Can You Get ISO Certified Without Using a Consultant?
- 11 hours ago
- 6 min read
One of the first decisions businesses face when considering ISO certification is whether they need outside help.
Some companies are told that appointing an ISO consultant is essential. Others buy a set of templates, assign the work internally and plan to go directly to certification.
That raises an obvious question:
Can you get ISO certification without using a consultant?
The answer is yes.
There is no requirement to appoint a consultant before applying for certification. However, taking the completely self-managed route is more realistic for some businesses than others.
The right decision depends on your existing processes, internal knowledge, available time and the complexity of the standard you want to achieve.
The short answer - yes you can get ISO certified without using a consultant
You can prepare for ISO certification without a consultant, and you can get ISO certified without using a consultant.
Your organisation can develop its own management system, complete the required internal activities and then approach an independent certification body for audit.
A consultant can provide valuable support, but they are not a mandatory part of the certification process.
The more important question is whether your business has the knowledge, time and internal resources needed to prepare properly.
What is the difference between a consultant and a certification body?
This distinction is important.
An ISO consultant helps a business design, implement or improve its management system.
A certification body independently audits that system and decides whether it meets the requirements of the relevant ISO standard.
These are two different roles.
The certification body must remain independent. Its job is not to build the system for you and then approve its own work.
A business may therefore choose to:
develop the management system internally
use an independent consultant
use templates and structured implementation support
combine internal work with limited specialist advice
Whichever route you choose, the final certification audit must assess the system impartially.
When the self-managed route can work well
Preparing internally can be a sensible option where the business already has structured processes and someone has the time to coordinate the project.
You may be well placed to manage implementation yourself if you already have:
clearly defined operational processes
organised records and document control
established risk-management arrangements
experienced managers who understand the business
someone able to learn and interpret the standard
enough time to complete the work properly
Many businesses discover that they already operate in a way that is broadly consistent with ISO requirements.
The task is often to bring those controls together, identify any gaps and demonstrate that the system is being used consistently.
What you will need to manage internally
The self-managed route involves more than writing a policy and downloading a few procedures.
Depending on the standard, you will need to establish and maintain activities such as:
defining the scope of certification
understanding interested parties and business context
assessing risks and opportunities
establishing objectives
controlling documents and records
monitoring performance
carrying out internal audits
completing management reviews
addressing nonconformities and corrective actions
The documentation should reflect how your business genuinely operates.
It should not simply repeat the wording of the standard or describe processes that employees do not actually follow.
When a consultant may be useful
External support can be valuable when the organisation does not have suitable knowledge or capacity internally.
A consultant may be particularly helpful where:
certification is required within a demanding timeframe
several ISO standards are being implemented together
the business has multiple sites or complex activities
responsibilities and processes are currently unclear
nobody internally has experience of management systems
previous audits have identified significant weaknesses
The consultant can help translate the requirements into practical actions and keep the implementation project moving.
That can reduce the risk of spending months producing documentation that is unsuitable or unnecessarily complicated.
The cost of doing everything yourself
The self-managed route can reduce external consultancy fees, but it is not necessarily free.
Internal time still has a cost.
Managers and employees may need to spend significant time:
learning the requirements
writing and reviewing documents
gathering evidence
carrying out audits
correcting gaps
preparing staff for certification
If the person leading the project has several other responsibilities, implementation can lose momentum.
A lower upfront cost may not represent better value if the project takes much longer or has to be substantially reworked before certification.
The risk of relying on generic templates
Templates can provide a useful structure, but they do not automatically create a compliant or effective management system.
A common problem is that businesses adopt procedures describing controls they do not actually use.
For example, a template may say that supplier performance is formally scored every quarter, while the company really evaluates suppliers through project reviews and ongoing management discussions.
The documented system and actual practice then conflict.
During certification, the auditor will assess what the business genuinely does - not simply whether documents contain the right terminology.
Templates therefore need to be adapted carefully.
Can your certification body tell you what to change?
The certification body can explain audit findings and identify where the management system does not meet a requirement.
However, it must not design the solution for you.
For example, an auditor may identify that your internal audit programme does not adequately cover the scope of the management system.
The organisation must then decide how to correct that issue.
The certification body can assess whether the eventual action is effective, but it should not act as your implementation consultant.
This independence is an important part of credible certification.
Do you need an internal ISO expert?
Not necessarily.
Someone does need to coordinate the management system, but they do not have to be a full-time quality, environmental, safety or information-security manager.
In a smaller business, responsibility may sit with:
an operations manager
a director
an office manager
a technical lead
another suitably competent employee
The person leading the system needs sufficient authority, time and understanding to make sure the required activities are completed.
ISO should not become the responsibility of one individual alone, though. Process owners and senior management also need to be involved.
How do you know whether you are ready for audit?
Before approaching certification, you should be able to demonstrate that the management system is operating - not merely that the documents have been written.
As a minimum, you should normally have:
defined the scope of the system
implemented the relevant processes
retained records showing those processes are used
completed an internal audit
held a management review
addressed known gaps or nonconformities
Staff should also understand the parts of the system relevant to their work.
They do not need to memorise clause numbers, but they should be able to explain their responsibilities and how activities are controlled.
The common mistake: asking for certification too early
Some businesses approach a certification body as soon as their documents are drafted.
They assume the audit will confirm whether the system is ready and tell them what still needs to be done.
That is a risky approach.
Certification audits are intended to assess an implemented management system. They are not a substitute for implementation support or a full pre-audit consultancy review.
Approaching certification before the system has been operated, audited internally and reviewed by management can lead to delays and additional costs.
Which route is best for your business?
There are three broad options.
Manage it internally
This can work well where you have suitable knowledge, organised processes and sufficient time.
Use a consultant
This may be appropriate where the business needs specialist guidance, has limited capacity or is dealing with greater complexity.
Use a supported self-implementation route
Some businesses choose structured templates, implementation guidance and occasional expert support while retaining ownership of the project internally.
This can provide a middle ground between working entirely alone and commissioning a full consultancy project.
The right option is the one that results in a system your business understands and can continue to operate after certification.
Not sure whether your business can manage ISO internally?
You may already have much of what you need.
Alternatively, there may be gaps that would make some level of implementation support worthwhile.
Our free ISO readiness check can help you understand:
which ISO standards are relevant to your business
how close your existing processes may be to certification
what areas are likely to need further work
what your most practical next step should be
Final thought
You do not need to appoint a consultant to achieve ISO certification.
Many businesses successfully develop and implement their own management systems.
However, doing it yourself only works when the organisation has enough knowledge, time and commitment to complete the process properly.
The objective should not be to produce the largest manual or take the cheapest route.
It should be to create a practical system that reflects how your business works, supports the opportunities you want to pursue and can stand up to an independent certification audit.
Comments