Choose the system around the business need
Quality, environmental management, occupational health and safety, information security and AI management address different responsibilities. Start with your customer commitments, operations and risks. A relevant standard can help structure management without every organisation needing every certification.
Agree the scope early
Identify the activities, sites, teams, products or services that the management system will cover. Refine this scope during the gap assessment. A narrow certificate scope should not be presented as covering unrelated business activities.
Turn the gap assessment into operating practices
Compare current arrangements with the applicable requirements. Define responsibilities and objectives, implement suitable processes and retain evidence that they operate. Documents alone do not demonstrate an effective system.
Review before independent assessment
Internal audit and management review help the organisation evaluate the system and address weaknesses. Competence and appropriate independence matter. The support engagement should clearly allocate responsibilities rather than implying that the adviser controls certification.
Understand the independent certification assessment
The certification body defines its assessment arrangements, including the applicable Stage 1 and Stage 2 audit process. Findings may require corrections and corrective actions. The body evaluates the evidence and makes its own certification decision; engaging a consultant does not guarantee a certificate.
Maintain the system after certification
Processes, controls and evidence must continue to reflect the organisation. Changes in sites, services, risks or standard editions may require action. Confirm surveillance, recertification and transition arrangements with the certification body.
Keep the three roles distinct
ISO develops the standard. Advisory or implementation support helps an organisation prepare and improve within an agreed scope. An independent certification body assesses the management system and decides whether certification requirements have been met.
Prepare for an initial conversation
Bring the intended standard or business problem, your activities and locations, current certification status, major customer requirements and desired timeframe. If a tender specifies certification, review its exact wording rather than assuming every certificate will satisfy it.
Further reading
ISO: certification and accreditation · ISO: management system certification bodies