How to Choose an ISO 27001 Certification Body: Accreditation, Audit Days and Questions to Ask

Choose a certification body that is accredited for ISO/IEC 27001 by a national accreditation body that signs the IAF multilateral recognition arrangement, such as Swedac, UKAS, DAkkS or ANAB, because that is what makes the certificate recognised by customers abroad. Beyond accreditation, the differences are auditor experience in your sector, how the body schedules and staffs the audits, whether it audits remotely, how it handles nonconformities, and how it calculates audit days under IAF MD 5. A firm that helped build your ISMS cannot certify it. Get the accreditation scope in writing before comparing anything else.

The certification body is the organisation that will audit your ISMS at Stage 1 and Stage 2, return every year for surveillance, and put its name on the certificate your customers read. Choosing one is a three-year decision made, usually, on a two-page quote. This article covers what to check and what to ask.

1. Accreditation first

Accreditation is the assessment of a certification body by a national accreditation body against ISO/IEC 17021-1 and the ISMS-specific requirements of ISO/IEC 27006-1. Bodies accredited by a member of the IAF multilateral recognition arrangement, among them Swedac in Sweden, UKAS in the United Kingdom, DAkkS in Germany and ANAB in the United States, issue certificates that are recognised as equivalent across the arrangement. Check two things on the accreditation body's own register: that the body is accredited, and that ISO/IEC 27001 is in its accreditation scope. Unaccredited certificates exist, are cheaper, and are discounted or rejected in most security reviews. IAF CertSearch lists accredited certificates, but listing is voluntary, so an absence there is not proof of a problem.

2. Independence

ISO/IEC 17021-1 forbids a certification body from certifying a management system it helped design or implement, and from using auditors who consulted for you, for a period after the engagement. A consultancy that built your ISMS and offers certification through a related company is a conflict the accreditation body will act on, and so is a body that offers to "help you close" findings its auditors raised. Keep implementation help and certification with separate organisations.

3. How audit days are calculated

Certification bodies determine audit time from IAF MD 5, which starts from the effective number of personnel in scope and adjusts for complexity, the number of sites, the amount of outsourced activity and the maturity of the system. Surveillance audits take roughly a third of the initial audit time each year and recertification roughly two thirds. Ask each body for its calculation, not just the total, so you can see whether it counted your contractors, your sites and your development work the same way. A quote with noticeably fewer days than the others is either a misunderstanding of your scope or a sign the body will not look very hard.

4. Sector experience and auditor continuity

An auditor who knows software companies, cloud hosting and the shared-responsibility model asks sharper questions and accepts inherited controls where they are justified; one who does not spends Stage 2 learning how your deployment pipeline works. Ask who the lead auditor would be, what they have audited, whether the same auditor will come back for surveillance, and what happens when they leave. For companies in Sweden or the Nordics, ask whether the audit and the report are in your language or in English, and which your customers expect.

5. How the audit runs

• Lead time: audit dates are commonly booked two to three months ahead. Ask when Stage 1 and Stage 2 could happen and how far apart.
• Remote or on site: Stage 1 is often remote; ask what the body requires for Stage 2 and surveillance, and how it samples sites under IAF MD 1 if you have several.
• Nonconformities: how findings are graded, how long you get to respond, and whether verification of majors needs a visit.
• The certificate: what the scope statement will say, whether it references the Statement of Applicability version, and in which languages it is issued.
• Combined audits: whether the body can audit ISO 27701 or ISO 42001 together with ISO 27001 if you add them later.

If your buyers or regulators are in Europe

For ordinary customer requirements, any IAF-recognised accreditation serves. Where a regulator or a public buyer requires accreditation under EU rules, or names a national accreditation body, confirm that the certification body's accreditation qualifies before you sign, because that cannot be fixed after the certificate is issued. European buyers also tend to read the scope statement closely, so the body's willingness to word it precisely matters. The scope article covers what to put in it.

Comparing quotes

Switching certification bodies

An accredited certificate can be transferred to another accredited body during the cycle under IAF MD 2, after a pre-transfer review of your last audit reports, open findings and the validity of the certificate. Transfers are refused where a certificate is suspended or majors are open. Knowing this makes the first choice less frightening, and it is worth asking a prospective body how it handles both directions.

Before the first conversation, know what you are asking them to audit: the timeline article shows where the certification body fits, and the Stage 1 versus Stage 2 article what each visit tests.