Personnel Certification Explained: How to Get Certified

Published 14 September 2026, updated 12 November 2026

Two very different things are both called “ISO certification”. An organisation is certified when a certification body confirms that its management system meets a standard such as ISO 9001:2026. A person is certified when a personnel certification body confirms that the individual has demonstrated defined competence, for example as a Lead Auditor for that standard. QA Assessor does the second. This article explains what that involves and how the QA Assessor grade model works.

What ISO/IEC 17024 asks of a certification body

ISO/IEC 17024:2026, Conformity assessment: General requirements for bodies operating certification of persons, is the international standard for personnel certification bodies; its third edition was published in March 2026. It requires the body to:

• Define each certification scheme: the competence required, the prerequisites, the assessment method, the validity period, surveillance and the recertification requirements
• Assess applicants against those requirements with methods that are valid, reliable and fair; the assessment of verified evidence of experience, a work sample and a structured interview are such methods
• Keep certification decisions impartial: decisions are made by people who did not train or assess the applicant, and no one’s pay depends on how many certificates are issued
• Separate training from certification so that attending the body’s own course gives no advantage
• Publish the information applicants need, keep a register of certified persons, handle complaints and appeals, and have a policy for suspending and withdrawing certification
• Protect confidentiality, manage conflicts of interest, secure its records, and, in the 2026 edition, control any use of artificial intelligence in the certification process

A certification body can be accredited against ISO/IEC 17024 by a national accreditation body, which independently verifies that it meets the standard. QA Assessor is not accredited; its processes are self-declared as aligned with ISO/IEC 17024:2026, and its policies, procedures and Impartiality Committee terms of reference are published so that anyone can see how it works.

Grades decided on evidence

QA Assessor certifies auditors, and only auditors, on ten schemes, one per ISO management system standard. Certification is decided on a structured assessment of what you have done: a verified auditor course, verified audits, a work sample and, for the higher grades, a structured interview, scored against a published rubric by an assessor who did not train you, with the decision made by a different person. Each scheme has five grades:

1. Associate Auditor. You have completed an auditor course for the scheme and want formal recognition before you have built up audit experience.
2. Internal Auditor. You audit parts of your own organisation’s management system, or a supplier’s: five verified internal or supplier audits of at least three hours each, after an Internal Auditor or Lead Auditor course.
3. Auditor. You carry out full management system audits as a team member or alone: four verified audits and twenty audit days, fifteen of them on site, after a Lead Auditor course, with four years of verified work experience (two in the discipline) and a work sample of your own audit work.
4. Lead Auditor. You plan and lead audit teams: the Auditor requirements plus three audits led, fifteen days and ten on-site days as team leader, and a structured interview.
5. Principal Auditor. A long auditing history, ten years or more, for senior professionals who now work mainly in training, consultancy or management; audits from the last fifteen years count, and a structured interview is part of the assessment.

The exact numbers for every grade are on the Certification Grades page and on each scheme page, and the dashboard checks your verified records against them before you apply.

The nine steps

1. Create your account and verify your identity. Your Member ID is issued at once and becomes your Register ID when you are certified; QA Assessor verifies your identity before your first certification.
2. Complete an auditor course. Foundation, Internal Auditor or Lead Auditor, at the level the grade needs, with QA Assessor, an Approved Training Provider or any provider whose certificate we can confirm.
3. Log your audits and work experience. Record every audit in your Audit Log with the standard and edition, dates, your role, days, on-site days and a person who can confirm it, and your work experience with the discipline. For Auditor and above, attach a redacted audit plan, checklist or report you produced to one of the audits and flag it as your work sample.
4. Records verified. A reviewer checks each record against its evidence and may contact the people you named; verified records are locked, and only verified records count.
5. Apply and declare. Choose the scheme and grade, see the live check of your records and the itemised fees (the US $16 scheme application fee, charged once per scheme, plus the first annual fee for the grade) and accept the declaration. Nothing is paid yet: QA Assessor verifies your eligibility first, then asks for the fees in one payment, and assessment starts when they are received.
6. Prerequisite review and assessment. The prerequisites are confirmed and the records your application rests on are frozen. An assessor who did not train you scores your verified records, your work sample and, where the grade requires it, a structured interview against the published rubric; the assessor may contact your verifiers and may ask for more information. The assessment is locked when submitted.
7. Decision. Made by a Certification Manager who did not assess, verify or train you, on the locked assessment and the evidence, with the reasons recorded; normally within 15 working days of the prerequisite review, not counting time waiting for you.
8. Certificate and register entry. A certificate number, a certificate stating the scope and the three-year certification period, a digital auditor card and a public entry on the Auditor Register, each with a verification link and QR code.
9. Keep it current. Pay the annual fee every twelve months, complete at least three CPD records in each calendar year, recertify every three years, and regrade as your experience grows.

Choosing a grade

Match the grade to what you have actually done, not what you hope to do next year. If you audit your own organisation’s processes, Internal Auditor is right. If you take part in full system audits, Auditor. If you lead audit teams and your log shows it, Lead Auditor. If you have audited for a decade and now mostly train, consult or manage, Principal Auditor. If you have completed a course and have not audited yet, Associate Auditor gets you on the register while you build your log, and you can regrade at any time for a small fee.

Preparing

You do not need a QA Assessor course to be certified, and taking one gives no advantage in the assessment of your application. What you need is a verified auditor course for the scheme, an audit log with the people and organisations who can confirm each audit, and evidence where you have it. The Applicant Handbook sets out exactly what counts, and How Certification Works walks through the process step by step.