10 warning signs in a certification quote
Be careful when a quote names no accreditation body, comes with consultancy, or promises a pass. Tick each sign you see. You get the question to send for each one.
Your quote check
Questions to send
0 signs ticked
Tick each sign you see in the quote. The question for each one collects here.
- "Which accreditation body accredits you for ISO/IEC 27001, and what is the number?"
- "Send the link to your entry in the registry of a national accreditation body."
- "Do you, or a company under your control, sell ISO/IEC 27001 consultancy or implementation work?"
- "What happens if the audit finds a major nonconformity?"
- "Which facts did you use to calculate the audit time?"
- "When is stage 1, and how many days before stage 2?"
- "Why does the certificate run longer than 1 certification cycle?"
- "Send your current certificate to ISO/IEC 27001:2022."
- "Do you pay a commission to anyone for this referral?"
- "Send the link to your entry in the registry. A PDF can be out of date."
Not warning signs
- A body from another EU country. Recognised accreditation is accepted across Europe.
- Remote audits. The rules allow them when you and the body agree.
- A higher day rate. Compare the 3-year total, not the rate.
- A group that also issues SOC 2 reports. That is a separate attestation, not consultancy.
Why consultancy and certification stay apart
A certification body, or a company it controls, must not sell management system consultancy. A body that audits its own advice has a reason to pass you. Public training is allowed. One pre-audit before stage 1 is allowed when it does not threaten impartiality.
Some sellers issue certificates with no real audit, under logos that look like accreditation marks. Large customers check the registry and reject them.
Check the accreditation of each body that quotes
Pick the accreditation body on its sample certificate. Open the official registry and follow the exact clicks.