ISO 18295 Certification for Customer Contact Centres

ISO 18295 is the international standard for customer contact centres, and itmad audits customer contact centres and their client organisations against ISO 18295, in all industries. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 18295 in brief

The standard defines what a contact centre must do to deliver consistent service, and what a client organisation must provide when it outsources customer contact to a contact centre.

The two parts of ISO 18295

ISO 18295-1 sets requirements for the contact centre itself, whether in-house or outsourced, and covers how the service is delivered. ISO 18295-2 sets requirements for the client organisation that uses a contact centre, and covers what that organisation must specify, resource and monitor in the outsourcing relationship.

The two parts serve different organisations. A contact centre certifies to Part 1 to demonstrate its own service delivery. A government entity, bank or utility that outsources customer contact certifies to Part 2 to demonstrate that it specifies, resources and monitors the relationship properly. itmad certifies against both parts.

Who the standard is for

Customers and supplier programmes sometimes ask for independent proof of customer contact arrangements. ISO 18295 applies to any organisation that runs or commissions a customer contact centre, including:

• Outsourced contact centres and business process outsourcing providers
• Telecommunications and utility customer service operations
• Banking, insurance and fintech support functions
• Government service centres and public-facing helplines
• Healthcare appointment and patient contact services
• Airlines, travel and hospitality reservation centres
• Client organisations that outsource customer contact and need Part 2 certification

What the standard covers

• Customer contact strategyDefined service levels across all channels, with targets for waiting times, response rates and first-contact resolution.
• Staff competence and authorityRecruitment criteria, induction, ongoing training, and defined authority for agents, including enough authority to resolve enquiries without unnecessary escalation.
• Enquiry and escalation handlingHandling at first contact, escalation of what cannot be resolved, and closing the loop with the customer on the outcome.
• Complaint handlingComplaints distinguished from general enquiries, logged, acknowledged and closed within defined timescales, with trend analysis feeding improvement.
• Customer information protectionControls over the customer data that the contact centre collects and holds, appropriate to the privacy obligations that apply.
• Quality monitoringCall and contact monitoring against defined criteria, with feedback to agents, calibration between assessors and evidence that the data is used and not just collected and filed.
• Satisfaction measurementCustomer satisfaction data collected, reported and acted on, not surveyed once a year and otherwise ignored.
• Business continuityContinuity arrangements for the contact operation, tested and not assumed.
• Client organisation requirements (Part 2)What the commissioning organisation must specify, resource, monitor and report on when it outsources customer contact: the obligations that make the outsourcing relationship manageable.

Where ISO 18295 audits find gaps

Quality monitoring is the clause that most often produces findings. Monitoring records exist, but calibration between assessors was never carried out, so scores cannot be compared across supervisors or time periods. The other recurring area is complaint handling: a defined process that is followed for straightforward cases and bypassed for anything difficult, with the most significant complaints settled informally and never entered into the system at all.

How an itmad audit runs

Stage 1 reviews the documented arrangements, the service level definitions and the scope. Stage 2 tests the operation in practice: call and contact monitoring records, evidence of staff competence, complaint files followed end to end, and the measurement data behind the performance that is reported.

The certificate cycle

An ISO 18295 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years and recertification before it expires. The certificate states its scope, including the locations covered.

Independence

Independence is what gives the certificate its value to the customer who asked for it. ISO/IEC 17021-1 bars itmad from designing, implementing or consulting on the system being certified, so the role of itmad is limited to the audit, the certification decision and, on request, a pre-assessment that identifies gaps against ISO 18295 without prescribing the fix.

What itmad delivers

• A Stage 1 report setting out readiness gaps ahead of the main audit
• A Stage 2 report with findings tied to objective evidence
• Nonconformities classified by severity, with defined response timescales
• A certificate of registration stating the certified scope and locations
• The certification mark, under the terms of itmad's mark and seal policy
• Annual surveillance audits and reports for the full three-year cycle

Frequently asked questions

What is ISO 18295?

ISO 18295 is the international standard for customer contact centres. It defines what a contact centre must do to deliver consistent service, and what a client organisation must provide when it outsources customer contact.

What is the difference between ISO 18295-1 and ISO 18295-2?

Part 1 sets requirements for the contact centre itself, whether in-house or outsourced, and covers how service is delivered. Part 2 sets requirements for the client organisation using a contact centre, and covers what it must specify, resource and monitor in the outsourcing relationship.

Which part does an organisation that outsources customer contact certify to?

A government entity, bank or utility that outsources customer contact certifies to Part 2, to show that it specifies, resources and monitors the relationship properly. A contact centre certifies to Part 1 to show its own service delivery, and itmad certifies against both.

What do ISO 18295 audits find most often?

Quality monitoring most often produces findings: monitoring records exist, but calibration between assessors was never done, so scores cannot be compared. Complaint handling is the other recurring area, with a defined process followed for easy cases and bypassed for difficult ones.

How does an ISO 18295 audit work?

itmad audits in two stages. Stage 1 reviews the documented arrangements, the service level definitions and the scope. Stage 2 tests the operation in practice, including monitoring records, staff competence evidence, complaint files and the data behind reported performance.

How long does an ISO 18295 certificate last?

An ISO 18295 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years. Recertification is completed before expiry.