How to Choose an ISO 27001 Consultant in the UK

How to choose an ISO 27001 consultant comes down to four checks. Have they led ISO/IEC 27001:2022 implementations for organisations like yours? Is the person who will do the work named and qualified, typically with Lead Implementer or Lead Auditor training? Will they build your information security management system (ISMS) around your real risks rather than a template pack? And are they independent of the certification body that will audit you? Ask for a fixed-price proposal after a gap analysis, and check the certification body’s accreditation yourself.

This guide sets out what a consultant should do, the red flags to watch for, what consultants charge and the questions to ask before you sign. It is written by Sovereign Secure, an ISO 27001-certified UK firm that provides ISO 27001 consultancy, so we have been on both sides of the audit.

Key takeaways

• A consultant builds and prepares your ISMS; only an independent certification body can certify it.
• Consultants aren’t accredited. Certification bodies are, and you can check their accreditation.
• Judge consultants on the named person, relevant experience and a risk-led, proportionate approach.
• Published UK day rates run from £400 to £1,000; audit fees are separate.
• Guaranteed certification, template-only packs and “certificate in two weeks” offers are red flags.

Do you need an ISO 27001 consultant?

Not always. ISO 27001 can be implemented in-house, and some organisations do it well. The question is whether you have the time, the internal expertise and someone who can hold the project together.

If you’re unsure, a gap analysis is a sensible first purchase. It shows how much work there is before you commit to a full project. Our ISO 27001 checklist lets you do a rough version yourself.

What does an ISO 27001 consultant do?

A good consultant helps you build an ISMS you can run without them: the gap analysis, scope, risk assessment, Statement of Applicability, policies, internal audit and preparation for the Stage 1 and Stage 2 audits. What they cannot do is certify you, which is the job of an independent certification body; our ISO 27001 consultancy page sets out each step and who does what.

What is the difference between a consultant and a certification body?

The roles are separate by design, and understanding them is the fastest way to spot a poor offer.

Impartiality rules under ISO/IEC 17021-1 stop a certification body from certifying a management system it helped to build. That separation is what gives your certificate its value. It is also why “consultancy plus certification” offers from a single team deserve a close look.

At Sovereign Secure, we provide the consultancy and our partner certification body, MQA International, carries out the Stage 1 and Stage 2 audits and issues the certificate. MQA International is accredited for ISO/IEC 27001 by IAS, the International Accreditation Service.

How do you verify a certification body’s accreditation?

Consultants are not accredited, so “accredited ISO 27001 consultant” is a sales phrase rather than a credential. Certification bodies are. To check one:

1. Ask the consultant which certification body they propose, and ask the certification body which accreditation body accredits it.
2. Check the accreditation body’s public register to confirm the certification body is listed.
3. Confirm the accreditation covers ISO/IEC 27001 specifically, not just other standards.
4. If a customer or tender names a particular accreditation body, confirm the certification body meets that requirement before you start.

Remember that ISO itself doesn’t certify anyone. ISO’s own certification guidance explains that ISO develops standards but does not issue certificates, and suggests checking whether a certification body is accredited before you choose it.

How to choose an ISO 27001 consultant: what to look for

If you already hold Cyber Essentials, a consultant should show you how that evidence carries across. Our comparison of Cyber Essentials vs ISO 27001 explains the overlap.

What are the red flags?

• Guaranteed certification. Only the certification body decides, after an independent audit.
• One team consulting and certifying. Ask who audits you and how impartiality is maintained.
• A template pack before any questions. If they send documents before they understand your business, the ISMS will describe someone else’s.
• Unrealistic timescales. The ISMS needs to operate long enough to produce records, including an internal audit and a management review, before Stage 2. “Certified in two weeks” means either no real audit or a certificate your customers may not accept.
• Unaccredited certificates. A cheap certificate from a body with no recognised accreditation can fail a customer’s due diligence.
• No named person. You should know who is doing the work.
• Lock-in. Documents you can’t edit, or evidence held only in the consultant’s tool.

How much does an ISO 27001 consultant cost?

Published UK prices we reviewed in September 2026 put consultant day rates at £400 to £1,000 and fixed implementation packages at about £8,000 to £25,000, with certification audit fees on top.

Our guide to how much ISO 27001 consultants charge explains what moves the price and what each pricing model includes.

What questions should you ask before you hire?

1. Who exactly will do the work, and what is their experience with ISO/IEC 27001:2022?
2. How many days of our staff’s time will the project need, and from whom?
3. Which certification body do you propose, and who accredits it?
4. What is included in the price, and what would cost extra?
5. How will you keep documentation proportionate to our size?
6. Will you run or support the ISO 27001 internal audit and management review?
7. How do you hand over, so we can run the ISMS without you?
8. What happens if the Stage 2 audit raises a major non-conformity?

What does a good engagement look like?

For most small and mid-sized organisations this takes three to nine months. Our guide to information security management systems explains how the ISMS keeps running afterwards, and our article on the benefits of ISO 27001 covers the business case.

Why Sovereign Secure?

We are ISO 27001 certified ourselves, so we build ISMSs we would be happy to be audited against. We are also a PCI SSC Qualified Security Assessor (QSA) company and an IASME-licensed Cyber Essentials certification body, which helps when ISO 27001 has to sit alongside PCI DSS or Cyber Essentials. Consultancy and certification stay separate: MQA International audits and certifies.

Next step

Start with an ISO 27001 gap analysis to find out how far you are from certification, or see how our ISO 27001 consultancy takes you from gap analysis to certificate.