Your ISO 27001 certificate is issued by a certification body, not by your consultant. Goldline is not a certification body and does not issue certificates. This guide sets out how to check accreditation, how to book your audit and what to prepare for a quote.
The UKAS question
Check what your buyer asks for before you choose.
Check UKAS accreditation first
UKAS is the national accreditation body for the United Kingdom, appointed by government. It accredits management system certification bodies to ISO/IEC 17021-1, which confirms a body's competence, impartiality and consistent approach. Certificates from non-accredited bodies are issued by bodies that have not been independently evaluated in this way.
Accreditation is granted by category. Before you shortlist a body, search it in the UKAS directory. Confirm it is listed under Information Security Management Systems Certification (ISMS), not only under another category such as quality management.
UKAS is a full signatory to the international mutual recognition arrangements. Since 1 January 2026 these have been run by Global Accreditation Cooperation Incorporated (Global ACI), which replaced IAF and ILAC. UKAS accredited certificates are accepted as technically equivalent to those of other signatories.
How to book your audit
- Check what your buyer requires. Read the contract, tender or questionnaire that asked for ISO 27001, and note whether it asks for accredited certification.
- Shortlist accredited bodies. Confirm each one in the UKAS directory under the ISMS category.
- Prepare your scope information. Use the list below.
- Request written quotes. Ask each body for a written quote covering the three-year cycle: Stage 1, Stage 2, annual surveillance audits and recertification.
- Confirm next steps. Agree what the body needs from you before Stage 1, who will lead the audit, and the dates. The certification body then sets its own Stage 1 and Stage 2 dates.
Stage 1 and Stage 2
Initial certification is a two-stage audit.
At Stage 1, the auditor:
- reviews your documentation;
- confirms the scope of certification and how far the management system has been implemented;
- confirms whether you are ready for full assessment.
Concerns raised at Stage 1 can become nonconformities at Stage 2 if they are not addressed.
At Stage 2, the auditor tests whether the management system conforms to the standard in practice, using objective evidence and samples of the processes in scope. If a major nonconformity is raised, the certificate cannot be issued until corrective action is taken and verified.
Once issued, the certificate is valid for three years. It is maintained through annual surveillance audits and a recertification audit every three years.
What to prepare for a quote
- The legal entity or entities in scope, and your sites, or confirmation that you are cloud hosted.
- The number of people doing work within the scope.
- A draft scope statement.
- The window in which you want Stage 1 to take place.
- Any other certificates you would like audited at the same time, such as ISO 9001.
- Whether you also want ISO/IEC 42001. If so, check the body is listed under Artificial Intelligence Management Systems (AIMS).
Goldline is not a certification body and does not issue certificates. Certification is by an accredited certification body you appoint and pay directly.
What to compare
Once you have a UKAS-accredited shortlist, the differentiators are audit approach, sector depth, pricing, and commercial terms. Five comparison factors are worth working through.
Audit fees. Get quotes from two or three bodies. Certification body audit fees are quoted per engagement rather than published, so the only reliable number is the one on a written quote. Compare what is included. Ask what each quote includes.
Sector expertise. Does the body have auditors with experience in your sector? A defence supply chain SME and a fintech have different control environments. An auditor familiar with the sector will produce a more useful audit and waste less time on contextual onboarding.
Auditor continuity. Will you get the same lead auditor across Stage 1, Stage 2, and surveillance? Continuity reduces friction in subsequent audits. Some bodies rotate auditors more aggressively than others.
Audit flexibility. How does the body handle minor nonconformity closure? What is their process for disputes? What happens if your business changes scope mid-cycle? Ask before committing.
Surveillance approach. The certificate is valid for three years and is maintained through annual surveillance audits and a recertification audit, so ask for a quote covering the full cycle. The full three-year cost matters more than the initial fee.
A practical approach: shortlist three UKAS-accredited bodies that fit your sector and scale, request fee quotes covering the three-year cycle from each, and have a 30-minute conversation with each before deciding. The conversation itself is informative. A body that is responsive, clear, and substantive in pre-engagement is usually responsive, clear, and substantive in audit.
Verifying accreditation
Two checks before signing.
Visit ukas.com and use the organisation search. Confirm the body holds UKAS accreditation specifically for ISO/IEC 27001 management system certification. Some bodies hold UKAS accreditation for quality management (ISO 9001) but not for information security management. The scope of accreditation matters.
Check the certification body's own register of issued certificates. Most accredited bodies maintain a publicly searchable register. Searching by company name confirms a specific certificate is live and not suspended or withdrawn.
A common procurement mistake is accepting a certificate without verifying current status. Certificates that were valid when last provided may have lapsed or been suspended. Always verify through the UKAS register or the certification body's own register rather than relying on a copy of a certificate provided by a supplier.
Closing thought
The certification body is not the most important decision you will make in your ISO 27001 work. The implementation work matters more. But it is a decision that affects cost, timeline, and certificate acceptance.
Take the decision seriously. Shortlist UKAS-accredited bodies. Verify accreditation against UKAS. Get quotes covering the three-year cycle. Have a substantive conversation with each before deciding.
Goldline Consultancy is led by an ISO 27001 Senior Lead Implementer and Lead Auditor (PECB) and ISO 42001 Lead Implementer and Lead Auditor (PECB). Goldline is not a certification body and does not issue certificates. We can help you prepare the scope information a certification body needs to quote. Take our free ISMS maturity self-assessment or book a free 45 minute diagnostic.
Related reading: Can an ISO 27001 consultant certify you?
Questions
How do I check a certification body's UKAS accreditation?
Search the body's name in the UKAS directory at ukas.com, open its schedule, and confirm it is listed under Information Security Management Systems Certification (ISMS). For ISO 42001, check it is listed under Artificial Intelligence Management Systems (AIMS). Accreditation is granted by category, so accreditation for one standard does not cover another.
How do I check a company's ISO 27001 certification?
Search the company in IAF CertSearch, the global database of accredited management system certificates. It shows the certificate's status and scope, the certification body that issued it and the accreditation body behind that body. You can also search the issuing certification body's own register. Do not rely on a copy of a certificate alone.
Does ISO 27001 require audits?
Yes. The standard requires internal audits (clause 9.2), carried out by your organisation or by someone it appoints. Certification adds external audits by the certification body: a two-stage initial audit, annual surveillance audits and a recertification audit every three years.
How much does certification cost?
The certification body sets its own audit fee and quotes it per engagement, so ask each shortlisted body for a written quote covering the three-year cycle. You pay that fee to the certification body directly. Goldline's consultancy prices are published on the pricing page.
Ready for audit, or not sure? See the Pre-Certification Readiness Audit or book a free 45 minute diagnostic.