A consultant helps you design and implement your ISMS. A certification body independently audits it and issues the certificate. Impartiality rules generally keep one organization from doing both for the same client. Ask any certification body how it handles consulting, and confirm its accreditation for ISO 27001.
Two different jobs
A consultant is on your side. They help you write policies, run a risk assessment and prepare for the audit. The certification body is the independent party that decides whether the system meets the standard.
If one firm designed your system and then judged it, the judgment would not be independent. That is the reason for the separation.
What to ask a certification body
- Is it accredited for ISO 27001 certification, and by which accreditation body?
- What is its impartiality policy?
- Does it or a related company offer consulting, and how is that separated?
- Does it recommend a specific consultant? That should be a warning sign.
Accreditation bodies publish directories of the organizations they accredit. Check the entry rather than relying on a logo.
Cooling off periods
Guidance from accreditation sources discusses a gap of about two years between consulting for a client and certifying them. Check the exact rule with the certification body, since it may vary by scheme.
What to ask a consultant
Ask for references, a clear scope of work and what you will own at the end. You should come away able to run the ISMS yourself. A consultant who keeps the documents or the know-how in their own tools creates dependence.
Watch for guarantees
Nobody can promise a pass in advance. The certification body decides on the evidence. Be careful with offers that say certification is guaranteed or faster with a particular advisor.
Getting value from a consultant
Define the outcome before the first meeting: a scoped ISMS, a risk assessment you understand, a Statement of Applicability, and a team that can run the internal audit. Ask the consultant to teach while they build, so that your people know why each document exists.
Agree the handover. At the end you should hold all the documents in your own systems, with edit rights, and know how to maintain them.
Choosing a certification body
Compare more than price. Ask how audits are scheduled, how long they take, how findings are communicated and how you can appeal a decision. Ask about auditors who know your industry. Speak with a reference customer of similar size if possible.
Read the contract for the rules on certificate validity, surveillance audits and notification of changes. Those details matter more than the quote.
Documents to ask for
Request the certification body's audit time calculation for your size, its sample audit report format and its complaints and appeals procedure. These show how it works in practice. If you cannot get clear answers, treat that as information about how audits will go.
Quick check
Can our internal audit be done by the consultant?
Often yes, if they are independent of the areas audited and competent, and your certification body is comfortable. Ask first.
Last reviewed: 19 October 2026.
