Choosing an ISO Implementation Consultant: Scope, Competence and Handover

Separate implementation from certification

A management system connects an organisation’s responsibilities and processes so it can achieve objectives, review performance and improve. It includes how people work, the decisions they make and supporting records; it is more than documentation.

An implementation consultant helps the organisation interpret requirements, improve processes and prepare evidence. A certification body independently assesses conformity and makes its certification decision. ISO develops standards; it does not issue certificates to organisations. Accreditation is formal independent recognition of a certification body’s competence against relevant requirements.

Ask the consultant to explain these roles clearly. A promise of guaranteed certification or special influence over an auditor is a warning sign. Confirm the certification body’s status and relevant scope independently if accredited certification is required by a customer or contract. Consultancy fees and certification fees should be distinguishable.

Describe the actual operating scope

List the sites, activities, products or services, workforce arrangements and outsourced processes to be considered. Name the management-system standard and confirm the applicable edition and any transition arrangements before contracting. Do not assume that an old website article names the current edition.

Ask how the proposed scope reflects the organisation’s real operations. A narrow scope chosen only to simplify assessment may fail to meet a customer’s need. Conversely, including activities without an accountable owner creates implementation gaps. Distinguish the activities included in scope from a requirement judged inapplicable within that scope. Check any justification for non-applicability against the relevant standard rather than treating it as a marketing choice.

Ask for evidence of relevant competence

Start with the person who will lead the assignment. Ask about comparable processes and how they will learn your actual workflow. Request an explanation of how they observe work, talk to employees and compare practice with requirements. Then clarify internal managers’ tasks, how documents will be tested with users and support included after the first implementation review.

Request an anonymised example of a practical process change and its supporting records. Generic certificate images do not show how the proposed practitioner works. Training credentials can support a competence assessment, but should be considered alongside relevant experience and a credible method.

Buy a working system, not a document bundle

Useful deliverables connect responsibilities, operating methods and records. They may include a gap assessment: comparing current practice with requirements to identify what is missing. This informs implementation priorities, process controls, training and support for internal audit and management review, as agreed in scope. Their exact form depends on the chosen standard and the organisation. More procedures do not automatically mean better control.

Require editable files, a named person to approve versions and acceptance criteria that explain how completion will be checked. Sample a real transaction through the proposed process. Can the employee identify the current instruction, perform the task and retain the necessary evidence? If the system exists only in the consultant’s folders, the handover is incomplete.

Compare proposals on the same basis

Build a scope comparison covering sites, staff participation, languages, training, travel, internal assessment support and follow-up. Separate mandatory work from optional services. Clarify what happens when data or access is delayed and how additional work is approved.

In a hypothetical example for illustration, a service company receives one proposal for 20 templates and another for interviews, process testing and team coaching. The template count is not a useful common denominator. The company should compare whether each offer addresses its identified gaps and leaves managers able to operate the system. Neither offer can determine an independent certification outcome.

Protect internal audit objectivity

An internal audit systematically examines evidence to check whether specified requirements are met. Management review is leadership’s evaluation of the system’s suitability, effectiveness and need for change. A consultant can support preparation for both, but management remains responsible for its decisions.

Check how objectivity will be maintained when implementation support and internal audit support come from the same provider. Agree responsibilities and safeguards appropriate to the relevant standard and engagement. One practical arrangement is to use a competent auditor who did not design the work being examined, and disclose conflicts of interest. Naming another person is insufficient if they accept the implementer’s opinion without independently examining evidence. Managers remain responsible for reviewing performance and addressing findings; outsourcing support does not transfer organisational accountability.

Treat findings as evidence for improvement. Record the issue, evidence and relevant requirement. A correction addresses the detected problem, such as fixing an incorrect record. Corrective action addresses its cause to prevent recurrence. Assign an owner and date, then use operating evidence to verify implementation and effectiveness. Replacing a document without confirming changed practice may leave the original problem unresolved.

Agree acceptance evidence for each deliverable

Turn the deliverable list into questions that can be checked. For the gap assessment, does each finding connect to a process, evidence and a relevant requirement? For the implementation plan, confirm owners, dates and approved resources. For training, ask employees to demonstrate the task rather than relying only on attendance records.

In a hypothetical example for illustration, the consultant prepares a customer-complaint procedure. The team runs a sample complaint from receipt to closure. It checks who records the case, who determines the action, how the deadline is monitored and where outcome evidence is kept. If the team cannot complete the workflow, record the gap, revise the procedure and test it again. Approving a file cannot compensate for a process that does not operate.

State the sample’s limits and what remains untested. One successful transaction does not establish effectiveness across every site and condition. This is a suggested method for accepting consultancy work, not a substitute for the standard’s requirements or the certification body’s assessment. The depth of testing should reflect the process’s importance and associated risks.

Organise internal participation and changes

Agree process owners’ time, required information and decision dates at the outset. Even a capable consultant may be unable to progress without the decision-maker or necessary records. Keep regular meetings focused on decisions, obstacles and new evidence, and update ownership of open work.

• The consultant records the gap, treatment option and expected effect.
• The process owner checks whether the solution fits daily work and available resources.
• The authorised person approves changes to scope, timing or cost.
• The team checks implementation and retains test and follow-up results.

When a site or activity is added, review the impact on the plan rather than accepting an implicit scope change. If the standard’s edition changes during the assignment, check the relevant official arrangements and document the decision. Keep a brief decision record showing what changed, why and who approved it. A replacement owner should be able to maintain the system without reconstructing every email exchange.

Test the handover before closing

Ask process owners to update a controlled document, retrieve a record and explain how they escalate a problem. Agree how any handover-test gaps will be resolved and when they will be rechecked. Confirm future review dates and who maintains the system. Keep access to source files and the decisions behind major controls.

The next step is a scoped discussion based on actual operations and the intended certification need. ATMACSS ISO implementation and certification support can assist implementation; certification remains the responsibility of the independent certification body.