Auditors
Independent auditors.
No commission – for anyone.
We help you get audit-ready. Someone else audits you: an accredited auditor from our partner network or a body of your choice. No money changes hands for the referral, in either direction.
Partner network rules
Six rules that protect your certificate.
A certificate is only worth as much as the independence of whoever issues it. That is why the rules are simple and have no exceptions.
Accredited
The partner network only includes auditors and certification bodies accredited for the framework in question – in Germany by DAkkS, the national accreditation body.
Independent of us
Partners neither hold a stake in Sightadel nor are they engaged by us. They audit your system, not our software.
No commission
No money changes hands for an audit – neither from us to the auditor nor from the auditor to us. Not even on request.
Free choice
In the app, you choose from the partner network or invite your own body into your account. Both work equally well.
Direct contract
You engage the auditor directly and pay them directly. Sightadel is not a party to that contract.
Separate from consulting
Whoever advises you does not audit you. ISO/IEC 17021 requires this separation – and it protects the value of your certificate.
Why independence matters
A certificate is a promise to third parties.
Your customers, your supervisory authority and your insurers rely on the audit having been done by someone with no interest of their own. That is exactly what ISO/IEC 17021 governs.
ISO/IEC 17021 sets out how certification bodies for management systems must operate. A central point is impartiality: a body must not advise the organisation it certifies. It has to identify, assess and avoid conflicts of interest – including those arising through affiliated companies or individual people.
The logic is simple. Whoever helped build a system ends up auditing their own work. Whoever earns from a referral has an interest in the outcome. Both weaken the certificate – in the worst case, a customer will not recognise it.
That is why we keep things strictly separate: Sightadel and our consultants help you build the system. The audit is carried out by an accredited body with which we have no contractual or financial ties. No money changes hands for the referral.
Finding the right body
How to recognise a good certification body.
Whether from the partner network in the app or on your own: clarify these points before you engage anyone.
Accreditation
Accredited for exactly the standard you need. In Germany by DAkkS, internationally by a body that is a member of the IAF. Many customers do not recognise a certificate without accreditation.
Scope
Accreditation covers specific standards and industries. Ask whether your sector is covered – it is stated in the scope of accreditation.
Industry experience
An auditor who knows your industry asks the right questions and understands your answers faster. Ask for references from comparable companies.
Compare quotes
Get two or three quotes. Compare audit days for stage 1, stage 2, surveillance and recertification, plus travel costs and certificate fees.
Availability
Good auditors are often booked up months in advance. Ask about dates early, especially if a customer or a tender sets a deadline.
Language and process
Clarify which language the audit will be held in, which parts can be done remotely and how the body handles nonconformities and deadlines.
Process
From the last control to the certificate.
Using an ISO certification as the example. For attestations and audit reports such as BSI C5 or SOC 2, an audit firm works on the same principle.
- 1
Check audit readiness
All controls answered, evidence linked, internal audit and management review completed. Sightadel shows you what is still open.
- 2
Choose an auditor
From the partner network or your own body. Feel free to get several quotes – the effort depends mainly on headcount and number of sites.
- 3
Set up access
The auditor is given the “Auditor” role: they see the audit scope, add comments and – once you approve – create or edit entries. They can never delete anything.
- 4
Stage 1: documentation
The auditor reviews scope, risk assessment, Statement of Applicability and policies – directly in the system, no folders sent by e-mail.
- 5
Stage 2: implementation
On site or remotely, the auditor checks whether the system is lived day to day. In Sightadel, nonconformities become action plans with a deadline.
- 6
Certificate and surveillance
Once the audit is passed, annual surveillance audits follow. Evidence with expiry dates makes sure the system does not fall asleep again.
The certification cycle
Three years, four audits.
An ISO certificate is not a one-off event. It is valid for three years and is reviewed every year. This is what the cycle looks like.
Stage 1
The auditor checks whether your system is ready in principle: scope, policy, risk assessment, Statement of Applicability, internal audit, management review. They record what still needs doing before stage 2.
Stage 2
Now it is about everyday practice. The auditor talks to staff, looks at processes and checks samples of evidence. The result is a set of findings and a recommendation on certification.
Surveillance
Once a year, the auditor reviews part of the system and all nonconformities from the last audit. The certificate remains valid as long as these audits are passed.
Recertification
Before the certificate expires, the whole system is reviewed again, much as in stage 2. Then a new three-year cycle begins.
Nonconformities
Closing findings properly.
Hardly any initial audit ends without a finding. What matters is how you deal with it: find the cause, implement the measure, prove it works.
Major nonconformity
A requirement is not met, or is systematically not met – for example, if there is no internal audit. It must be resolved before the certificate is issued or confirmed. The body sets a deadline and checks the fix, often on the basis of evidence, sometimes with a follow-up audit.
Minor nonconformity
An isolated case or gap that does not call the system into question – for example, an expired training record. You submit an action plan. At the next audit, the auditor checks whether it has been implemented and is effective.
How Sightadel helps
- Every finding becomes an action plan with an owner and a deadline
- Root cause analysis and corrective action sit at the affected control
- Evidence of the fix is linked and immediately visible to the auditor
- At the next audit, it is clear what was done and when
- For tricky findings, a consultant helps you get to the real cause
For the auditor
Everything in one place. Nothing to change.
Auditors work in Sightadel with a role of their own. That saves both sides days of follow-up questions and folders sent by e-mail.
The auditor comments, creates or edits only after your approval and can never delete anything. It remains traceable which version was audited. Whether you choose an auditor from the partner network in the app or invite your existing body makes no technical difference. Both get the same role, and you revoke access with one click once the audit is over.
The partner network is an offer, not an obligation. It saves you the search, because it lists auditors who already know Sightadel. If you already have a body you are happy with, simply stay with them.
The auditor sees
- Controls with answers and comments
- Linked evidence with version and validity
- Policies and Statement of Applicability
- Action plans and their status
- The activity log
The auditor cannot
- Delete content or evidence
- Create or edit without your approval
- Manage users or settings
Are you an auditor and want to handle your clients through Sightadel? Go to the partner network
Questions and answers
Questions about audits and independence
More in our FAQ or directly via our contact form.
Why does Sightadel not certify itself?
Because consulting and certification must be kept separate. Under ISO/IEC 17021, a certification body must not advise the organisation it certifies. We help you build your system – someone else audits it.
Does Sightadel earn from referring an auditor?
No. No commission is paid for audits, neither to us nor to our partners. This is not an exception but a founding principle of the partner network.
Can I keep my current auditor?
Yes. Any accredited body can work with Sightadel. You invite the auditor, and they get the Auditor role.
What does the auditor see in Sightadel?
What they need for the audit: controls with answers, linked evidence, policies, action plans and the activity log. They comment and, once you approve, create or edit entries – but they can never delete anything.
How much does the audit cost?
The certification body sets the fee and invoices you directly. The main factors are headcount, number of sites and scope. Sightadel has no part in this.
I am an auditor. How do I join the partner network?
Sign up directly in the partner network – free of charge and with no obligation. You will then find customers who work with Sightadel directly in the app.
How do I know whether a certification body is accredited?
In Germany, DAkkS keeps a public register of accredited bodies. Check there whether the accreditation covers the specific standard. For bodies outside Germany, look for accreditation by a member of the IAF.
What is the difference between a major and a minor nonconformity?
A major nonconformity means a requirement is not met at all or is systematically not met. It must be resolved, and usually evidenced, before the certificate is issued or confirmed. A minor nonconformity is an isolated case or gap that does not fundamentally call the system into question. An action plan, which the auditor checks at the next audit, is usually enough.
How long is an ISO certificate valid?
Three years. Surveillance audits take place in the two years in between, followed by a recertification audit for the next cycle.
Can I change certification body?
Yes, even during a running cycle. The new body takes over the certificate under its own rules. In Sightadel, you simply invite the new auditor and remove the previous one’s access.
Does the audit have to take place on site?
The certification body decides this under the rules of its accreditation. Parts can often be audited remotely. In Sightadel, the documents are in one place anyway, wherever the auditor is based.
Get audit-ready. With Sightadel.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.