Understanding the difference between an ISO consultant vs certification body is essential when preparing for ISO certification. Although both may be involved in your certification journey, they perform entirely different functions.
An ISO consultant helps your organisation develop, implement, and improve its management system. A certification body independently audits that system and decides whether it meets the relevant ISO standard. Keeping these roles separate protects the integrity and impartiality of the certification process.
It is also important to understand that ISO develops and publishes international standards, but does not audit organisations or issue ISO certificates.
ISO Consultant vs Certification Body: The Core Difference
An ISO consultant is an adviser appointed by your organisation. Their purpose is to help you understand the applicable requirements and build a management system that works in practice.
A certification body is an independent conformity-assessment organisation. Its auditors examine objective evidence to determine whether your management system conforms to the chosen standard.
The simplest way to remember the distinction is:
- The consultant helps you prepare.
- The certification body assesses you.
- The accreditation body evaluates the certification body.
- ISO publishes the standard.
An accredited certification body must maintain its independence. It cannot design your management system and then certify its own work.
What Does an ISO Consultant Do?
depend on your organisation’s existing systems, internal expertise, certification objectives, and operational complexity.
A competent consultant may help you:
- Define the management system’s scope.
- Conduct an ISO gap analysis.
- Interpret clauses and applicable requirements.
- Map processes, responsibilities, risks, and controls.
- Develop proportionate policies, procedures, and records.
- Establish objectives and performance indicators.
- Train employees and process owners.
- Prepare for management reviews and internal audits.
- Investigate nonconformities and develop corrective actions.
- Conduct a certification-readiness assessment.
The consultant should work collaboratively with employees instead of building a system that only the consultant understands. Your organisation remains responsible for operating the system, retaining evidence, and demonstrating conformity.
A consultant also cannot guarantee certification. The final outcome depends on the organisation’s implementation and the certification body’s independent findings and decision.
WWISE provides ISO implementation support to help organisations establish practical management systems, prepare employees, and address gaps before certification.
What Does a Certification Body Do?
A certification body independently evaluates whether your implemented management system conforms to a particular standard, such as ISO 9001, ISO 14001, ISO 45001, or ISO/IEC 27001.
Its responsibilities normally include:
- Reviewing your application, certification scope, sites, and employee numbers.
- Determining the required audit duration and technical competence.
- Appointing a suitably qualified audit team.
- Conducting the Stage 1 and Stage 2 certification audits.
- Reporting nonconformities and other audit findings.
- Reviewing corrective action evidence where required.
- Making an independent certification decision.
- Issuing the certificate when all requirements have been satisfied.
- Conducting surveillance and recertification audits.
During Stage 1, the certification body reviews areas such as your certification scope, documented information, organisational context, internal audits, management review, and readiness for Stage 2. The Stage 2 audit then evaluates whether the management system has been implemented effectively across the organisation.
The certification body may explain an audit requirement or finding, but it cannot write your procedures, design your controls, or complete corrective actions on your behalf. Doing so would compromise the independence and impartiality of the certification process.
The Difference Between an ISO Consultant and a Certification Body
An ISO consultant supports your organisation with implementation and preparation. This may include conducting a gap analysis, helping employees understand the standard, developing documented processes collaboratively, providing training, and assisting with management system maintenance and improvement.
However, the consultant does not conduct the independent certification audit, decide whether certification should be granted, or issue the ISO certificate.
The certification body has a different purpose. It conducts the formal certification audits, reports its findings, reviews the organisation’s response to any nonconformities, and makes the final certification decision. When the requirements have been satisfied, the certification body issues the certificate.
After certification, a consultant may continue supporting the organisation with training, system maintenance, and continual improvement. The certification body maintains its independent role through surveillance and recertification audits. Keeping these responsibilities separate protects the credibility of the certification process.
How the Two Roles Fit into the Certification Process
A typical ISO certification process follows these steps:
- Your organisation selects the relevant ISO standard and defines its certification scope.
- An ISO consultant may conduct a gap analysis and support implementation.
- The organisation operates the system and generates evidence.
- Internal audits and management reviews are completed.
- An accredited certification body is selected and contracted.
- The certification body conducts the Stage 1 audit.
- The organisation addresses any readiness concerns.
- The Stage 2 certification audit is completed.
- Audit findings are corrected, where applicable.
- An independent certification decision is made.
After certification, the consultant may continue supporting system maintenance, training, and improvement. The certification body returns for periodic surveillance audits and, typically, a recertification audit before the end of the certification cycle.
What Happens When an Auditor Raises a Nonconformity?
The certification auditor records the requirement, the evidence examined, and the nature of the nonconformity. Your organisation must investigate the root cause, take appropriate corrective action, and provide the required evidence.
A consultant may help your team apply a root-cause analysis method, assess the proposed action, and prepare evidence. However, process owners should remain involved and accountable. The consultant should not argue with the auditor on your behalf or attempt to influence the certification decision.
The certification body determines whether the response is acceptable and whether evidence of implementation or effectiveness is required.
How to Choose the Right Providers
When choosing an ISO consultant, look for relevant standard knowledge, industry experience, recognised auditing credentials, practical implementation ability, and a clear knowledge-transfer approach. Be cautious of anyone promising “guaranteed certification” or offering a generic pack of documents without understanding your operations.
When selecting a certification body, confirm:
- Its accreditation status and accredited scope.
- Its experience in your industry.
- The competence of its proposed auditors.
- Its audit, transfer, suspension, and appeals processes.
- The complete certification and surveillance costs.
- Whether the certificate will meet customer or tender requirements.
South African organisations should verify the certification body’s accreditation and ensure that its scope covers the required management system standard and industry sector.
Common Mistakes to Avoid
Do not purchase an “ISO certificate” from a consultant without an independent certification audit. Avoid arrangements in which the certification body or its auditors also provide management-system consultancy.
Organisations should also avoid outsourcing the entire system to a consultant. Employees must understand their responsibilities and be able to explain how processes work during the audit.
Finally, do not wait until implementation is complete before contacting a certification body. Auditor availability, quotation approval, Stage 1 scheduling, corrective actions, and the certification decision can all affect your planned completion date.
Keep the Roles Separate but Coordinated
An ISO consultant builds capability, supports implementation, and prepares your organisation for assessment. A certification body independently audits the resulting system and decides whether certification can be granted.
WWISE can assist with gap analysis, implementation, management-system maintenance, internal audit preparation, and employee training. Certification itself must be awarded by an independent certification body.
To prepare your organisation for a credible and efficient certification process, speak to an ISO implementation specialist.
