In short
Whoever prepares you for ISO certification can never issue the certificate: only an accredited, independent certification body can.
A traditional consultant brings expertise, but the system risks living in their files and becoming "filed and forgotten" documentation.
Software alone gives structure but does not interpret the standard: it only works if the expertise already exists in-house.
The hybrid model combines an expert who guides the decisions with a shared platform that organises evidence, documents and deadlines.
Assess the whole three-year cycle of surveillance audits and renewals, plus ownership of your data, not just the first audit.
Choosing how to get certified matters almost as much as choosing which standard to adopt. Many SMEs start an ISO certification journey because a client, a funding call or a tender requires it, and they immediately face a fork in the road: rely on a consultant, buy compliance software and do it yourself, or combine the two. Every route leads to the certificate, but with very different effects on internal time, control over your documents and the effort required in the years that follow.
In this guide we take an honest look at the three models: the traditional consultant, software only (do-it-yourself) and the hybrid model, where an expert works alongside a platform. For each one we look at how it works, who it suits, where it delivers and where it stalls. First, though, a clarification that many people skip: whoever guides you towards certification is never the one who issues it. At the end you will find a comparison table, the questions to ask yourself before signing and the factors that affect the investment.
Who prepares you and who certifies you: what is the difference?
Whoever prepares you for ISO certification cannot issue your certificate. This is the rule the whole system rests on, and it applies whichever model you choose.
On one side are the parties that help you build the management system: consultants, service firms, platforms, internal experts. On the other is the certification body, an independent third party that carries out the audit, assesses conformity with the standard and issues the certificate. For the certificate to carry recognised value, the body must be accredited for that standard and for the company's sector. In Italy, accreditation is granted by the single national accreditation body designated under Regulation (EC) No 765/2008, which in turn is a signatory to the international mutual recognition agreements. If you want to brush up on the basics (what a standard is, what the certificate covers, how Stage 1 and Stage 2 work), you will find them in our guide to what ISO certifications are and how they work.
Why consultants cannot certify
The principle is called independence, and it is set out in black and white in ISO/IEC 17021-1, the standard that lays down the requirements for bodies certifying management systems. A certification body cannot offer management system consultancy to its own clients. Nor can it carry out internal audits for the clients it certifies. And if the company has received consultancy from a party linked to the certification body, the standard treats this as a significant threat to impartiality: the recognised safeguard is that the body does not certify that system for at least two years after the consultancy ends. The same two-year limit applies to auditors who have provided consultancy to that company: they cannot take part in its audit.
The logic is simple: a certification body must be impartial and cannot certify work it designed itself. If the people writing the procedures were also the people issuing the certificate, the certificate would lose its meaning in the eyes of clients, public contracting authorities and partners. That is why, when a provider offers to "do everything, certificate included", the right question is: who is the body, is it accredited, and is it genuinely independent of whoever is preparing me?
What this means for you in practice
For a business the consequence is concrete: no preparation model can promise you the certificate. It can prepare you well, reduce non-conformities and get you to the audit with well-organised evidence, but the final decision rests with the certification body's auditor.
This also gives you a yardstick for reading offers. Be wary of anyone talking about "guaranteed" or "assured" certification: it is a promise that no party independent of the body can keep. Look instead at what the provider actually does: initial analysis, documentation, training, internal audit, support during the body's visit, handling of non-conformities. The rest of the comparison is only about how you prepare and how you maintain the system, not about who certifies you.
How does the traditional consultant model work?
In the traditional model an external consultant builds the management system for ISO certification, either for you or with you. Historically it has been the most common route among Italian SMEs.
The typical route to ISO certification starts with a gap analysis, a snapshot of the distance between how you work today and what the standard requires. Next come drafting the manual, procedures, forms and records, staff training, the internal audit and the management review. The consultant usually also supports the company during the certification body's visit and helps deal with any non-conformities. The work happens through on-site or remote meetings, documents exchanged by email and shared files.
Who it suits and what its strengths are
The traditional consultant works well when a company has little time, no experience of management systems and prefers to delegate. The main advantage is expertise in the standard: an experienced professional knows how to interpret the requirements, understands what auditors expect and can tell what is mandatory from what is merely recommended.
Then there is the value of the relationship. A good consultant knows your sector, speaks the language of the shop floor or the IT department, and can become a steady point of reference for quality. For companies facing their first certification, having someone who says "this is needed, this isn't" reduces uncertainty. Finally, the model is easy to understand: one person, one engagement, one expected result.
Limits and risks: dependence and "filed and forgotten" documentation
The first risk is dependence on the consultant. If the system lives in the head and the files of an external person, every change, every surveillance audit and every new record goes through them. When the relationship ends, the company discovers it does not know where the evidence is or why a procedure was written a certain way.
The second risk is "filed and forgotten" documentation: well-written procedures that describe a theoretical company. This happens when documents are adapted from generic templates rather than built around real processes. The system passes the initial audit, then sits idle until the next surveillance audit, when there is a rush to produce overdue records. Experienced auditors notice, because they ask people how they work and compare the answers with the paperwork.
The third limit concerns tools. Traditional work often relies on email, spreadsheets and shared folders. That works while there are only a few documents; with more standards, more sites or more owners, control of versions and deadlines becomes fragile. It is not the consultant's fault: it is a limit of the method, which depends on people's discipline more than on a system.
Is compliance software enough for ISO certification?
For ISO certification, compliance software on its own is only enough if the expertise in the standard already exists in-house. In every other case it risks becoming a tidy archive of the wrong documents.
The do-it-yourself model involves buying a platform that offers document templates, requirement checklists, document management, a deadline tracker and, in some cases, risk analysis features. The work of interpreting the standard, adapting it to your processes and preparing for the audit stays entirely with internal staff, typically the quality manager or the IT manager.
What software does well
A platform's strength is structure. It makes you keep documents in one place, with tracked versions, assigned owners and visible deadlines. Compared with folders and spreadsheets, it cuts out the trivial mistakes: the unapproved document, the missing record, the expired calibration nobody remembered.
Software also makes the work more transparent. Management can see where the project stands without asking for updates, and whoever takes over a role finds a readable history. For companies with an experienced quality manager, perhaps one who has already been through other certifications, do-it-yourself can be efficient: the expertise is there, it just needs a good tool to organise it.
Where it stops: expertise cannot be downloaded
The limit is structural: software does not interpret the standard for you. A checklist tells you that you need an analysis of context or a risk assessment, but it does not tell you whether yours is adequate, proportionate and consistent with what the auditor expects in your sector.
This is where the most expensive mistakes are made. Templates filled in mechanically produce documents that are formally complete but disconnected from reality, in other words "filed and forgotten" documentation again, just in digital form. The scope of certification is poorly defined, applicable requirements are excluded without justification, and the internal audit becomes a box-ticking exercise. And when the certification body's visit comes, there is nobody at your side who knows the auditor's language and expectations.
There is also the question of workload. Do-it-yourself shifts all the work onto one or two internal people, who often already have another job. The risk is that the project drags on, loses priority or gets crammed into the weeks before the audit.
What is the hybrid expert + platform model?
The hybrid model for ISO certification combines an expert who guides the decisions with a platform that organises the work. The aim is to take the consultant's expertise and the software's structure, removing the weak point of each.
In practice, a professional with audit experience supports the company from the initial analysis to the certification body's audit and beyond. Procedures, evidence, risks and deadlines, however, do not live in emails and attachments but on a shared platform where the company and the expert work on the same data. The expert interprets the standard and validates the content; the platform keeps track of who has to do what and by when, and keeps the history.
How it works day to day
The value of the hybrid model shows in the recurring activities that follow ISO certification, which make up most of a management system's life. A training record, a maintenance report, a supplier evaluation, a procedure review: in the hybrid model each one has an owner, a deadline and a precise place to go. The expert does not have to chase files, and the company does not have to wonder whether it uploaded the right version.
The critical decisions remain human. Defining the scope of certification, assessing whether a requirement applies, deciding how to treat a risk, preparing people for the auditor's questions: these are activities that call for experience, not a form. In a good hybrid model the platform does not replace the expert, it works alongside them.
This is exactly how Complaion works. Every company has a dedicated Lead Auditor who supports it along the way: validating content, writing procedures, guiding the critical decisions, preparing for the audit and handling the dialogue with the certification body. The Complaion platform collects evidence with version control, manages documents and their approval, keeps the deadline tracker, schedules internal audits and organises risks, training, maintenance and suppliers. You can meet the people who do this work on the Lead Auditor team page.
Limits and conditions for it to work
The hybrid model also has conditions to meet, and it is only fair to say so. The first is internal involvement: the platform makes visible what is missing, but someone in the company has to upload the evidence and make the decisions. If the expectation is to delegate everything without lifting a finger, no model will build a living system.
The second is a change of habits. People used to working by email need to learn a new tool, and the first few days require some adjustment. The third is the quality of the expert: the hybrid model is only as good as the person leading the project. A well-built platform with an expert who is rarely around turns back into do-it-yourself software. That is why it pays to ask who your point of contact will be, what audit experience they have and how available they will be.
What happens after the certificate: maintenance, surveillance audits and renewals
An ISO certificate is not a finish line, it is the start of a three-year cycle. This is where the differences between the models become most evident.
Under ISO/IEC 17021-1, the certification cycle lasts three years from the certification decision. The certification body carries out surveillance audits at least once per calendar year (the first within 12 months of the decision) and, in the third year, a recertification audit before the certificate expires. At each of these visits the auditor does not just check that the documents exist, but that the system has actually been used: internal audits carried out, management review done, non-conformities closed, objectives monitored, training recorded.
The second- and third-year problem
Many management systems perform well in the first year and weaken in the second. Initial enthusiasm fades, the internal contact changes role, and the consultant is called back only a month before the surveillance audit. The result is a scramble to reconstruct records, which the auditor spots easily because the dates all cluster in the same few weeks.
Each model tackles this risk differently. With the traditional consultant, maintenance depends on how often the contract provides for meetings. With software alone, the deadline tracker sends reminders for activities, but nobody checks they are done properly. In the hybrid model the deadline tracker and the expert work together: the platform flags what is about to fall due, and the expert steps in where expertise is needed, for example in the internal audit or in updating the risk analysis.
Then there is the matter of new editions of standards. When a standard is revised, certified companies have a transition period to adapt. It is a moment that calls for someone who knows the changes and can translate them into the existing system without rewriting it from scratch.
Several standards, one system
Things get more complicated when there are two or more standards. An SME that starts with ISO 9001 often goes on to add ISO 14001 for the environment, ISO 45001 for health and safety or ISO 27001 for information security, perhaps prompted by a client or by obligations such as NIS2. ISO management system standards share a common structure, so many parts can be integrated: policy, context, risks, internal audits, review.
A multi-standard approach rewards models in which documents and evidence live in a single system. Managing three certifications with three different consultants, three folders and three deadline trackers multiplies the work and the opportunities for error. The same goes for software that covers one standard well but not the others. Before choosing, ask yourself which standards or regulations you may need to tackle in the next few years. Complaion covers many standards and regulations in the same environment: you will find them on the page dedicated to the certifications and regulations we manage.
Consultant, software or hybrid: comparison table of ISO certification routes
No model is better in absolute terms: each one fits a different mix of in-house expertise, time and ambitions. The table summarises the main differences on the criteria that matter most to an SME.
Criterion | Traditional consultant | Software only (do-it-yourself) | Hybrid model (expert + platform) |
|---|---|---|---|
Expertise in the standard | High, held by the consultant | Held by the company | High, held by the dedicated expert |
Internal workload | Low for drafting, variable for maintenance | High: interpretation and drafting in-house | Medium: the company provides evidence and decisions |
Where documents and evidence live | Often email, files and folders | Platform | Platform shared with the expert |
Version and deadline control | Depends on people's discipline | Structured | Structured and supervised |
Risk of external dependence | High if the system lives in the consultant's files | Low | Low: data and history remain accessible to the company |
Risk of "filed and forgotten" documentation | Present if generic templates are used | High without in-house expertise | Reduced, if the expert validates against real processes |
Support during the certification body's audit | Yes, as a rule | No, unless as an add-on service | Yes |
Maintenance over the years | Tied to how often meetings take place | Deadline tracker, no quality check | Deadline tracker plus the expert's check |
Multi-standard management | Possible, often with separate documents | Depends on the standards the software covers | Integrated in a single environment |
Best suited to | Those who want to delegate and are short of time | Those who already have an experienced quality manager | Those who want external expertise and internal control |
Read the table starting from your own situation, not from the column with the most advantages. If you have a quality manager with years of experience across several standards, software may be enough. If you are looking for a reference figure and are happy working with traditional tools, a good consultant remains a solid choice. If you want expert guidance but also want to keep the system in your own hands, the hybrid model is the one that best balances the two needs.
How to choose your ISO certification route: the questions to ask
The right choice comes from an honest analysis of your resources, not from comparing price lists. Before asking for quotes, it is worth answering a few key questions internally.
Who in the company will be responsible for the system, and how much time will they be able to give it each month?
Does this person already know the standard, or will they have to learn it along the way?
Is the certification needed for a specific deadline, such as a tender or a client request?
How many standards or regulations might we have to manage in the next three years?
Do we want to delegate as much as possible, or do we want the system to become an internal management tool?
If we changed provider tomorrow, would we have full access to documents, evidence and history?
Reading the answers: three typical profiles
If you answered that nobody in the company knows the standard and there is little time available, do-it-yourself is the riskiest route: you need external expertise, through a consultant or a hybrid model. If instead you have an experienced but overstretched manager, the value lies mainly in the tool that organises the work, with targeted expert support at critical moments.
If there is more than one standard on the horizon, or if the client asking you for certification will soon ask for something else too, the ability to integrate matters a great deal. A system built for a single standard, in separate files, costs you when the second one arrives. Finally, the sixth question is often underestimated: ownership of and access to your data is what protects you from depending on a single provider, whichever model you choose.
The questions to ask a potential provider
The same questions apply when assessing whoever is offering you the service. Ask who exactly your point of contact will be and what audit experience they have with the standards you are interested in. Ask how maintenance will work after the first certificate: which activities are included, how often, and who carries out the internal audit. Ask where documents and evidence will be stored and how you will be able to access them in future.
Ask too how the provider handles the relationship with the certification body, bearing in mind that it must be an accredited body independent of whoever is preparing you. Finally, ask to see real examples: companies similar to yours in size or sector that have followed the same route. Real stories say more than any brochure, like those collected in our case studies of certified companies.
Which factors affect the investment?
The cost of an ISO certification journey depends on company-specific variables, not just on the model chosen. That is why a serious comparison is made on quotes built around your situation, not on average figures.
Costs fall into two families. The first is preparation: initial analysis, building the system, training, internal audit, support during the audit, maintenance. This is the part that varies with the model: a consultant prices it by the day or by project, software by licence, and a hybrid model generally combines service and platform. The second family is certification proper, that is the certification body's audit, surveillance audits and renewal. This item is kept separate from preparation in all three models, precisely because of the principle of independence.
The variables that weigh most
The main variables are the same for everyone. What counts is the number of employees and sites, which also affects the length of the certification body's audits, the complexity of your processes and your sector, the number of standards to manage and your starting point: a company with procedures already in place starts at an advantage over one that has to build everything.
Finally, there is a cost that never appears in quotes: internal time. A cheap offer that shifts all the work onto your people may, in practice, cost more than one that reduces it. Likewise, a route that gets you the certificate but leaves you with a system that is hard to maintain shifts the cost onto the following years. When you compare proposals, look at the whole three-year cycle, not just the first audit.
What are the most common mistakes when choosing an ISO certification route?
The most frequent mistake is choosing with only the first certificate in mind. The first audit is the most visible moment, but the system has to work for all the years that follow.
A second mistake is underestimating the expertise required. Many companies buy software thinking that pre-filled templates will be enough, and discover during the audit that the documents do not describe their organisation. The problem is not the tool, but the absence of someone who knows how to adapt it.
A third mistake is delegating everything and not involving management. The standard explicitly requires leadership commitment, and auditors check it by talking to the people who run the company. A system built entirely from the outside, without the owner knowing its objectives and risks, does not hold up well.
A fourth mistake is failing to clarify who owns the documents and evidence. If the system is spread across a consultant's inboxes and a few local folders, every change of provider becomes a reconstruction job. Finally, there is the mistake of confusing roles: relying on someone who promises to "certify" you without checking that the body is accredited and independent exposes you to the risk of a certificate that clients and contracting authorities do not recognise.
How Complaion combines Lead Auditors and a platform
If you are looking for expert support for ISO certification without losing control of your system, the hybrid model is what Complaion applies every day, with more than 1,000 clients. A dedicated Lead Auditor supports you from the initial analysis to the certification body's audit: writing and validating procedures, guiding the critical decisions and preparing you for the auditor's questions. They also carry out the internal audit, so you reach the certification body's audit with a system already checked by someone who knows what the auditor expects: what matters is that auditors do not check their own operational work, and the Lead Auditor does not work in the processes they audit. The platform collects evidence, manages documents, keeps the deadline tracker and organises internal audits, risks, training and suppliers, so the system stays alive through surveillance audits and renewals too.
We work on achieving and maintaining many standards and regulations: ISO 9001, 14001, 27001, 45001, 37001, 42001, 27701, 22301, 50001, 13485, UNI/PdR 125, SOC 2, as well as NIS2, GDPR, the AI Act and DORA. Certification always remains in the hands of an independent body.
Want to find out which model is right for you? Talk to a Lead Auditor or request a quote built around your company from the pricing page.
Frequently asked questions about choosing an ISO certification route
Can an ISO consultant issue the certificate?
No. An ISO certificate is issued only by a certification body, which must be accredited to issue a recognised certificate. The consultant, or any other party preparing you, helps build the management system and get you ready for the audit. Under the independence principle set by ISO/IEC 17021-1, a certification body cannot provide management system consultancy and, if the consultancy came from a party linked to it, it must not certify that system for at least two years.
Can I get ISO certification with software alone?
It is possible, but only if someone in the company already has solid expertise in the standard. Software organises documents, evidence and deadlines, but it does not interpret the requirements or assess whether your choices are adequate. Without that expertise, the risk is producing documents that are complete in form but disconnected from real processes, which comes to light during the audit.
What does the hybrid model mean in ISO certification?
The hybrid model combines an expert who guides the process with a platform on which the company and the expert work together. The expert interprets the standard, validates the content and prepares you for the audit; the platform collects evidence, manages documents and keeps the deadline tracker. The aim is to combine external expertise with internal control of the system.
How much internal time do I need to set aside?
It depends on the model and on your starting point. With a traditional consultant the internal workload is lower during drafting; with software alone it is the highest, because interpretation and drafting stay in-house. In any case you need an internal contact who provides information and evidence and involves management: no ISO standard can be applied without the organisation.
If I change consultant or provider, do I lose my certification?
No, the certificate is tied to the company and to the body that issued it, not to whoever prepared you. The real risk is losing access to documents, evidence and history if they are stored in the provider's archives. That is why it is important to clarify from the outset where the data lives and how you will be able to retrieve it.
What happens if I do not maintain the system after the first audit?
During surveillance audits the certification body checks that the system has actually been applied. If internal audits, reviews or records are missing, non-conformities may be raised that must be closed within set deadlines. If the system persistently or seriously fails to meet the requirements, or you do not allow surveillance audits at the required frequency, the certificate can be suspended and, if the issue is not resolved, withdrawn.
Is it worth managing several ISO standards with the same provider?
In many cases yes, because ISO management system standards share a common structure and several elements can be integrated. Having a single environment for documents, risks, internal audits and deadlines reduces duplication and errors. What matters, though, is that the provider has real expertise in each standard you are interested in.
How can I tell whether a certification body is reliable?
Check that it is accredited for the standard you are interested in and for your company's sector by consulting the public databases of the accreditation bodies. Also make sure it has no links with whoever provided your consultancy. A certificate issued outside the accreditation system may not be recognised by clients and public contracting authorities.
