Last Updated on August 20, 2026 by Hafsa J.

ISO/IEC 17065 Management System: Option A vs Option B (Clause 8) and Which to Choose

Here is the decision, stated plainly before anything else. Clause 8 of ISO/IEC 17065:2012 lets your certification body satisfy its management system requirement two ways. Option A (clause 8.1.1) means you build your own management system that meets sub-clauses 8.2 through 8.8 directly. Option B (clause 8.1.1) means you run on a management system that is established and maintained in accordance with ISO 9001 and is capable of supporting and demonstrating consistent fulfillment of ISO 17065. Both routes are equally valid for accreditation. Neither is “lighter” in the way most new CBs hope.

The test that settles it for most new bodies is one question: are you already operating a certified, conforming ISO 9001 management system? If yes, and that system genuinely runs your organization rather than sitting in a binder, Option B usually saves you duplicated procedures. If no, building a fresh ISO 9001 system purely to claim Option B is rarely worth it, and Option A built straight against 8.2 to 8.8 is the cleaner path. That is the short answer. The rest of this article is the part nobody writes: what each route demands clause by clause, where Option B does NOT buy you anything, and the ISO 9001 to ISO 17065 cross-reference an assessor will expect you to have thought through.

The two routes, read straight off the clause

Clause 8 opens with 8.1.1, which is the umbrella requirement that applies whichever route you pick: you shall establish, document, implement and maintain a management system that supports and demonstrates the consistent achievement of the requirements of ISO 17065. Clause 8.1.2 then sets the policy-and-objectives requirement that your management system policy and objectives stay consistent with your certification activity. So far, no choice. The choice sits inside how you meet 8.1.1.

Option A: your own management system, clauses 8.2 to 8.8

Under Option A you build a management system that meets the seven sub-clauses ISO 17065 writes out for you: 8.2 general management system documentation, 8.3 control of documents, 8.4 control of records, 8.5 management review, 8.6 internal audits, 8.7 corrective actions, and 8.8 preventive actions. These are not a separate quality framework you have to source elsewhere. They are written into 17065 itself, scoped to a certification body, and an assessor will check them against 8.2 to 8.8 word for word. Most genuinely new product CBs without a pre-existing ISO 9001 system take this route because it gives them exactly the management system the standard wants, with nothing extra to maintain.

Option B: an ISO 9001-conforming system that still proves it fits 17065

Under Option B you do not follow 8.2 to 8.8 line by line. Instead you maintain a management system that conforms to ISO 9001, and you carry an added burden: you must be able to demonstrate that this ISO 9001 system supports and demonstrates the consistent fulfillment of ISO 17065. Read that twice. Option B is not “we are ISO 9001 certified, therefore clause 8 is done.” It is “our ISO 9001 system is capable of supporting and demonstrating 17065, and here is the evidence.” The standard hands you the framework but keeps the obligation to prove fit. A body that bolts ISO 9001 on without mapping it back to 17065 fails the demonstration test, and that is the most common Option B finding an assessor raises.

Whichever route you choose, 8.1.1 and 8.1.2 still apply to both. The management system must support consistent achievement of 17065, and your policy and objectives must stay consistent with what your certification body actually does. Option B does not exempt you from 8.1; it only changes how you satisfy the rest of clause 8.

The decision: which route fits your body

The honest framing is that Option A and Option B reach the same destination by different roads, and the right road depends almost entirely on what management system you already have. The table below maps the factors that actually decide it for a product certification body. Run your situation down the rows.

The deciding question is the first row, and it is binary: are you already operating a certified, conforming ISO 9001 management system that genuinely runs your organization? If the answer is a confident yes, Option B lets you reuse it and avoid writing 8.2 to 8.8 from scratch, provided you do the mapping work. If the answer is no, or your 9001 certificate exists mostly on paper, do not manufacture a 9001 system just to claim Option B. Build straight to 8.2 to 8.8 under Option A. The tool below walks you through the same logic and a few follow-up checks, then tells you which route to start from.

Option A walked clause by clause (8.2 to 8.8)

If you take Option A, here is exactly what you are committing to build and keep evidence for. None of this is optional under Option A, and an assessor reads it sub-clause by sub-clause.

8.2 General management system documentation

You document the policy, the objectives, and the procedures and records the standard requires, and you make them available to the personnel who need them. This is the documented backbone everything else hangs on. The common gap is a policy that exists but objectives that were never written down or never made it to the people doing the evaluations.

8.3 Control of documents

You control the documents your certification activity relies on across their whole life: approve them before issue, review and update and re-approve as needed, identify changes and revision status, keep the current versions available at the point of use, keep them legible and identifiable, control documents of external origin, and prevent the unintended use of obsolete ones. For a CB this is not bureaucratic housekeeping. An evaluator working from a superseded scheme version is a live conformity problem, which is why 8.3 spells out obsolete-document control explicitly.

8.4 Control of records

You keep a documented procedure covering the identification, storage, protection, retrieval, retention and disposal of records, and you keep those records protected and accessible. Note this sits alongside clause 7.12, which already requires per-client records demonstrating each process requirement was met. The 8.4 procedure is the system-level control that 7.12 records live inside.

8.5 Management review

Top management reviews the management system at planned intervals, at least once a year. The standard names the inputs the review must consider: audit results, feedback from interested parties including complaints and appeals, the outputs of the mechanism for safeguarding impartiality, the status of corrective and preventive actions, follow-up from previous reviews, whether your objectives were achieved, and any changes that could affect the management system. The outputs must cover improvement of the management system’s effectiveness, improvement of your certification activities, and resource needs. This is the clause most thin Option A systems fail: a review that happens but never ingests the impartiality mechanism’s output or the appeals data, so it is a meeting rather than a review.

8.6 Internal audits

You run an internal audit program that verifies the management system both meets the standard and is effectively implemented. You set criteria, scope, frequency and methods by the importance of the areas and the results of prior audits. Auditors must be objective and impartial, and the hard rule here is that they shall not audit their own work. You communicate results to the relevant managers, trigger corrective action without undue delay, and keep records. For a small CB the “shall not audit their own work” line is the practical pinch point, because the same handful of people wear several hats.

8.7 Corrective actions

When a non-conformity occurs you identify and review it, determine its causes, evaluate whether action is needed to stop it recurring, implement that action, record the results, and review whether the action was effective. The last step is the one bodies skip: closing a corrective action without ever confirming it actually worked. Effectiveness review is part of the requirement, not a nicety.

8.8 Preventive actions

You identify potential non-conformities and their causes before they happen, evaluate the need to act, implement action, record it, and review its effectiveness. Preventive action is forward-looking where corrective action is reactive. Together 8.7 and 8.8 are your improvement loop, and management review (8.5) is where their status gets read back to top management.

Option B: what ISO 9001 covers, and what it never excuses

Option B is attractive because a mature ISO 9001 system already gives you most of what 8.2 to 8.8 ask for. ISO 9001 carries document control, record control, internal audit, management review, and corrective action in forms that map closely onto the Option A sub-clauses. If your organization runs a real 9001 system, reusing it instead of writing a parallel 17065 system is the sensible move, and clause 8.1.1 exists precisely to let you.

The catch is in the wording of 8.1.1 itself. Your 9001 system must be capable of supporting and demonstrating the consistent fulfillment of ISO 17065. “Capable of demonstrating” is an active obligation. You cannot simply present a 9001 certificate and treat clause 8 as satisfied. You have to show the assessor how your 9001 management review pulls in the impartiality mechanism’s output, how your 9001 document control covers your certification schemes, how your 9001 internal audit verifies the 17065-specific processes, and so on. In practice this means a mapping document and live evidence, not a certificate on the wall.

Where ISO 9001 stops, and 17065 keeps going

This is the part that catches established companies who assume their 9001 maturity carries them through 17065 accreditation. It does not, because ISO 9001 is a generic quality management standard and ISO 17065 layers certification-body obligations on top that 9001 was never written to address. Option B changes how you satisfy clause 8 only. Every other clause stands at full strength regardless of which management-system route you chose:

• Impartiality (clause 4.2). Top-management commitment to impartiality, a public impartiality statement, an ongoing impartiality risk register with documented treatment, and personnel independent of commercial interests. ISO 9001 has no concept of impartiality. None of clause 4.2’s thirteen requirements are touched by Option B.
• The consultancy firewall (4.2.6 and 4.2.7). You shall not be the designer, manufacturer, installer, distributor, supplier or maintainer of the item you certify, and you shall not certify where you or a related body gave consultancy before the evaluation under conditions that compromise impartiality. A flawless 9001 system does nothing to satisfy this. The firewall is a 17065 obligation, full stop.
• The safeguarding mechanism (clause 5.2). A documented mechanism, a committee or council with balanced composition where no single interest predominates, that reviews the impartiality of your audits, decisions and activities at least once a year. ISO 9001 requires nothing of the kind.
• Competence and resources (clause 6). Documented competence requirements per function, evaluator remuneration that is not linked to the number or outcome of evaluations, qualification records per person, and controlled outsourcing. ISO 9001’s competence clause is generic and does not reach the technical depth 17065 demands of a certification body’s evaluators.
• The certification-decision independence rule (clause 7.6). The certification decision must be made by one or more persons employed by or under a legally enforceable arrangement with the CB who did not take part in the evaluation. This segregation of evaluation from decision is the structural heart of 17065, and ISO 9001 has no equivalent. Option B cannot soften it.

Read the list as a single rule: ISO 9001 conformity satisfies the management-system clause and nothing more. The technical, competence, impartiality and process clauses that make you a certification body rather than a quality-managed company are yours to meet directly, under both options. If anyone tells you “we are ISO 9001 certified, so 17065 is mostly done,” they have misread the standard.

ISO 9001 to ISO 17065 cross-reference

If you go with Option B, this is the mapping the assessor wants to see. It shows which 17065 management-system expectations your ISO 9001 system already covers, and where 9001 leaves a gap you must close with 17065-specific evidence. Use it as the skeleton of your demonstration document. The left column is the 17065 clause 8 expectation; the middle column shows how a conforming 9001 system meets it; the right column flags what 9001 does not reach.

The pattern down the middle column is reassuring: a real ISO 9001 system gives you the management-system machinery. The pattern down the right column is the warning: that machinery has to be pointed at certification activity, not generic quality, and the bottom row is the hard stop where 9001 simply has nothing to offer. Building this mapping is the work Option B asks of you in exchange for not rewriting 8.2 to 8.8. If you would rather not do the mapping, Option A is the simpler path. Either way, the documentation you produce is the same evidence an assessor expects, and our ISO/IEC 17065 documentation toolkit gives you both the Option A management-system procedures and the Option B mapping template as editable starting points.

Common questions on the Option A and Option B choice

Choosing well, and why it matters less than people fear

The Option A versus Option B choice carries more anxiety than it deserves, mostly because the wider conversation borrows from other conformity-assessment standards instead of reading 17065’s own clause 8. Once you strip it back to the standard, the decision is small and the test is one question. If you already run a real ISO 9001 system, Option B lets you reuse it, at the cost of a mapping document that proves it fits. If you do not, Option A built straight against 8.2 to 8.8 is cleaner and cheaper, and you lose nothing by taking it.

What matters far more than the route is what neither route changes. Your impartiality, your safeguarding mechanism, your competence framework and the independence of your certification decision are the clauses that make you a certification body, and they are yours to meet in full under both options. Get those right and the clause 8 choice is a formality. Get the clause 8 choice wrong and you have only made paperwork harder, not failed the standard. If you want to confirm the exact wording before you commit, the standard’s official record is on the ISO Online Browsing Platform entry for ISO/IEC 17065. Read clause 8 there, run the test, and pick the route that fits the system you already have.