How to Verify a Certification Body's Accreditation

Before you sign with a CB, verify accreditation explicitly:

1. Ask the CB which accreditation body accredits it for ISO 27001
2. Look up the CB on the accreditation body's public register (UKAS, ANAB, Swedac, etc. all publish lists)
3. Confirm the accreditation covers ISO/IEC 27001 specifically — not just ISO 9001 or another standard
4. Confirm the accreditation body is a signatory to the IAF MLA for management systems

This verification takes 15 minutes and prevents the worst-case outcome — a certificate that procurement rejects.

The Pitfalls We See Most Often

Across customer engagements and audit observations, four pitfalls account for most certification credibility issues.

Pitfall 1: Choosing an Unaccredited or Non-IAF-MLA Certification Body

Some CBs issue ISO 27001 "certificates" without accreditation under any IAF-MLA body. The certificates carry the ISO 27001 wording but lack the accreditation chain. Procurement teams familiar with the standard reject them. New SMEs sometimes fall for these because pricing is 50-70% lower than accredited CBs. The savings disappear when the certificate fails its first procurement check.

Pitfall 2: Underbid Audits

ISO/IEC 27006 prescribes minimum audit days based on organisation size, scope complexity, and effective number of personnel. A quote that significantly undercuts other accredited CBs for the same scope is suspicious — either the CB is calculating audit days incorrectly or skipping required audit work. Both are accreditation findings against the CB and may eventually invalidate certificates issued.

Pitfall 3: Single-Auditor Risk

Smaller CBs may have only one or two auditors qualified for ISO 27001 in your region. If that auditor leaves the firm or is unavailable, surveillance audits get rescheduled or rerouted to new auditors who must learn your environment from scratch. Larger CBs and well-staffed regional ones avoid this concentration risk.

Pitfall 4: Auditor Competence Mismatch

An ISO 27001 auditor with strong manufacturing experience may struggle with cloud-native SaaS environments. The standard is industry-agnostic but auditors are not. Ask the CB about the proposed auditor's industry and technology experience. A mismatched auditor produces longer audits with more findings — sometimes findings that reflect auditor unfamiliarity rather than real ISMS weaknesses.

Negotiation Patterns That Actually Work

CB selection and negotiation is more leveraged than most companies realise. The patterns that consistently produce better outcomes:

• Get three quotes minimum, all from accredited CBs in the same accreditation tier. Quote spread of 30-40% for the same scope is normal
• Confirm audit-day calculations — ask the CB to share the ISO 27006 calculation. Catch errors before the contract
• Negotiate the multi-year package — initial audit + 2 surveillance + recertification. Year-by-year is more expensive
• Confirm auditor assignment in writing — get the named lead auditor's CV before signing
• Confirm CB capacity — multi-year continuity matters, especially for smaller CBs

Switching Certification Bodies

You can switch CBs mid-cycle. The new CB performs a "transfer audit" reviewing the prior CB's findings, the current SoA, and recent management reviews; if everything is in order, the new CB issues a fresh certificate covering the remainder of the original 3-year cycle. The transfer audit costs roughly 30-50% of a new Stage 2.

Common reasons to switch: pricing, auditor availability, accreditation issues at the original CB, customer-driven requirement for a specific accreditation chain. Switching is operationally manageable and worth doing when the original CB relationship has gone sideways.

Mutual Recognition: When One Certificate Is Enough

The IAF MLA means that an ISO 27001 certificate from any IAF-MLA-accredited CB should be accepted globally. In practice, some specific procurement requirements are stricter (e.g., German federal requires DAkkS-accredited certs in some sectors). For most enterprise procurement, IAF-MLA recognition is sufficient.

How Opsio Helps

Opsio runs the CB selection process as part of our ISO certification gap analysis service. We get multiple quotes, review accreditation, vet auditor profiles for technology fit, and structure the multi-year contract. We also run transfer audits when customers inherit a CB relationship that is not working. The CB choice meaningfully affects audit quality and ongoing cost; we treat it as a strategic procurement decision rather than an administrative one. We tie this into broader request a security & compliance review programmes for organisations holding multiple certifications.