Can an ISO 27001 consultant certify you?

Last checked 26 October 2026. Sources are listed at the end.

Who issues the certificate

An ISO/IEC 27001 certificate is issued by a certification body after its own Stage 1 and Stage 2 audits. In the UK, accreditation by UKAS is the independent check on that body. ISO puts it this way: a certificate from an accredited body "may bring an additional layer of confidence, as an accreditation body has provided independent confirmation of the certification body's competence."

You can check a UK certificate on UKAS CertCheck by searching the company name or the certificate number.

What the rules say

Certification bodies are accredited against ISO/IEC 17021-1:2015. Its impartiality section, clause 5.2, draws a hard line between certifying and consulting.

• Clause 5.2.5: the certification body, and any part of the same legal entity, shall not offer or provide management system consultancy.
• The European co-operation for Accreditation defines consultancy as taking part in establishing, implementing or maintaining a management system, for example preparing manuals or procedures, or giving specific advice towards developing and implementing it.
• Clause 5.2.6: a certification body that carries out internal audits for a client should not certify that management system for at least two years after those internal audits.
• Clause 5.2.7: where a client was consulted by an organisation that has a relationship with the certification body, the body should not certify that system for at least two years after the consultancy ends.
• Clause 5.2.9: a certification body's activities shall not be marketed or offered as linked with a consultancy.

What that means when you buy

• If one firm offers to build your system and issue your certificate for the same scope, ask which accredited body issues the certificate, then check it on UKAS CertCheck.
• The certification body is your contract and your choice. Its audit fee is separate and paid to it directly.
• Your internal audit has to be objective and impartial under clause 9.2 of ISO/IEC 27001. The person who built the system is not the right person to audit it.

Where Goldline sits

Goldline is not a certification body and does not issue certificates. Goldline will not audit a management system it implemented, and will not sell implementation and certification to the same organisation for the same scope. The internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built your system.

Choosing an ISO 27001 certification body · Readiness assessment, internal audit and certification audit compared · Published prices · ISO 27001 on your own or with a consultant?

Common questions

Sources: ISO/IEC 17021-1:2015, clause 5.2. European co-operation for Accreditation, FAQ 41.1 on clause 5.2.5. ISO, ISO/IEC 27001:2022 standard page. All read 26 October 2026.