without an audit.
A new site or a new activity is not administrative. Either one extends the scope of certification, and a scope extension is audited against the clauses that apply to the new work before the certificate names it. Where the change is known in advance, that audit is usually built into the next surveillance audit rather than run as a separate visit. Where it surfaces on the audit day, it cannot be absorbed into the same visit, because the plan, the duration and the team were all set for the scope we were told about.
Ownership changes divide on the legal entity. A share purchase leaves the certified entity in place, so the certificate stays with it, subject to what the new owner then does to the system. An asset purchase creates a different position: the buyer is a different legal entity and holds no certificate, however completely it has bought the operation that earned one. What follows there is a transfer or an initial certification, not an amendment.
The finding this produces
The failure mode is a certificate that is genuine, current and accurate, covering work carried out somewhere it does not mention. An organization wins a contract at a new address, staffs it, runs it for a year, and submits its certificate in the next tender without anyone connecting the two. At the surveillance audit the project list and the site list do not agree. The auditor asks about the work done at the address that is not on the certificate, and the question is about the scope of certification rather than about how well that site is run. The site may be run impeccably. It is still not on the certificate, and the tender was answered with a document that did not cover the contract it was submitted for.
Your own system already requires the change to be handled, which is why an unreported one tends to produce two findings rather than one. ISO 9001 clause 6.3 requires changes to the management system to be planned rather than absorbed. ISO 45001 clause 8.1.3 requires a process for managing changes that affect OH&S performance, temporary changes included. ISO 14001 clause 6.1.2 requires environmental aspects to be determined for the activities the organization actually carries out, so a new process or a new site brings new aspects with it. An auditor who hears about a change part-way through an audit will sample the change against those clauses. A new site where hazard identification was not completed before work started is a clause 8.1.3 finding on its own, with nothing to do with the wording on the certificate.
The habit worth building is an annual read of your own certificate against how the organization now runs: the legal name, the activities in the scope wording, and every address at which certified work happens. When somebody asks us to confirm a certificate, we answer from our own record of what we issued and what we have audited since. A change you have not told us about is a change we cannot confirm, and the person asking is usually deciding whether to award you work.