Can your certification body also be your ISO consultant?

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

No. The reason is worth understanding, because it explains a good deal about how this market works.

A certification body, also called a registrar, is the independent company that audits your management system and issues the certificate. On this page we often refer to it simply as your certifier.

If you have talked to BSI, SGS, DNV, NQA, Intertek or Bureau Veritas about ISO 14001 or ISO 45001, you may have noticed that they will audit you, train you and sell you a certificate. What they will not do is write your environmental aspects register, build your risk assessments or set up your management system.

That is not a business choice but a condition of their accreditation, and breaking it would cost them their accredited status.

What the rule actually says

The governing standard is ISO/IEC 17021-1:2015, Conformity assessment: Requirements for bodies providing audit and certification of management systems, and every accredited certification body is audited against it.

Clause 5.2.5: the outright prohibition. This clause names three parties:

• The certification body
• Any part of the same legal entity
• Any entity under the organizational control of the certification body

It says they "shall not offer or provide management system consultancy." There is no time limit on this one. It is not a waiting period, and they cannot offer the service at all.

Clause 5.2.7: the waiting period for related bodies.

This clause covers consulting by a body that has a relationship with the certification body. European Accreditation (EA) states the position this way in EA FAQ Question 33.1 (March 2017). These are EA's words, not a quotation from ISO/IEC 17021-1 itself:

"Where a client has received management systems consultancy from a body that has a relationship with a certification body, this is a significant threat to impartiality. A recognized mitigation … is that the certification body shall not certify the management system for a minimum of 2 years following the end of the consultancy."

In this softer case, where the consulting comes from a related body and not from the certifier itself, it is not prohibited outright. It is, however, a significant threat to impartiality that has to be mitigated, and the mitigation EA names is that the certifier does not certify you for a minimum of 2 years after that consulting ends.

One caveat tends to get dropped when this rule is repeated. EA's answer allows the 2-year period or equivalent measures to reduce the risk, so the 2 years is the standard mitigation, not the only possible one. A certifier that tells you it has a different arrangement is not necessarily wrong. Ask what the measures are, and how the certifier's accreditation body has assessed them.

Clause 5.2.6 applies a similar 2-year minimum where the certifier has provided your internal audits, and clause 5.2.10 applies it to the people who did the consulting.

The related-body rule also reaches further than most people assume. The European Accreditation Certification Committee has held that a single consultant working through their own company counts as a "body" for this rule, so the 2-year rule applies. "It was only a contractor, not a firm" is not a way around it.

Clause 3.3 defines "management system consultancy" as taking part in establishing, implementing or maintaining a management system.

The certification bodies publish their own versions of this rule:

• BSI states that BSI Assurance cannot offer certification to clients who have received consulting from another part of the BSI Group for the same management system.
• DEKRA publishes a 2-year separation between consulting or internal audit work and certification. That wording comes from DEKRA's own certification policies and is not a quotation from ISO/IEC 17021-1.
• NQA says plainly that it aims to "deliver impartial certification services" and so "NQA does not provide consultancy."

What they can still sell you

This is where explanations of the rule often overreach, so be wary of anyone, including a consultant, who tells you that certification bodies cannot help you at all.

Training is allowed. Note 1 to clause 3.3 clearly distinguishes it from consulting, on one condition. Where the course is about management systems or auditing, it must be limited to generic information, and the trainer must not provide company-specific solutions. Note 2 also allows:

• Arranging training courses and lecturing in them
• Explaining certification criteria
• Identifying opportunities for improvement
• Sharing methods
• Discussing non-confidential best practice

So the line runs between generic and company-specific. A certifier teaching a public course on how clause 6.1.2 works is training, while a certifier sitting down to build your aspects register is consulting. Once the finished work has your company's name on it, it has crossed the line.

A pre-assessment is allowed. Note 2 to clause 3.3 clearly allows pre-audit work aimed solely at determining whether you are ready to be certified. That is why certifiers can sell you a pre-assessment without breaching the consulting prohibition.

Referrals are allowed, within limits. NQA openly runs an Associate Consultant Register. Clause 5.2.9 prohibits two things: marketing the certifier's work as linked with a consulting firm's work, and implying that certification would be simpler, easier, faster or cheaper if you use a particular consultant.

UKAS, the UK accreditation body, has gone further, following that same EA committee. A certifier cannot run a "Recognized Consultant Scheme", cannot let consultants use its logo, and cannot use wording that implies it endorses a consultant's competence, because all of these breach clause 5.2.9. A referral list is acceptable only where the certifier does three things:

• States that it does not endorse the consultants
• States that the choice belongs to the client
• States that the choice does not affect the cost or timeline of certification

So if a certifier presents its list to you as approved or recognized consultants, that wording is itself out of bounds, however good the consultant may be.

A corporate group can do both, in sequence. This is the fine point to get right. A large group with a genuinely separate advisory arm can consult for a client and certify the same client. The condition is that the 2-year waiting period, or equivalent measures that reduce the risk, must sit between the end of the consulting and the certification. It is a waiting period, not a permanent prohibition across the whole group. The permanent prohibition is clause 5.2.5, which applies to the certification body itself and anything under its organizational control, and that is a stricter rule, not a softer one.

Why this matters when you are buying

There are three practical consequences.

1. You will hire two companies. One helps you build the management system and the other certifies it. That is not anyone's preference but the way the accreditation system is designed, so budget for both.

2. "We'll handle everything" should prompt a question. If one provider offers to set up your system and deliver your certificate, ask which accredited body is issuing the certificate and whether that body knows about the consulting relationship. Sometimes the answer is fine, because it is a genuine partnership between separate companies. Sometimes the certificate is not accredited at all, which brings us to the third point.

3. Check whether the certificate is accredited. With an accredited certificate, the certification body is itself audited against ISO/IEC 17021-1. That audit is done by an accreditation body that is a signatory to the Multilateral Recognition Arrangement of the International Accreditation Forum (IAF). In the United States, that body is ANAB, the ANSI National Accreditation Board. Certificates issued under other IAF signatories (UKAS, DAkkS, JAS-ANZ and the rest) carry the same recognition. An unaccredited certificate means only that someone printed you a certificate, which anyone can do. When a customer contract says "ISO 14001 certified", it almost always means the accredited kind.

You can verify this yourself at IAF CertSearch, the IAF's global database, which confirms three things at once:

• The certificate is valid
• The certification body is accredited
• The accreditation body is an IAF signatory

You can search by company name or certificate number.

One caveat: coverage is not complete, and not every accredited body uploads every certificate. Finding a certificate in CertSearch is therefore strong evidence, while not finding it is weaker evidence. If a certificate is not listed, ask for the accreditation body's mark and the certificate number, then check that body's own directory.

Our own position in this, honestly

We are a consulting firm, so this rule is good for our business, and you should read this page with that in mind.

We would say the following regardless: the separation exists for a reason that benefits you, because a body that built the system cannot give an independent opinion on it. The value of a third-party certificate comes entirely from the third party genuinely being a third party, and the rule protects the meaning of the certificate you are paying for.

It also means we cannot issue you a certificate. What we do is the following:

• Build the management system
• Run the gap analysis against the standard
• Prepare you for the Stage 1 and Stage 2 certification audits
• Sit with you through the audit

No consulting firm, ours included, can promise you a certificate as an outcome it controls, because that decision belongs to your certification body.

→ ISO 14001 consulting · ISO 45001 consulting · What Stage 1 and Stage 2 audits involve