Certificate transfer under IAF MD 2: pre-transfer reviews and scheduling
Certificate transfer IAF MD 2 rules for planners: eligibility, the pre-transfer review, when a visit is needed, open nonconformities and the inherited cycle.
Key takeaways
- Only valid, accredited certification can transfer; certification known to be suspended must not be accepted.
- The pre-transfer review is done by people with the same competence as the audit team, and a pre-transfer visit is not an audit.
- Outstanding major nonconformities must be closed and verified before the new certificate is issued.
- The accepting body inherits the previous certification cycle, so surveillance and recertification due dates do not reset.
Under IAF MD 2:2023, a certification body can accept a transfer only of valid, accredited management system certification covered by an IAF or regional MLA signatory. It must run a pre-transfer review by competent people, add a visit when needed, verify corrective action on outstanding major nonconformities, decide before any further audit and continue the client's existing certification cycle.
What is certificate transfer under IAF MD 2?
A certificate transfer IAF MD 2 process is how one accredited certification body recognises an existing, valid management system certification issued by another, so that it can issue its own. IAF MD 2 is the IAF mandatory document for the transfer of accredited certification of management systems; the current version is IAF MD 2:2023, Issue 2 Version 2, issued on 14 June 2023.
Transfers are common when clients change provider on price, service or group policy, and when a certification body stops trading. For planners they are unusual work: a review that is not an audit, an audit programme you did not design, and due dates you inherit.
Concurrent certification by more than one body is outside the definition and is not encouraged by IAF. Check iaf.nu for any issue later than 2023.
Which certificates can be transferred?
- Accredited only (2.1.1). Certification must be covered by an accreditation from an IAF or regional MLA signatory at level 3 and, where applicable, levels 4 and 5. Unaccredited certification is treated as a new client.
- Valid only (2.1.2). Only valid accredited certification is transferred. Certification known to be suspended must not be accepted.
- Failed issuing body (2.1.3). Where the issuing body has stopped trading or lost its accreditation, the transfer must be completed within 6 months or on expiry of the certification, whichever is sooner, and the accepting body informs its accreditation body.
- Scope inside both accreditations. The review confirms the certified activities fall within both bodies' accredited scopes.
Certificate transfer IAF MD 2 checklist: what the pre-transfer review covers
Clause 2.2.4 lists the minimum aspects of the pre-transfer review. Treat it as a checklist and file the answer to each.
- ✓The certified activities fall within both bodies' accredited scopes
- ✓The issuing body's accreditation scope is within the MLA scope of its accreditation body
- ✓The reasons the client wants to transfer
- ✓The site or sites hold valid accredited certification
- ✓The initial or latest recertification report, the latest surveillance report and the status of outstanding nonconformities
- ✓Complaints received and the actions taken
- ✓Considerations for the audit plan, including the issuing body's audit programme where available
- ✓Any current engagement with regulators relevant to the certified scope
If the reports are missing, or audits in the issuing body's programme have not been completed, MD 2 says to treat the client as a new client.
When is a pre-transfer visit needed?
The review normally starts with documents. When the review identifies the need, for example unclear status of outstanding major nonconformities, it includes a pre-transfer visit to the client to confirm the validity of the certification. MD 2 states plainly that the pre-transfer visit is not an audit.
The people doing the review, and any visit, need the same competence as an audit team for the scope being reviewed (2.2.3). That makes the visit a scheduling job like any other: match standard, technical area and conflicts, then fit it into a date. See auditor competence under ISO/IEC 17021-1.
What does the transfer process look like end to end?
- 1EnquiryClient asks to transfer, authorises information release
- 2ReviewDocuments checked against 2.2.4
- 3Visit if neededCompetent person confirms validity
- 4DecisionSeparate decision-maker, before any audit
- 5NotifyAccepting body informs issuing body
The decision is taken by someone other than the reviewers, through the normal certification decision process of ISO/IEC 17021-1. Once issued, the accepting body informs the issuing body (2.4.5).
How should the transferred client be scheduled?
Clause 2.3.4 says the certification cycle is based on the previous one, and the accepting body sets up the audit programme for the rest of the cycle. Clause 2.3.5 says the certification decision comes before any surveillance or recertification audit starts. In practice, the due dates come with the client.
- Jun 2025Initial certification by the issuing bodyStarts the 3-year cycle
- Feb 2026Client asks to transferPlanner imports the existing programme and due dates
- Mar 2026Pre-transfer reviewNo outstanding majors; no visit needed
- Apr 2026Certification decision by the accepting bodyMust come before the surveillance audit starts
- By Jun 2026First surveillanceNo later than 12 months from the original certification decision
- 2028RecertificationTimed to the original cycle, before the certificate expires
The example is illustrative. The dangerous gap is between enquiry and decision: if the transfer drags, the surveillance window keeps running. Put the inherited due date in your plan on the day of the enquiry; surveillance audit frequency and recertification timing explain the windows.
What happens to open nonconformities?
Clause 2.3.1 sets two conditions before the accepting body issues certification. It must have verified the corrections and corrective actions for all outstanding major nonconformities, and it must have accepted the client's plans for correction and corrective action for all outstanding minor ones. If the review finds issues that prevent the transfer, the client is treated as a new client (2.3.2).
MythA transfer resets the certification cycle.
RealityThe cycle is based on the previous one. It resets only if the client is treated as new.
MythThe pre-transfer visit can double as the surveillance audit.
RealityMD 2 says the visit is not an audit, and the decision must come before any surveillance starts.
MythThe issuing body can suspend the client to block the move.
RealityMD 2 says the issuing body shall not suspend or withdraw certification after notification of transfer where the client continues to meet requirements.
How scheduling tools help with transfers
A transfer adds a client mid-cycle with dates already fixed. ScheduleAI imports the inherited programme with its due dates, schedules the review or visit with competent, conflict-free people, and places the first surveillance inside its window with planners approving each step. For moving whole client books between systems, see audit scheduling data migration.
See how ScheduleAI's audit scheduling software applies these rules across a whole programme in minutes.
ScheduleAI imports a transferred client's existing audit programme and due dates, schedules the pre-transfer review or visit with competent, conflict-free staff, and keeps the next audit inside its inherited window.
Book a demo Estimate your savingsQuestions
What is IAF MD 2?
The IAF mandatory document for the transfer of accredited certification of management systems between accredited certification bodies. The current version is IAF MD 2:2023.
Can a suspended certificate be transferred?
No. Certification known to be suspended must not be accepted for transfer.
Is the pre-transfer visit an audit?
No. MD 2 states it is not an audit; it confirms the validity of the certification.
Does the certification cycle restart after a transfer?
No, unless the client is treated as a new client. The cycle is based on the previous certification cycle.
What if the issuing body has closed down?
The transfer must be completed within 6 months or on expiry of the certification, whichever is sooner.
Who can do the pre-transfer review?
People with the competence required of an audit team for that scope; the certification decision is then made by someone else. See competence verification.