Home / Insights / Consultancy, certification and accreditation: who decides what
Quality & IMSGuide
Consultancy, certification and accreditation: who decides what
Three parties make three different decisions, and only one of them issues a certificate. This guide sets out the split, the rule that keeps consultancy and certification apart, and what accreditation does and does not tell you.
Published 4 August 2026Reviewed 4 August 20264 minute read
In brief
Three parties, three decisions. A consultant prepares the system. A certification body decides whether to certify it. An accreditation body decides whether that certification body is competent, and for which standards.
The rule keeping the first two apart is not a convention. It is written into the standard certification bodies are accredited against.
Who does what
The International Organization for Standardization (ISO) writes the standards but certifies nobody. In its own words, ISO "does not perform certification or issue certificates", and certification is carried out by external certification bodies.1
| Consultant | Accredited certification body | |
|---|---|---|
| What they do | Design, implement and improve the management system, and build the evidence it produces. | Audit the system against the standard and decide whether to issue, maintain, suspend or withdraw the certificate. |
| What they decide | Nothing about certification. The output is a working system and its evidence. | The certification outcome, reached independently. |
| Who accredits them | Consultancy is not an accredited activity. There is no accreditation to check. | An accreditation body, for a defined scope.3 |
Why one supplier cannot do both
Clause 5.2.5 of ISO/IEC 17021-1 states that a certification body, and any entity under its organisational control, "shall not offer or provide management system consultancy".2
Where consultancy has come from a body merely related to the certification body, clause 5.2.7 treats that as a significant threat to impartiality, and names a minimum two year gap before certification as a recognised way of managing it.2
A provider who audits their own work has removed the only external check the certificate represents.
What accreditation tells you, and what it does not
It is granted for specified conformity assessment activities, not universally. The Emirates International Accreditation Centre defines scope of accreditation as the "specific conformity assessment activities for which accreditation is sought or has been granted", and can extend, reduce or suspend part of it.4 A body accredited for one standard is not thereby accredited for another. Ask what the accreditation actually covers rather than assuming the certification body's logo tells you.
ISO states that accreditation "is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable".1 It does mean no third party attests to that body's competence, and many tenders require an accredited certificate specifically.
The practical test is whether the certificate will be accepted by whoever asked for it. Where a tender, regulator or customer specifies accreditation, an unaccredited certificate may not satisfy the requirement regardless of the audit's quality.
Comparing certification bodies
Once accreditation and scope are confirmed, quotations from certification bodies still differ in ways that are easy to miss at the point of comparison.
- Audit scope. Which sites, activities and processes the audit covers, in the wording that will appear on the certificate. Two quotations covering different scopes are not comparable on price.
- Audit duration. How many auditor days are proposed for the initial certification audit, and what that assumes about your headcount, sites and processes. A materially shorter proposal usually rests on a different assumption, not a different method.
- Surveillance arrangements. Certification is a cycle, not an event. Confirm the frequency of surveillance audits, what each covers, and when recertification falls due, because the recurring cost typically exceeds the first invoice over the cycle.
- What is excluded. Travel, subsistence, additional site visits, transfers from another body, and the handling of nonconformities and follow-up visits.
What this means for your organisation
Before appointing a certification body, ask which accreditation body accredits them and for which standards, then verify both with that accreditation body directly. Compare quotations over the full certification cycle rather than the first audit alone.
ExSolution is not a certification body. We provide consultancy and audit readiness support. We do not issue ISO certificates and we do not guarantee the outcome of an independent audit.
We do not rank, recommend or endorse certification bodies, and we publish no list of "best" certification companies. Choosing one is your decision, made against verified accreditation and a scope that matches what your customers are asking you to demonstrate.
Sources and references
All accessed 4 August 2026.
- International Organization for Standardization, Certification. Source for ISO not performing certification, and for accreditation not being compulsory.
- ISO/IEC 17021-1, clauses 5.2.5 and 5.2.7. The standard is copyright protected; clause wording quoted here is as reproduced by European Accreditation.
- Emirates International Accreditation Centre, Certification Bodies, and the Emirates National Accreditation System, Ministry of Industry and Advanced Technology.
- Emirates International Accreditation Centre, General Accreditation Requirements: definitions of scope of accreditation and granting of accreditation.
Related reading
If the requirement is clear but the route is not, we can talk it through before anything is scoped.
Discuss a certification requirement