How to shortlist and score 3–5 ISO registrars

Choosing how to buy a registrar is one job. Running a bake-off is another. The selection method tells you what “accredited” must mean, why the legal entity beats the brand, and why you design the programme before anyone sends a number. This page is the compare chapter: how many certification bodies (CBs) to invite, how to build that set from the directory plus constraints, how to score replies on one page, and how to leave a memo the next quality manager can defend.

It is written for mid-market manufacturers and professional-services firms — typically operations, quality, IT, or compliance leads — who need accredited certification to ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001.

It does not republish the accreditation lookup. It does not republish what a quote should include. It does not walk transfer or surveillance and recertification. It does not invent prices, day-rate totals, or accreditation identifiers.

1. Why 3–5 CBs (not 1, not 12)

One CB is a relationship you already decided. That can be the right end state. It is a poor process. You will not see under-scoping, a hidden legal entity, or a planning window that only works for the salesperson’s calendar if nobody else is in the room.

Twelve CBs is a science project. Mid-market packs go stale while you wait for the tenth reply. Day counts diverge because someone quietly dropped a warehouse. Serious bodies stop answering when they realize they are one of a crowd. You will spend more time administering the RFQ than reading proposals.

Three to five is the workable mid-market set:

• Enough diversity that one familiar logo cannot win by default.
• Few enough that every body sees the same scope pack while it is still true.
• Large enough to include a recognized global TIC brand, a regional or manufacturing-dense registrar if you are a plant, a security-competent body if 27001 or 42001 matter, and optionally the CB that already audits a sister company — if accreditation and chemistry are still right.

Do not pad to five to look thorough. If customer-named marks, a live 42001 need, and a two-country plant list collapse the set to three, stop at three. Do not invite a body you already know you cannot award (wrong mark, no shop-floor language, consulting conflict). A courtesy RFQ wastes their time and yours.

If you already hold a certificate and the question is “stay or move,” that is transfer, not a twelve-body beauty contest. If the certificate is fine and the irritation is one auditor, stay.

2. Build the shortlist from the directory plus constraints

Start with constraints, not with logos. Write them down before you open the directory:

Constraint	Why it gates the set
Accreditation-body mark	“ANAB only” or “UKAS only” on a customer portal is a fact. An IAF MLA mark that the portal cannot store is still the wrong buy.
Sector / IAF or EA codes	A food-plant specialist is the wrong lead CB for a professional-services ISMS. A security boutique is the wrong lead CB for a heat-treat line.
27001 / 42001 competence	Do not infer AIMS coverage from a 27001 brochure. If 42001 is in the 12–24 month plan, the body has to survive a live-scope recheck, not a press release.
Geography, language, shifts	Multi-site sampling, second-shift interviews, and which legal entity will issue all change with country. A global group is many companies.

Then filter the directory by standard and region. The list you get is an editorial shortlist, not a live accreditation feed. Use it to find candidates. Verify them off-site with the accreditation walkthrough before you treat a profile as awardable.

A manufacturing plant usually needs: one customer-recognized brand, one body that actually staffs factory audits in your region, and — if information security or AI management is on the path — one body that can name lead-auditor competence for those schemes. A professional-services firm often reverses the emphasis: ISMS or AIMS competence first, a recognized mark second, and a factory-dense registrar only if you also run plants.

Exclude early:

• A consultant who wrote the system. ISO/IEC 17021-1 independence is not optional flavor text. How to hire implementation help without mixing it into the bake-off is consultant vs certification body.
• A training house that “issues certificates.”
• A body that cannot name the legal entity or the accreditation body.
• A 42001 offer with no AB named in the quarter you would book Stage 1.

The directory lets you select up to three profiles to compare side by side. That is a visual aid, not a rule that the RFQ may only have three names. Invite three to five. Use the on-page compare for the two or three you are still arguing about after the first read.

3. One-page scorecard (copy this)

Score qualitatively. Must / High / Medium is a weight, not a price. Strong / Adequate / Weak is a judgment, not a dollar total. Do not invent a 100-point model that pretends live accreditation and a friendly account manager are the same unit. Do not convert day counts into a fake “value score.” Days are a designed programme; the anatomy lives in what quotes include.

Copy the table into a sheet. One row per criterion. One column per CB, using the legal entity name, not the group brand.

Criterion	Weight	What you are scoring	Strong	Weak / fail
Accreditation live	Must	Named legal entity appears on the AB’s current schedule for the standard and edition you need	You viewed the schedule this week; entity, standard, and codes match the proposal	Brochure-only claim; last year’s PDF; brand searched instead of entity; 42001 inferred from 27001
Sector competence	High	IAF/EA codes, anonymized similar work, named lead-auditor competence for 27001/42001 if in scope	They can describe a plant or ISMS like yours without reading your website back to you	Excellent in a different industry; no language or shift coverage for shop-floor interviews
Integration design	High if more than one standard	Which clauses are audited once versus twice; one report or several; who leads when quality and security collide	A method (IAF MD 11 and scheme rules), not “we’ll add 27001 onto the 9001 week”	Unexplained day-count collapse; conflicting expiry dates sprung as a surprise
Scheduling honesty	High for plants; Medium for single-site offices	Planning window, remote versus on-site split, what happens when inventory week cannot move	They ask about shutdowns and name a change-lead-time	Surprise week; “we’ll fit you in”; no answer on surveillance windows
Transfer / certificate mark	Must if a customer names a mark or you already hold a certificate	Accepting entity can cover the scope; mark will survive the portal; cycle clock is understood	They describe a transfer review, not a second Stage 2 disguised as a favor	Promise to ignore open majors; unnamed entity; “every portal accepts us”
Cultural fit	Medium	How they argue about evidence; whether findings will be usable	Direct, specific, willing to say no	Theater; guaranteed pass; the auditor you will never meet
Quote transparency	Must	Assumptions you can audit: headcount, sites, complexity, reductions, additions, travel policy, cycle table	Same scope pack in, comparable programme out	Stage 2 only; travel “TBD” across three states; no legal entity; consulting bundled as accreditation

How to use the weights without fooling yourself:

• A Must that is Weak is a no-bid, not a “we’ll manage it.” Live accreditation and a readable quote are gates.
• High items decide among bodies that cleared the gates. Competence and integration usually beat a slightly tidier travel policy.
• Medium items break ties. Cultural fit matters because you will argue about evidence for three years. It does not outrank a missing schedule.

If two CBs are Strong on Musts and Adequates on Highs, pick the one whose planning window and mark you can live with. Do not average the columns into a fake winner.

4. Run the same RFQ / scope pack to all

Write one page. Send that page to every body on the shortlist. How to build the RFQ / scope pack is the outbound chapter; do not rewrite the pack per brand.

Minimum contents:

• Standards and editions.
• Sites, headcount bands, and which sites are central functions (multi-site scope).
• Integrated versus separate certificates.
• Transfer of existing certificates, if any.
• Constraints (customer-named brands, AB marks, no remote Stage 2, languages, shifts).
• Cycle facts you already know: last audit, next audit, expiry — especially if surveillance is due.

What you are asking them to return is a designed programme, not a single number. Point them — and yourself — at what a CB quote should include. Before you treat a reply as real, confirm the legal entity off-site (verify accreditation).

Do not customize the pack so the famous brand “only sees 9001” while the security boutique “only sees 27001” unless you are genuinely buying two CBs. If the programme is integrated, the pack is integrated. If you later split the award, say so in the memo — do not discover the split because two salespeople scoped different companies.

Send the pack once, through one intake, so the assumptions cannot drift. The send is the block at the end of this page.

5. Read replies side-by-side without logo familiarity

Open a sheet. Rows are the scorecard criteria plus a few proposal facts. Columns are legal entities. Then fill the facts before you fill the judgments:

Fact to line up	Why it belongs in the sheet
Issuing legal entity and AB	The brochure is not the certificate
Date you viewed the live schedule	Press releases age
Headcount and site list they used	Unlike lists are unlike days
Complexity category; reductions and additions	This is where under-scoping hides
Days by stage and year (cycle table)	A Stage 2-only price is incomplete
On-site versus remote split	A “cheap” remote Stage 2 may be the wrong product — remote vs on-site
Integration method in one sentence	Vibe is not MD 11
Planning window and change lead time	Plants cannot pause a line for a surprise week
Transfer or mark caveats	Portal configuration is not IAF theory

Logo familiarity is a bias, not a criterion. Put the global TIC name in the same columns as the regional registrar. If the famous proposal hides the issuing company, under-counts a second shift, or cannot name 42001’s AB, it is a weak proposal. If the smaller body is Strong on competence and Musts and merely less famous on a factory floor, that is information — not a defect.

Other ways buyers fool themselves:

• Shortest day count wins. Short can be efficient integration. Unexplained short is a risk transfer onto you. Compare assumptions, not a single bottom-line number.
• The consultant’s favorite. Efficient when independent. A conflict when they wrote the system or take a referral fee they will not disclose.
• The sister-company CB, on autopilot. Right when accreditation, codes, and chemistry still fit. Wrong when you inherit a mark your new customer portal cannot store.
• A 27001 badge as 42001 coverage. Confirm the AIMS schedule in the quarter you would book. Recheck rules sit in the selection method and the 9001 → 27001 → 42001 path.

If replies are incomparable — different site lists, different editions, one body quoting a transfer and another quoting a new Stage 2 — stop scoring. Send the same pack back and ask for a revision. A registrar that cannot describe its own programme will not describe your nonconformities clearly either.

6. Decision memo template (why this CB)

Write this before you sign, not after the first awkward surveillance. Future you, or the next quality manager, will need it when someone forwards a competitor’s logo from a trade show.

Copy:

Award
- Standards and editions:
- Issuing legal entity (not the group brand):
- Accreditation body:
- Date we viewed the live schedule:
- IAF/EA codes they will register:

Constraints that gated the shortlist
- Customer-named mark (or “none stated”):
- Geography / language / shifts:
- 27001 or 42001 in this cycle? Recheck date:

Shortlist (3–5) and qualitative scores
- Entity A — Musts / Highs / Mediums (Strong · Adequate · Weak):
- Entity B — …
- Entity C — …

Why this CB (one paragraph)
- Competence we actually saw:
- Integration design we accepted:
- Scheduling window we can live with:
- Mark / transfer facts:

Why not the others (one line each)
- Entity B:
- Entity C:

Independence
- Who implemented the system:
- Confirmation they are not the certifier:

Notified
- Procurement / plants / IT:
- Customer portals that store a CB name or mark:
- Date the next quality manager should re-verify 42001 (if later):

Keep it short. Do not paste the proposal. Do not record a dollar “score.” Record the judgments and the dates you looked things up. If the award is two CBs (factory stack with one body, ISMS/AIMS with another), say that on purpose — it is a common mid-market design, not a failure to pick a winner.

7. Send one pack, then compare

The bake-off only works if every body sees the same scope. Submit that pack once with the Get quotes button below. Then open the directory and select up to three profiles to compare while you fill the scorecard.

Do not send a second, different pack to the body you already like. Do not collect prices before the page is written. Do not treat this site’s editorial tags as a live accreditation feed — verify the entity you intend to award.

If you already hold a certificate and the fit is wrong, read transfer before you collect a second set of Stage 2 prices. If you are still deciding how to choose at all, start with the selection method. This page is the scorecard, not a substitute for competence and independence.