For many UK businesses, Cyber Essentials is the first formal cyber security certification they achieve. Some then progress to Cyber Essentials Plus, complete the technical assessment and quite reasonably think: “If we've already got Cyber Essentials Plus, why would we need ISO 27001 as well?” It's a good question. After all, both are associated with information security, both can provide assurance to customers, and both regularly appear in supplier questionnaires and tender r

More businesses now operate without a traditional office. Employees work from home. Meetings happen on Teams. Documents sit in SharePoint or Google Drive. Customer systems are cloud-based. Some companies may not have a permanent business premises at all beyond a registered address. That can create an understandable question when ISO certification becomes relevant: Can a fully remote or home-based business actually become ISO certified? The answer is yes. ISO certification is

A newly formed company finds a contract it wants to bid for. The opportunity looks ideal, but the supplier requirements ask for ISO 9001 certification. That creates an obvious problem: How can a new business become ISO certified when it hasn’t been operating for years? It is easy to assume that ISO certification requires a long trading history, dozens of completed projects and years of performance data. It doesn’t. A new business can achieve ISO certification, but there does

Businesses change constantly. A new software platform is introduced. A supplier is replaced. A team is reorganised. A company moves premises. New equipment is installed. A process that has worked for years is redesigned. Most of these changes are made for good reasons. They are intended to improve efficiency, reduce cost, support growth or solve an existing problem. But change also creates risk. And one of the most commonly overlooked parts of an ISO management system is maki

For many software and technology businesses, the first serious conversation about ISO 27001 does not start with an auditor. It starts with a customer. A promising enterprise prospect sends over a security questionnaire. Procurement asks about information-security certification. A potential client wants to know how customer data is protected. Then comes the question: “Are you ISO 27001 certified?” For a growing SaaS or technology company, that can quickly turn information secu

If you have started comparing ISO certification providers in the UK, you will probably come across the term UKAS accredited very quickly. Some providers emphasise it heavily. Some tender documents specifically ask for it. Others simply ask for ISO certification without mentioning accreditation at all. That leaves many businesses with an important question: Does your ISO certification body actually have to be UKAS accredited? The answer is not as simple as many people assume.

Most businesses put a lot of effort into achieving ISO certification. The system is implemented, the audits are completed, the certificate is issued - and then ISO gradually becomes part of normal business life. Until somebody notices the expiry date. Perhaps a surveillance audit was missed. Maybe the recertification process was left too late. Sometimes responsibility changed internally and nobody realised the certification cycle needed attention. Then comes the uncomfortable

When a business starts ISO certification, a lot of attention naturally goes to the standard itself. Do we need ISO 9001?Should we add ISO 14001?How long will certification take? But there is another decision that can have a major impact on how useful your certificate becomes: What exactly should the scope of ISO certification cover? The scope is the wording that describes the activities, services and operations included within your certification. Get it right, and the certifi

A tender opportunity appears, the contract looks ideal, and then you reach the supplier requirements. ISO 9001, ISO 14001, ISO 45001 or ISO 27001 is listed - but your business has not completed certification yet. Perhaps your management system is already being implemented. Maybe the certification audits have been booked. You may even have completed Stage 1 and be waiting for Stage 2. That creates an important question: Can you still submit the tender while ISO certification i

One of the first decisions businesses face when considering ISO certification is whether they need outside help. Some companies are told that appointing an ISO consultant is essential. Others buy a set of templates, assign the work internally and plan to go directly to certification. That raises an obvious question: Can you get ISO certification without using a consultant? The answer is yes. There is no requirement to appoint a consultant before applying for certification. Ho

As a business grows, its structure often becomes more complicated. A second office opens. A warehouse is added. Regional depots begin operating. Another company is acquired. Different legal entities start trading under the same group. That can create an important question: Does every location and company need its own ISO certificate, or can one certificate cover the whole organisation? In many cases, multi-site certification is possible. However, simply owning several busines

Many construction and engineering businesses rely heavily on subcontractors. Electrical work, groundworks, scaffolding, specialist installation, design support and site labour may all be delivered by external providers rather than permanent employees. That often raises an important question when the business starts considering ISO certification: Can we still become certified if subcontractors carry out a significant part of our work? The answer is yes. Using subcontractors do

One of the first questions many businesses ask when discussing ISO certification is: “Does the auditor actually need to come to our premises?” For years, businesses assumed that an ISO audit automatically meant an auditor spending one or more days on site, sitting in a meeting room, reviewing documents and interviewing staff. That is no longer always the case. Remote auditing has become an established part of ISO certification, and for many businesses, a significant proportio

One of the first decisions businesses face is surprisingly difficult. Should you certify to one ISO standard now and add others later? Or should you implement an Integrated Management System (IMS) that combines multiple standards from the start? If you're aiming for ISO certification to support growth, win contracts or improve your management systems, it's an important decision. Choosing the right approach can save time, reduce duplication and make certification easier to mai

One of the most common calls businesses make is this: "We've just found out we need ISO certification for a tender. How quickly can we get it?" Sometimes the requirement appears in a supplier questionnaire. Sometimes it arrives as part of a framework application. Sometimes a major customer suddenly asks for certification as a condition of doing business. Whatever the trigger, the result is usually the same. The business wants ISO certification quickly. The question is whether

One of the most common things we hear from business owners is: "We already have good processes. We know what we're doing. Do we really need ISO?" It's a fair question. Many organisations have been operating successfully for years. They have experienced staff, established ways of working and satisfied customers. From their perspective, certification can sometimes look like an unnecessary layer of paperwork. The reality is that ISO certification is rarely about proving somethin

If you’ve started looking at public sector opportunities, there’s a good chance you’ve come across references to ISO certification in tender documents. Sometimes it appears as a mandatory requirement. Sometimes it sits quietly within the scoring criteria. And sometimes it’s not mentioned directly at all, but suppliers with certification seem to have an advantage. This often leaves businesses asking the same question: Do we actually need ISO certification to win public sector

“Can we fail an ISO audit?” It’s one of the first concerns many businesses have when they start thinking about certification. There’s often a perception that ISO audits are designed to catch companies out, or that one mistake means the entire certification process collapses. In reality, ISO audits are usually far more practical than people expect. Most businesses do not fail because they are incapable of meeting the standard. They struggle because the system has been rushed,

If you have started looking for ISO certification, you may already have noticed something confusing. One provider gives you one price.Another gives you a completely different price.Someone else promises certification quickly and cheaply. So why do ISO certification quotes vary so much? And more importantly, how do you know whether you are comparing like for like? This is an important question, because the cheapest quote is not always the best value - and the most expensive qu

If you run a construction or engineering business, ISO certification can quickly become confusing. One tender asks for ISO 9001.Another asks for ISO 14001.A framework asks for ISO 45001.Then a client questionnaire asks whether you have “recognised management system certification”. So the obvious question is: Which ISO standards do construction companies actually need? The answer depends on the type of work you do, the clients you want to work with, and whether you are targeti