ISO 27001 Consultant vs Certification Body: Do You Need Both?

What is an ISO 27001 Consultant?

An ISO 27001 consultant helps your organisation build and prepare an information security management system (ISMS) to meet ISO/IEC 27001 requirements. They assess existing arrangements, identify gaps and help put suitable controls and processes in place. Their support may include:

• Gap analysis: Comparing current practices with the standard’s requirements.
• ISMS development: Defining the scope, processes and responsibilities.
• Risk assessment: Helping identify and assess information security risks.
• Policies and documentation: Preparing or improving policies, procedures and the Statement of Applicability.
• Audit preparation: Helping your team organise evidence and prepare for internal and external audits.

The consultant advises and supports your team; your organisation remains responsible for its ISMS and the decisions behind it. A consultant can help you prepare for certification, but cannot issue an ISO 27001 certificate or guarantee the audit outcome. The formal certification audit and decision belong to an independent certification body.

Does every company need a consultant?

Not really. Consultants used to be the gatekeepers of ISO 27001 knowledge. Now online content and AI tools let more companies do much of the work themselves. But even with AI, it’s a lot of work and easy to go down the wrong path. A month or two of a small team’s time may be better spent paying an expert to project-manage the process.

Either way, the standard requires a competent internal audit by someone experienced with the standard. So even companies that build their ISMS themselves need a consultant or experienced auditor for the internal audit.

What is an ISO 27001 Certification Body?

An ISO 27001 certification body independently assesses an organisation’s information security management system (ISMS) against ISO/IEC 27001 and decides whether it meets the requirements for certification.

At Tempo Audits, we carry out this assessment in two stages. Stage 1 reviews the ISMS documentation and readiness for the main audit. Stage 2 checks whether the system and its controls are operating in practice. If the requirements are met and any necessary corrective actions are accepted, we make the certification decision and issue the certificate. We then conduct surveillance audits during the certification cycle and assess the system again at recertification.

As a UKAS-accredited certification body, we must remain impartial. We cannot design or implement the ISMS, write its policies or prescribe how the organisation should fix a finding if we are also assessing that system for certification. We explain the relevant requirement and our findings clearly; the organisation decides how to address them. That separation lets us assess the system on its evidence, rather than certify our own advice.

Why You Cannot Use One Instead of the Other

An ISO 27001 consultant and a certification body have separate responsibilities. A consultant can help build your ISMS, but cannot issue a certificate. A certification body must assess the system independently. Under impartiality requirements for accredited certification, it cannot provide management system consultancy to a client whose ISMS it certifies. That separation matters: an auditor must judge the evidence against ISO/IEC 27001, not sign off their own implementation advice.

If you work with a consultant, engage a separate certification body for the formal Stage 1 and Stage 2 audits. Tempo Audits assesses your ISMS, explains our findings and makes the certification decision. We do not write your policies or prescribe how to implement controls. Your consultant supports the preparation; we determine whether the system meets the certification requirements.

You can develop your ISMS without hiring a consultant. But if you do use one, the certification audit must be carried out independently by a certification body.

How the Two Roles Work Together

The route to ISO 27001 certification has a clear handover: your consultant helps you prepare the ISMS; the certification body then assesses it independently.

For many SMEs, preparation can take around three to six months, depending on the organisation’s starting point and the time it can commit. At Tempo Audits, the formal audit process typically takes around three to four weeks, with certification issued about a week after Stage 2 if the requirements are met. That makes the handover point clear: the consultant’s preparation work ends before our independent assessment begins.

“

Tempo prefers the internal audit to be done before Stage 1. Companies that implemented the ISMS themselves should leave at least 2 to 4 weeks after the internal audit to fix findings. Companies that prepared confidently with a good consultant can move straight on.

What UKAS Accreditation Means for Your Certificate

UKAS is the UK’s national accreditation body. It assesses certification bodies against requirements including ISO/IEC 17021-1, checking that they are competent and impartial to audit management systems within their accredited scope. UKAS accredits the certification body; the body audits your ISMS and decides whether it meets ISO 27001.

For a business, this provides independent assurance that the certification process follows recognised requirements. It can also matter in procurement, contracts and enterprise sales, where a customer may specifically require a certificate issued by a UKAS-accredited certification body.

Tempo Audits is UKAS-accredited to certify organisations against ISO/IEC 27001. When choosing a certification body, check that its accreditation scope covers the standard you need.

Common Stage 1 Gaps We See at Tempo Audits When Companies Arrive Unprepared

At Stage 1, we check whether your information security management system (ISMS) is clearly defined, documented and ready for the full implementation audit. Three gaps often need attention.

“

A good consultant gives Tempo more confidence that a client is prepared, because they’ve taken many clients through the process. Companies preparing themselves or through less tested routes carry a higher risk of more findings. That can push back Stage 2 or leave more work to do afterwards.

UK ISO 27001 Costs: Consultant Fees vs Certification Body Fees

Consultancy prepares your ISMS; our certification fees cover its independent assessment. They are separate budget lines. If you’re comparing an ISO 27001 consultant in the UK, check whether the quote covers advice on specific tasks or the full implementation.