“We have listened to the wisdom in an old Russian maxim. And I'm sure you're familiar with it, Mr. General Secretary, though my pronunciation may give you difficulty. The maxim is: Dovorey no provorey — trust, but verify.”Ronald Reagan · Remarks on Signing the Intermediate-Range Nuclear Forces Treaty · 1987 · Ronald Reagan, cuvântare la semnarea Tratatului privind forțele nucleare cu rază intermediară, Casa Albă, 8 decembrie 1987 — arhiva Bibliotecii Prezidențiale Reagan
Stage 1 judges the documents, stage 2 judges the evidence, and accreditation judges the body that judges both.
The certification audit comes in two stages. Stage 1 looks at documentation and readiness: the scope, the policy, risk assessment and treatment, the statement of applicability, evidence that the internal audit and the management review actually happened. Its output is not a grade but the plan for stage 2 and the list of things that would block it. Stage 2 checks implementation: records from the elapsed period are requested, people inside the processes are interviewed, what is written is compared with what is done. After the certificate come annual surveillance, on a sample of processes and controls, and full recertification every three years. The body issuing the certificate is itself accredited against ISO/IEC 17021-1, in Romania by the national accreditation body RENAR; a certificate with no accreditation behind it is paper, not recognition. For the same reason of independence, whoever implemented the system cannot also audit it.
Reagan borrowed a Russian proverb about trust and verification. The idea goes further: verification is not a one-off gesture but a rhythm. Certifying a management system works the same way. You do not look at something once and call it done; you set up a cycle with deadlines known from the start. Think of the medical check for a driving licence: you do not prove once and for all that you can see, you return at fixed intervals. The difference is that here the cycle has structure: preparatory stages, then yearly checks, then a full restart. The rhythm exists precisely because trust wears out and systems change. The natural next question is what actually happens at each of these moments in the cycle.
The cycle begins with a split many people miss: certification is not requested all at once, but in two stages. The first does not hunt for flaws in practice; it reads the paperwork and the readiness. It checks that the scope is defined, that policy and risk assessment exist, that the internal audit and management review actually happened. The result is not a grade but a plan: what stage two will examine and what could block it. It is like visiting the architect before a renovation: nothing gets demolished, but you learn where the load-bearing walls are. Skipping stage one means entering stage two blind. And stage two demands something else: records from the elapsed period and people describing how they work. What happens once the certificate is up on the wall?
Why it matters The order of the stages tells you where time is lost: entering stage 2 without records from the elapsed period delays the certificate rather than speeding it up.