ISO consultant vs certification body: who does what

This page is a buying guide. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional-services firms who need accredited certification to ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001 — and who keep being sold one firm for two jobs.

Those jobs are not the same product. One is design and implement the management system. The other is independently certify it. Mixing them up is how buyers send a consulting statement of work to a registrar, treat a training badge as a certificate, or let the firm that wrote the procedures pick the only body that will audit them.

It does not republish how to choose a registrar, how to write the outbound RFQ, how to score a shortlist, or how to verify accreditation. Those chapters still apply. This page is only the split: who does what, what belongs in which document, which independence problems are actual problems, and how to use both kinds of help without folklore.

It does not invent prices, day-rate totals, or accreditation identifiers.

1. Two different jobs

A management system is work you run: documented information, competence, internal audit, management review, corrective action — on the floor or in the ISMS, not in a ZIP file from last quarter. Getting that system to exist is implementation. Someone has to design the scope, close the gaps, train the people who do the work, and leave evidence that internal audit and management review have touched this system.

Accredited certification is a different job. A certification body (CB), also called a registrar, samples whether that system conforms to a named standard and issues a certificate under accreditation. Stage 1 is a design review of readiness. Stage 2 tests whether the system works. Surveillance and recertification keep sampling after the mark is on the wall. The product is an independent audit programme, not a purchased pass.

Treat the split the way you already treat financial audit. The controller can hire a firm to close the books. That firm should not also be the external auditor who signs the opinion. ISO management-system certification uses the same spirit. ISO/IEC 17021-1 is the impartiality rule set accreditation bodies use when they assess CBs. You do not need the clause list. You need the buyer consequence: the body that certifies you must not have consulted on the system it is certifying.

What that looks like in ordinary mid-market rooms:

Job	Who typically does it	What “done” looks like
Design / implement	Your team, a consultant, or both	A system people actually run; gaps closed; internal audit and management review on this scope
Independently certify	An accredited CB	Stage 1 and Stage 2 on a designed programme; a certificate mark customers can check; surveillance after issue

Confusion is cheap to buy:

• A quality manager asks “who does ISO” and gets one vendor who writes procedures and “handles the audit.”
• A salesperson says they are “ISO certified,” which means their company holds a certificate, not that they may certify you.
• Procurement puts “ISO consultant / registrar” on one RFQ because the bid form had one row.

Those are not efficiencies. They are two procurements taped together. The certificate that survives customer due diligence is the second job. The system that survives Stage 2 is the first. You can hire help for the first. You still have to buy the second from someone else.

If you already know you need an accredited registrar and only want the selection method, start at how to choose. If you already have names, verify the legal entity before you treat a brochure as a certificate. Come back here when someone is still arguing that implementation and certification are the same invoice.

2. What each one sells

Name the products. Sales language will not.

What a consultant or implementer sells

Useful implementation help is readiness work. Typical lines, when they are honest:

• Gap analysis against the standard and edition you actually need — not a generic “ISO readiness score.”
• Documented information: procedures, process maps, a Statement of Applicability that matches the ISMS you operate, an aspects or hazard register someone will maintain.
• Training and awareness for process owners, internal auditors, and the people who will be interviewed.
• Internal audit support: a programme, a couple of sampled audits, coaching so your people can run the next ones.
• Management-review hygiene: an agenda that sees this system, not last year’s orphan binder.
• Project management so Stage 1 is not the first time anyone opened the scope.

That work can be excellent. It can also be theatre: a binder nobody on the floor has seen, a 27001 SoA that lists a cloud estate the site list never named, an EMS legal register that died when the consultant left. The test is not page count. The test is whether the people who do the work can show it without staging a tour.

A consultant is not selling:

• An accredited certificate.
• The right to use a certification-body mark.
• A guarantee that Stage 2 will pass.
• The legal entity that will appear on IAF CertSearch after issue.

If the proposal bundles “implementation plus certification,” stop and split the page. You may still hire them for the first half. You may not treat the second half as the same product.

What a certification body sells

A CB sells an accredited audit programme for a named legal entity, standard, and scope. Typical lines, when they are honest:

• Stage 1 — readiness and scope sanity. Written findings if Stage 2 would be premature. What that visit is for sits in Stage 1 versus Stage 2.
• Stage 2 — implementation audit: processes, interviews, evidence.
• Surveillance in the years after issue, then recertification before expiry.
• A certificate issued after the CB’s independent review, not by the auditor in the closing meeting.
• A mark customers, portals, and insurers can store — only as useful as the accreditation behind it.

A CB is not selling:

• Your quality manual, your SoA, or your internal-audit calendar.
• A guaranteed pass.
• Implementation “to make Stage 1 easier,” except in the narrow sense of clarifying the standard.
• A training badge that looks like ISO stationery.

Bounded products CBs sometimes offer — a pre-assessment, a gap-shaped visit with a hard wall around consulting — are still not implementation. If the same legal entity that would certify you is also writing your procedures, you do not have a bounded product. You have a conflict. Gap assessments a CB sells should stay small enough that they cannot be accused of designing the system. Implementation is yours or a disclosed consultant’s.

This site does not publish audit prices. Day counts start from effective personnel, complexity, and sites. Compare programmes, not folklore. What a proposal should contain after you send the pack lives in what CB quotes include.

3. RFQ pack to CBs; consulting SOW is a different document

Two artifacts. Two audiences. Do not merge them because both PDFs say “ISO.”

The registrar RFQ / scope pack goes to certification bodies. It describes the programme you want quoted: standards and editions, sites and headcount bands, central function, processes and shifts, integrated versus separate certificates, transfers, customer AB or brand constraints, remote versus on-site preferences, the timeline you can staff, certificates you already hold, and who implemented the system. One page, same pack to every body on the shortlist. The copyable checklist is how to build a registrar RFQ / scope pack. This page does not rewrite that chapter. It only says: that pack is not a consulting SOW.

The consulting statement of work buys readiness. It names deliverables, owners, a finish line that is your system (not the certificate), and what “done” means before anyone invites a CB. Typical contents: gap method, documented-information list, training plan, internal-audit support, which sites the consultant will actually walk, what your team still owns, and an end date that is Stage 1 readiness — not “certificate in hand.”

Put this here	Consulting SOW	Registrar RFQ / scope pack
Who does the implementation	Named vendor, hours or milestones, what they will write or coach	One disclosure line: internal / named consultant / none
Procedures, SoA, registers	Deliverables	Do not attach the binder. Evidence waits for Stage 1
Gap analysis	The product	Not a CB quote line
Internal audit / management review	Often in scope as support	Readiness facts the Stage 1 auditor will test
Accredited Stage 1 / Stage 2	Out. Do not buy a certificate from the implementer	The product
Certificate mark	Not something a consultant issues	CB product, after independent review
Training / course certificates	Fine as competence evidence	Not a substitute for accredited certification
Day-count target or “guaranteed pass”	Leave it off	Leave it off. Ask for a designed programme, not a wish
Independence	Say they will not certify	Confirm the CB did not consult on this system
Legal entity to be certified	Context for the work	Required on the pack
Customer AB / brand constraints	Useful so the consultant does not steer one logo	Required so you do not invite a body you cannot award

What goes wrong when the documents collapse:

• The consultant’s pack is sent to “their” registrar only. You never ran a bake-off. You ran a referral.
• The CB receives the whole IMS binder and no site list. Quoting managers will not mine a quality manual for the second shift.
• You ask the CB to “finish the procedures in Stage 1.” That is asking them to consult on the system they will certify.
• You send a different, thinner pack to the famous logo and the consultant’s full pack to everyone else. Unlike packs produce unlike day counts.

Fill the consulting SOW until the system is honest enough to describe. Then write one registrar pack from those facts — not from the consultant’s favorite logo. Disclose the implementer on that pack. Every other body still needs to know who did the work. Hide that, and you waste a competent CB’s time or walk into an independence problem after you have already picked a favorite.

If more than one location does the work the certificate will claim, the pack needs a site list. That map is multi-site certification scope. If the question is whether 9001, 14001, and 45001 belong on one CB programme, that is integrated ISO management systems. Neither of those pages is a consulting SOW.

4. Independence red flags

Independence is not flavor text. A certificate is useful because someone who did not write the system sampled it. Accreditation bodies assess CBs against that idea. Buyers still have to notice when a sales process is trying to skip it.

Treat these as stops, not as items to “manage later.”

The same firm writes the procedures, then certifies. ISO/IEC 17021-1 restricts a CB from certifying a management system it consulted on. “We have a separate certification division” does not automatically fix it if the same company designed your documented information last quarter. Related bodies, shared branding, and a salesperson who staffs both sides of the wall are the usual mid-market pattern. If they implemented, they are off the certifier shortlist. Other CBs can still quote — once you disclose who implemented.

“Guaranteed certificate.” The product is an independent audit. A guaranteed pass is a purchase order for stationery. It attracts the wrong bodies and teaches your team that findings are a failure of vendor management rather than of the system. A pack that hints you want a promised pass belongs in the same bucket. Competent CBs will no-bid or will ignore the hint. The ones who lean in are advertising the wrong product.

A training outfit issuing “ISO certificates.” Course completion, a badge, a wallet card, “certified ISO lead auditor” as a personal qualification — those can be real competence. They are not an accredited management-system certificate for your organization. A firm that is itself “ISO certified” holds a certificate about them. That is not a right to certify you. If a website says “we are ISO certified, so we can certify you,” stop. Ask whether they are an accredited CB, which accreditation body assessed them, and which legal entity holds that accreditation. The lookup is verify registrar accreditation.

The only registrar on the list is the one the consultant named. A consultant who knows your sector can recommend bodies that staff that sector. That can be efficient. It is a conflict when they wrote the system, take a referral fee they will not disclose, or refuse to put more than one name on the table. You still need three to five accredited CBs, built from your constraints — customer marks, geography, 27001 or 42001 competence — not from one implementer’s preferred inbox. How to build that set is how to choose and shortlist and score 3–5.

Other patterns that belong with the four above:

• Referral fees that will not be named. If the implementer is paid when you pick “their” CB, you are not running a bake-off. Say so on the pack, or take them off the registrar process.
• Consulting bundled as accreditation on a CB quote. Training and consulting sold by a related company should be walled off from the audit. If the proposal cannot show the wall, it is a weak proposal.
• A promise to ignore open majors, or to treat Stage 1 as a courtesy before a Stage 2 date next week despite a hollow internal-audit programme. Utilization is not impartiality.

None of this requires you to become a 17021-1 specialist. It requires you to notice when one commercial relationship is trying to do the controller’s job and the external auditor’s job.

5. How to use both well

You can hire both. You should not hire them as one.

Get ready first — or in parallel with a honest timeline. If the system does not exist, a CB quote is a designed audit of a system that is not there. Stage 1 will find that. Implementation help (internal, consultant, or a mix) is how mid-market plants and professional-services firms close gaps, train process owners, and put internal audit and management review on the calendar. The consultant’s finish line is Stage 1 readiness, not the certificate. Do not write “certificate date” into an implementation SOW as if the CB worked for the consultant.

Shortlist accredited CBs separately. Constraints first, logos second. Three to five bodies. One recognized global brand, one regional or manufacturing-dense registrar if you are a plant, one security-competent body if 27001 or 42001 matter, optionally a sister-company CB if accreditation still fits. Invite bodies you can actually award. Exclude the implementer. Exclude a training house that “issues certificates.” Exclude a body that cannot name the legal entity or the accreditation body. The method is how to choose a registrar. The scorecard is compare a shortlist. The live lookup is verify accreditation. This site’s directory is an editorial shortlist, not a live accreditation feed.

Disclose the implementer on the registrar pack. One line. Internal team, named consultant, or none. Every CB on the shortlist sees the same line. You are not asking them to approve the consultant. You are telling them the independence fact before they spend quoting time.

Do not let the consultant write two packs. One registrar pack, from your facts, to every body. The implementer can help you fill the site table. They should not customize a thinner pack for the logo they like. They should not send the pack on your behalf to a single inbox and call that “getting quotes.”

Keep CB contact with your team. Process owners, the management-system owner, procurement. A consultant may join a scoping call. They should not be the only voice the quoting manager hears. Cultural fit is how the CB will argue about evidence for three years. You cannot score that if you never met them.

Verify the entity yourself. Do not accept “our registrar is accredited” as a close. Ask for the legal entity that will issue, the accreditation body, the standard and edition. Look that entity up in the AB directory and in IAF CertSearch. Press releases age. So do consultant slide decks.

If you already hold a certificate and the irritation is the implementer-turned-certifier relationship, that is a transfer question — after you confirm the current mark still fits. If the certificate is fine and the problem is one auditor, stay.

6. Where mid-market attention actually goes

This site does not publish prices, day rates, or invented budgets. The split you can plan without a number is attention, calendar, and which document you are writing.

Most of the work is the system. Documented information, competence, internal audit, management review, evidence on the floor or in the ISMS. That is where process-owner hours go. A consultant, if you hire one, is buying some of those hours back — not buying the certificate. Starving that work to “save it for the audit” is how Stage 1 becomes a finding generator.

The CB programme is smaller in calendar and stricter in independence. Stage 1, Stage 2, then surveillance. It is a designed sample, not a second implementation project. Spend buying attention here: live accredited scope, sector competence, a readable quote, a planning window the plant can live with. Do not spend it on binder aesthetics you already paid a consultant to pretty up.

A practical mid-market split of attention (not dollars):

Where the hours go	Typical owner	What “enough” looks like
Making the system real	Your process owners; consultant if you hired one	People can show the work without a staged tour
Internal audit and management review	Management-system owner	They match this scope, this cycle
Writing one registrar pack	Quality / compliance + whoever walked the sites	Same page to every CB; implementer disclosed
Checking legal entity and live scope	The person who will sign the CB contract	Viewed this week; not last year’s PDF
Scoring three to five replies	Same owner, with procurement in the room	Musts are gates; logos are not a criterion
The audits themselves	Process owners + CB	Staffed; findings owned by you, not the consultant

Ways buyers mis-allocate without needing a fake budget:

• All attention on the consultant, none on the CB bake-off. You will get a tidy binder and one referral. Customers will still ask which accredited body issued the mark.
• All attention on logos, none on the system. You will collect unlike day counts for a programme that is not ready. Stage 1 will say so in writing — if the CB is honest.
• Paying for documentation polish while the second shift is unnamed. The pack is the facts. Pretty procedures do not delete a warehouse.
• Treating CB days as the whole cost of “doing ISO.” The audit is the sample. The system is the work. This page will not invent a ratio. It will say: do not use a CB quote as a proxy for implementation effort, and do not use a consulting SOW as a proxy for an accredited programme.

Professional-services firms often reverse the shop-floor picture — more time in the ISMS and access reviews, less in coating lines — and still need the same split: implementation is yours (or a disclosed consultant’s); certification is an accredited CB’s. Manufacturers who already run 9001 and are adding 14001/45001 should not assume the consultant who wrote the quality manual is the certifier for the stack. Whether that stack belongs on one RFQ is IMS buying. Who may audit it is this page.

7. Decision checklist, then send the registrar pack

Work top to bottom. If you cannot tick a row, that row is the programme — not a footnote for after kickoff.

1. Name the two jobs. Implementation (system design, gaps, training, internal audit support) is separate from accredited certification (Stage 1, Stage 2, surveillance, the mark). If one vendor is selling both as one product, split the page or walk away from the certification half.
2. Who is implementing. Internal, named consultant, or none. Write it down. That name is a disclosure on the registrar pack, not a candidate on the CB shortlist.
3. Consulting SOW is readiness. Deliverables, sites the consultant will walk, what your team still owns, a finish line that is Stage 1 readiness — not “certificate guaranteed.”
4. Registrar RFQ is a different document. One scope pack, same facts to every body. Checklist and what to leave out: RFQ / scope pack. Do not attach the binder. Do not send the SOW as if it were the RFQ.
5. Independence stops. Same firm writing then certifying. Guaranteed certificate. Training outfit issuing “ISO certificates.” Only-one-registrar-from-the-consultant. Unnamed referral fees. Any one of these is a no-bid for that certifier, not a negotiation item.
6. Shortlist CBs separately. Three to five accredited bodies from constraints, not from a single referral. Choose, then score.
7. Verify the entity before you invite a body you cannot award (accreditation lookup). This site’s directory tags are editorial, not a live feed.
8. Keep the consultant out of the award vote. They may help you fill facts. They should not be the only source of names, the only voice on the scoping call, or the person who “simplifies” the site list for a preferred logo.
9. Staff Stage 1 as your system, not the consultant’s tour. The registrar is not your consultant of record. They can clarify the standard. They should not write your procedures the week before they audit them.
10. One pack, then quotes. Submit the registrar pack — not the consulting SOW — with the Get quotes button below. Then open the directory and keep the shortlist to names you can actually award.

If the jobs are split and the pack is honest, send that pack. Do not send a thinner version to the body the consultant already likes. Do not collect numbers before the site list is written. Do not treat a training badge as the mark you needed.

This page is the split, not a substitute for competence and independence. When you are ready, the next action is the same as the other buying chapters: one registrar scope pack, several CBs.