In short: a consultant can help design and improve your information security management system, but an independent certification body performs the certification audit and decides whether to issue the certificate. An accreditation body assesses the certification body. Keeping those roles separate protects audit impartiality.
The four roles most buyers confuse
| Role | Typical work | What it should not promise |
|---|---|---|
| Consultant | Gap assessment, implementation advice, workshops, documentation support and remediation planning | The certification decision, which only the independent certification body can make |
| Internal auditor | Tests whether the ISMS conforms and operates as intended before certification | An independent third-party certificate for the organisation |
| Certification body | Conducts the independent certification audit and makes the certification decision | Consulting that compromises impartiality |
| Accreditation body | Assesses certification bodies against applicable accreditation requirements | That it is your implementation consultant |
What a consultant can usefully do
A consultant can translate the standard into a workable project, facilitate scope and risk discussions, identify gaps, train control owners and review whether evidence is likely to support the intended control. The organisation must still own its risk decisions, policies, controls and management system.
Ask for deliverables rather than a vague “certification package”: a scoped gap report, prioritised remediation plan, responsibility matrix, internal-audit plan and management-review preparation. Define which documents will be templates and which will be tailored to actual operations.
What the certification body does
The certification body audits the ISMS against ISO/IEC 27001 and makes an independent certification decision. The audit is not a consulting engagement. Findings must be handled through the body's audit and certification process, and the certification decision depends on satisfactory audit evidence.
Start with our ISO 27001 readiness guide to understand the ISMS and certification cycle. Use the readiness assessment to identify operational gaps before requesting audit proposals.
How to verify a certification body
- Ask which accreditation covers the relevant ISO/IEC 27001 certification activity and geography.
- Check the accreditation body's public directory rather than relying only on a logo in a proposal.
- Confirm the exact legal name and scope shown in the directory match the contracting entity.
- Ask whether proposed audit personnel and locations are covered by the body's process.
- Verify an issued certificate through the certification body, relevant accreditation directory or IAF CertSearch where available.
ISO explains that ISO itself does not perform certification. That distinction is important when marketing language loosely says “ISO certified.”
Independence questions to ask
- Did the same organisation design controls it will later audit?
- Are consulting and certification contracts, teams and decisions separated?
- Can the certification body explain its impartiality safeguards?
- Is the internal auditor sufficiently independent from the work being audited?
- Are referral fees or bundled offers disclosed?
A practical buying sequence
- Define scope and target date internally.
- Choose implementation help only where the team lacks time or expertise.
- Establish the ISMS, operate controls and gather evidence.
- Complete internal audit and management review.
- Request comparable certification proposals based on the same scope and headcount.
- Verify accreditation before signing.
Compare the full engagement: audit days, locations, surveillance cycle, travel, certificate changes and treatment of scope expansion. The cheapest initial quote may not be the lowest three-year cost; see the compliance cost guide for planning categories.
Red flags
- A certificate promised regardless of audit evidence.
- Unclear accreditation or a directory entry that does not match the contracting name.
- One sales proposal that obscures which legal entity consults and which certifies.
- Pressure to buy policies without confirming that they match real operations.
- No explanation of surveillance audits, certificate suspension or scope changes.
Evidence note: verify directories and accreditation immediately before contracting because status and scope can change. This guide is general readiness information, not a certification decision or legal advice.