The rules behind the room

Why your certification body stops talking when you ask for advice

Somewhere in your first Stage 1 audit there is a moment that feels like the auditor being difficult.

They describe a finding. You ask the obvious question — what would fix it? — and they decline to answer. They will restate the requirement, and they will restate what they observed, and they will not close the gap between the two.

That is not a personality. It is clause 5.2 of ISO/IEC 17021-1, the standard a certification body is accredited against, and once you know where the line sits you can get considerably more out of the same conversation.

What the rule actually says

The clauses are short and worth reading in the original rather than in summary.

5.2.5: “The certification body and any part of the same legal entity and any entity under the organizational control of the certification body shall not offer or provide management system consultancy.”

Not should avoid. Shall not. The body that audits you is barred from selling you the help to get ready, and so is anything under the same ownership.

5.2.6 does the same for internal audits, and adds a consequence: a certification body that provides internal audits to a client “shall not certify a management system on which it provided internal audits for a minimum of two years”. Clause 9.2 of ISO 27001 requires you to run internal audits, every year, so this is a permanent second supplier rather than a one-off.

5.2.7 is the one that catches people out, because it reaches beyond the certification body itself. Where a client has taken consultancy from a body that has a relationship with a certification body, that certification body “shall not certify the management system for a minimum of two years following the end of the consultancy.”

5.2.9 closes the marketing route. A certification body’s activities “shall not be marketed or offered as linked with the activities of an organisation that provides management system consultancy”, and a certification body must not state or imply “that certification would be simpler, easier, faster or less expensive if a specified consultancy organisation were used.”

Why it exists

An auditor who designed your control cannot impartially assess it. Neither can one whose firm was paid to build your management system, or whose sister company was. The entire value of a certificate is that somebody with nothing at stake looked at your management system and said it met the requirement, and every one of those clauses is protecting that single proposition.

In the UK this sits inside a structure with a statutory anchor. The Accreditation Regulations 2009 appoint UKAS as the national accreditation body, and UKAS assesses certification bodies against ISO/IEC 17021-1 — including clause 5.2. A body that drifted across the line is not committing a faux pas; it is creating a non-conformity in its own accreditation.

What you can still ask for

The rule preserves something explicitly, and it is more useful than most people realise. A note to clause 5.2.5 records that the bar “does not preclude the possibility of exchange of information (e.g. explanation of findings or clarification of requirements) between the certification body and its clients.”

So these are all fair questions:

• Which clause does this finding relate to, exactly?
• What did you observe that led you to that conclusion?
• What would evidence of conformity look like in general terms?
• Is this a major or a minor nonconformity, and what is the closure process?

And this one is not: what should we do? Not because the auditor is withholding, but because answering it would be consultancy.

Experienced auditors are practised at walking this line and will get you very close to the edge of it. If you are getting monosyllables, it is often worth asking a more precisely shaped question rather than concluding that the body is unhelpful.

The question to ask before you engage anyone

Clause 5.2.7 is the one with financial consequences for you rather than for them, so it is worth a direct question to both suppliers before either is engaged: what is the relationship between your firm and the other one?

Most of the time there is none, the answer takes ten seconds, and everybody moves on. Occasionally it surfaces a two-year problem, and it is dramatically cheaper to surface before the engagement than after the audit.

A firm that finds the question awkward has told you something either way.

All notes · Cost calculator · ISO 27001 consultants