Certification body management software: what each system should do
Certification body management software explained: what your CRM, certification platform and scheduling engine should each own, and how they connect.
Certification body management software is the set of systems a certification body uses to win clients, manage audit programmes and certificates, schedule auditors and invoice. Most bodies run three core layers: a CRM for sales, a certification management platform as the system of record for clients, scopes and certificates, and a scheduling engine that allocates competent auditors inside each audit window.
Key takeaways
- No single tool does everything well; most certification bodies run a CRM, a certification platform and a scheduling engine.
- Every data item needs one system of record, or planners end up reconciling copies by hand.
- The certification platform holds what must happen; the scheduling engine decides who does it and when.
- Integration through an API and webhooks matters more than any individual feature list.
What is certification body management software?
Certification body management software covers every system a certification body uses to run its operation under ISO/IEC 17021-1: selling and quoting, holding the audit programme, recording certification decisions, allocating auditors, and billing. Few bodies buy it as one product. Most assemble it from specialist parts, and the quality of the whole depends on how clearly each part's job is defined.
This guide sets out what each layer should own, where the boundaries sit, and how to connect them so that planners stop copying data between screens. It is written for operations directors, IT leads and quality managers who are reviewing their systems or preparing a tender.
Which systems does a certification body need?
Four layers appear in almost every certification body, whatever its size. Small bodies sometimes combine two of them in one tool; large international bodies often run several instances of each across countries.
CRM and quoting
Leads, contacts, proposals and audit time calculations for quotes. Owns the commercial relationship until the contract is signed.
Certification management platform
The system of record for clients, sites, scopes, standards, audit programmes, reports, nonconformities and certificates. Intact is one example of this category.
Scheduling engine
Allocates competent, impartial auditors to each audit inside its window, forms teams, clusters travel and handles reschedules. See our guide to audit scheduling software.
Finance and HR
Invoicing, auditor fees, subcontractor payments, contracts and holidays. Usually an existing ERP or payroll system.
The layer that is most often missing is the scheduling engine. Many bodies still allocate auditors in spreadsheets that sit beside the certification platform, which is where most rule breaches and double bookings start.
Where should each record live?
The most useful design decision is to name one system of record for each data item. Other systems may read a copy, but only one may change it. This removes the reconciliation work that fills planners' weeks.
| Record | System of record | Who reads it |
|---|---|---|
| Client, sites and scope | Certification platform | CRM, scheduling engine |
| Audit programme and due dates | Certification platform | Scheduling engine |
| Audit time per audit | Certification platform (from the quote and IAF MD 5 calculation) | Scheduling engine, finance |
| Auditor competence and approvals | Certification platform or HR system | Scheduling engine |
| Auditor availability and holidays | HR system or calendar | Scheduling engine |
| Allocated auditor, team and dates | Scheduling engine | Certification platform, auditors, client |
| Certification decision and certificate | Certification platform | CRM, finance |
| Invoices and auditor fees | Finance system | CRM |
Competence is the record most often split badly. If it lives in a spreadsheet the scheduling engine cannot read, every allocation depends on memory. Our guide to building an auditor competence matrix shows how to structure it so software can use it.
How does a certification management platform differ from a scheduling engine?
Both touch audits, so buyers often assume one can do the other's job. They solve different problems. The certification platform records what must happen and what did happen. The scheduling engine decides who does each audit and when, across the whole programme at once, while checking every rule.
| Certification platform | Scheduling engine | |
|---|---|---|
| Holds clients, scopes and certificates | ✓ | Reads a copy |
| Tracks nonconformities and decisions | ✓ | ✕ |
| Checks competence for every allocation | Manual lookup | ✓ |
| Checks rotation and conflicts of interest | Manual lookup | ✓ |
| Plans a whole year of audits in one run | ✕ | ✓ |
| Clusters travel across nearby clients | ✕ | ✓ |
| Shows the knock-on effect of a reschedule | ✕ | ✓ |
| Planner approves the final result | ✓ | ✓ |
The practical answer is to connect them. ScheduleAI, for example, integrates with Intact so that audits, auditors and competence flow into the engine and confirmed bookings flow back to the certification record.
How should certification body management software connect?
Integration decides whether the stack saves time or creates it. Ask for a documented REST API, webhooks for changes, and a clear rule on which system wins when two disagree. Nightly file exports work for reporting but fail for rescheduling, where a change must reach auditors and clients within minutes.
Map the flow from signed contract to confirmed audit before you buy anything. Every arrow in that map is an integration you will need to build, test and maintain. More detail on common failure points is in our article on certification ERP integration.
- 1Contract signedCRM passes client and scope
- 2Programme createdPlatform sets audits and due dates
- 3Auditors allocatedEngine checks rules and travel
- 4Planner approvesExceptions reviewed, dates proposed
- 5Booking confirmedWritten back to platform and calendars
What evidence should the system produce for accreditation assessments?
Software is not accredited; your body is. Accreditation assessors under ISO/IEC 17021-1 look for evidence that each audit was carried out by competent, impartial people within the required timescales. Good certification body management software makes that evidence a by-product of normal work, so nobody rebuilds it before an assessment.
Check your current accreditation body's expectations and the current issues of the standards before finalising requirements.
- ✓Competence status of every auditor on the date of each audit, with its source
- ✓Impartiality and conflict of interest checks recorded per allocation
- ✓Previous auditors per client, to show how rotation was considered
- ✓Surveillance and recertification dates against their due dates
- ✓A change log for every reschedule, with who approved it and why
- ✓Audit time planned versus audit time delivered
For the underlying rules, see our articles on auditor competence under ISO/IEC 17021-1 and impartiality and conflict of interest checks.
How should you choose certification body management software?
Start from the problems you have today, measured, and test every shortlisted product on your own data. Demonstrations on vendor data prove little, because your competence codes, accreditation rules and travel patterns are what make scheduling hard.
- Measure the baselineRecord planner hours per month, auditor utilisation, subcontracted days and missed due dates.
- Name the systems of recordDecide which system owns each record before you compare products.
- Write requirements as questionsUse our scheduling software RFP template so vendors answer the same 40 questions.
- Run a proof of conceptLoad a real quarter of audits and compare the result with your manual plan. Our proof of concept guide explains how.
- Plan the data moveAgree what history moves and how it is checked. See audit scheduling data migration.
ScheduleAI is the audit scheduling software certification bodies use to plan ISO programmes from stage 1 to recertification.
ScheduleAI is the scheduling engine layer: it reads clients, audits and auditor competence from your certification platform or CRM through a REST API, webhooks or its Intact integration, checks 35+ rules, and writes approved bookings back. It is ISO/IEC 27001 certified with EU hosting.
Book a demo Estimate your savingsQuestions
Is certification body management software one product or several?
Usually several. Most bodies run a CRM, a certification management platform and a scheduling engine, connected through APIs, plus their existing finance and HR systems.
Can a certification management platform schedule auditors?
They hold the programme, the allocated auditor and the date, and several check qualifications as they do. A scheduling engine adds the programme-wide view: competence, rotation, impartiality, windows and travel optimised across every audit at once.
What is a system of record?
The one system allowed to create and change a given record. Other systems read copies. Naming one per data item stops conflicting versions of the same audit.
Does the software need to be accredited?
No. Accreditation applies to the certification body. The software should produce the records assessors ask for, such as competence at the audit date and a change log for reschedules.
Which integration matters most?
Usually the link between the certification platform and the scheduling engine, because audits, due dates and competence flow one way and confirmed bookings flow back.
How long does it take to evaluate a scheduling engine?
A proof of concept on a quarter of your own audits typically shows within a few weeks whether an engine handles your rules. Book a demo on your own data to see this for your body.