ISO consultancy and advisory
Standards turned into working systems
We help organisations prepare for and maintain certification across ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 27701 and ISO 50001, from gap analysis and documentation through implementation, internal audit and certification support. Because these four share the same high-level structure, we can build them into one management system instead of four, which reduces duplicated work. Practical, audit-ready, built to last.
Four management system standards
These four follow the same high-level structure, which is why one well-built system can carry all of them. IEC 62443 is different in kind, and has its own page.
- ISO/IEC 27001Information security management
- What it coversHow you protect the confidentiality, integrity and availability of information, using a risk-based management system and a defined set of controls.
- Usually prompted byCustomer security questionnaires, tenders that ask for certification, or regulated and sensitive data in your care.
- ISO/IEC 27701Privacy information management
- What it coversHow you manage personal data, whether you decide why it is processed (controller) or process it for someone else (processor).
- Usually prompted byProcessing personal data at scale, processor contracts that ask for evidence, or preparing for stricter privacy law.
- ISO 50001Energy management
- What it coversHow you measure energy use, set a baseline, and improve energy performance on evidence rather than assumption.
- Usually prompted byRising energy cost, sustainability reporting, or customer and group requirements for energy performance.
- ISO/IEC 42001Artificial intelligence management
- What it coversHow you govern building, buying and using AI systems: policy, risk and impact assessment, and lifecycle controls.
- Usually prompted byPutting AI into products or decisions that affect people, or customers asking how you govern it.
Built once, shared by all four
ISO/IEC 27001, 27701, 42001 and ISO 50001 use the same clause structure, clauses 4 to 10. The parts below are set up once. What each standard adds sits in clause 8 and in its own requirements.
- Clause 4 Context. Who the system serves, what it covers, and which processes sit inside it.
- Clause 5 Leadership. One policy framework, defined roles, and management that is visibly accountable.
- Clause 6 Planning. One method for risks and opportunities, and objectives you can measure.
- Clause 7 Support. Resources, competence, awareness and document control, set up once.
- Clause 8 Operation. Planned, controlled day-to-day work. This is where the standards differ most.
- Clause 9 Performance evaluation. Monitoring, one internal audit programme and one management review.
- Clause 10 Improvement. One route for nonconformities, corrective action and continual improvement.
How we help
The same eight services apply to each standard. We advise and prepare; an independent accredited body does the certifying.
- Gap analysis
- Know exactly where you stand before you commit.
- Documentation
- Policies and procedures built around how you actually work.
- Implementation support
- Hands-on guidance from roadmap to rollout.
- Risk assessment
- Identify and treat risks before they become findings.
- Internal audit
- Find the gaps before the external auditor does.
- Training
- Your team understands the system and keeps it alive.
- Certification support
- Preparation for the Stage 1 and Stage 2 audits run by your chosen certification body.
- Maintenance
- Support through surveillance audits and continual improvement.
Data governance runs underneath all of it. See how we approach it.
From first look to a standing system
The same six steps apply whichever standards you choose. Certification itself is a separate, independent step, and we do not take part in the decision.
- 1
Scope and gap assessment
We agree what the system covers, then compare what you do today with what the standard requires. You receive a written gap list ranked by effort and risk.
- 2
Design
Policies, processes and roles are shaped around how your organisation already works, not copied from another company's template.
- 3
Implement
Your teams run the new processes while we coach them, review the evidence they produce, and fix whatever does not fit.
- 4
Internal audit and management review
Every one of these standards requires both. We run them with you or train your people to run them, so the first external audit is not your first audit.
- 5
Certification audit
You choose an accredited certification body. We prepare your people and evidence, and stay available while the audit runs.
- 6
Keep it working
Surveillance audits, changes in scope, and the improvements your own audits uncover.
Questions we hear first
Do you issue the certificate?
Do we need all four management system standards?
Can the standards be audited together?
Is IEC 62443 only for factories?
Does this make us compliant with the law?
How long will it take, and what will it cost?
Not sure where to start?
A scoping call is a conversation about your organisation, the standards in play, and what a sensible first step looks like.