ISO 9001, 14001, 45001, 22301 & more
ISO Certification & Consultancy in the UK
ISO certification is independent confirmation, by a certification body, that your management system meets an ISO standard such as ISO 9001, 14001 or 45001. As ISO consultants and an ISO 27001-certified firm, we take you from gap analysis to certificate (typically three to six months for a single standard), with audits by our partner certification body, MQA International.
Prefer to talk? Call +44 161 523 5276
- 12 ISO standards covered
- Integrated management systems
- Certification audits by MQA International
Trusted by banks, payment providers and global brands
On this page
- ISO consultancy services for every major standard
- ISO certification vs ISO accreditation: what is the difference?
- Types of ISO certification
- How much does ISO certification cost?
- Integrated management systems: ISO 9001, 14001 and 45001 together
- ISO certification by sector
- How to get ISO certification in five steps
- Why choose Sovereign Secure for ISO certification?
- Frequently asked questions
- Guides and tools in this section
- Consultancy and certification services
Overview
What is ISO certification?
The short answer
ISO certification is independent confirmation, by a certification body, that your management system meets an ISO standard such as ISO 9001, 14001, 45001 or 27001. ISO writes the standards but does not certify anyone. Certification follows a two-stage audit, lasts three years with surveillance audits in between, and typically takes three to six months for one standard.
ISO certification means an independent certification body has audited your management system and confirmed it meets an ISO standard, such as ISO 9001 for quality or ISO 14001 for environmental management. ISO writes the standards but does not certify organisations; certification bodies do. A certificate normally lasts three years, with surveillance audits in between.
A certificate is always to a named standard, edition and scope, for example a quality management system covering the design and manufacture of a product range at one site. It is voluntary in law, but customers, tenders and supply chains often make it a condition of doing business.
Information security is our core ISO work, and Sovereign Secure is ISO 27001 certified itself. See ISO 27001 consultancy for the full service, or our ISO 27001 certification cost guide for what audits and consultancy typically cost. For quality management, see ISO 9001 consultancy and certification.
What's included
ISO consultancy services for every major standard
Whichever standard you need, the work follows the same path. For information security we also offer an ISO 27001 gap analysis and an ISO 27001 internal audit as standalone services.
- 01
Gap analysis
A clear view of where you stand against each standard, what is missing and what it will take to certify.
- 02
Integrated management
One set of policies, objectives, risk registers, internal audits and management reviews covering several standards at once.
- 03
Documentation
Policies, procedures and records written for how your organisation actually works.
- 04
Training
Awareness and internal auditor training so your team can run the system after we step back.
- 05
Internal audit and management review
Independent internal audits and management review support before the certification audit and every year after it.
- 06
Certification
Stage 1 and Stage 2 audits by an independent certification body, such as our partner MQA International, plus support through annual surveillance and recertification.
ISO certification vs ISO accreditation: what is the difference?
ISO accreditation is formal recognition, by an accreditation body, that a certification body is competent and impartial enough to audit; ISO certification is what your organisation receives from that certification body. So your organisation is certified, and the certification body that audits you is accredited. The two words are often used interchangeably, and many buyers say "ISO accredited" when they mean ISO certified.
| Aspect | ISO certification | ISO accreditation |
|---|---|---|
| Who receives it | Your organisation, for its management system | A certification body (or a testing, inspection or calibration body) |
| Who grants it | An independent certification body, after a Stage 1 and Stage 2 audit | An accreditation body, after assessing the certification body against ISO/IEC 17021-1 |
| What it proves | Your management system meets the requirements of the standard | The certification body is competent and impartial to audit and certify |
We are the consultancy that prepares you; MQA International is the independent certification body that audits you and issues your certificate. MQA International is accredited by IAS, the International Accreditation Service, for standards including ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1. If a customer or tender asks for a specific accreditation, tell us at the outset and we will confirm how your certificate will be issued before you commit.
Types of ISO certification
There is no single "ISO certificate": you are certified to a specific standard. These are the management system standards we support, who usually asks for them and where to read more. ISO 9001 is the most widely used; if you are new to it, start with what ISO 9001 is.
| Standard | What it certifies | Who usually asks for it | Read more |
|---|---|---|---|
| ISO 9001 | Quality management system | Customers, public sector tenders and manufacturing supply chains | ISO 9001 certification |
| ISO 14001 | Environmental management system | Public sector and construction tenders, customers with environmental targets | ISO 14001 certification |
| ISO 45001 | Occupational health and safety management | Construction, manufacturing, facilities and logistics clients | ISO 45001 certification |
| ISO/IEC 27001 | Information security management system (ISMS) | Enterprise and SaaS buyers, banks, the public sector | ISO 27001 consultancy |
| ISO 22301 | Business continuity management | Financial services, critical suppliers and outsourcers | ISO 22301 certification |
| ISO/IEC 20000-1 | IT service management | Clients of managed service and IT outsourcing providers | ISO 20000 certification |
| ISO 13485 | Quality management for medical devices | Medical device manufacturers, their suppliers and regulators | ISO 13485 certification |
| ISO 22000 | Food safety management | Food manufacturers, retailers and caterers | ISO 22000 certification |
| ISO 50001 | Energy management | Energy-intensive organisations; one route to ESOS compliance | ISO 50001 certification |
| ISO 55001 | Asset management | Utilities, infrastructure and transport operators | ISO 55001 certification |
We also support ISO 39001 for road traffic safety and ISO 21001 for educational organisations. For ISO 13485, ISO 22000, ISO 50001, ISO 55001, ISO 39001 and ISO 21001 we confirm the certification body for your scope when we quote.
How much does ISO certification cost?
There is no fixed price for ISO certification. The total has two parts: the certification body's audit fees over the three-year cycle (Stage 1, Stage 2, two surveillance audits and recertification), and any consultancy you choose to buy to get ready. These are the drivers that move both:
| Cost driver | Why it changes the cost |
|---|---|
| Which standards, and how many | Each standard needs its own audit time; an integrated audit of several standards can take less time than separate audits if the certification body agrees |
| People in scope | Certification bodies set audit days largely from the number of people the certificate covers |
| Number of sites | More locations to visit or sample |
| Scope and risk | Complex or higher-risk activities, such as manufacturing processes, hazardous work or software development, need more audit time |
| Your starting point | Existing procedures and records mean fewer consultancy days and fewer audit findings |
| Level of support | A full implementation costs more than a gap analysis or an internal audit on its own |
| Deadline | A compressed timeline concentrates consultant days and needs an early audit booking |
For information security, our ISO 27001 certification cost guide shows the published UK fees we found at each stage. For any other standard, we give you a fixed quote after a short call: use the enquiry form to tell us the standard, the number of people and the sites in scope.
Integrated management systems: ISO 9001, 14001 and 45001 together
Most ISO management system standards, including ISO 9001, 14001, 45001, 22301 and 27001, share the same harmonised structure, with their requirements in clauses 4 to 10. Quality, environmental, health and safety, business continuity and information security can therefore run as one integrated management system, built once and maintained together, with certification against each standard you need.
In practice that means one context and risk process, one document control system, one internal audit programme and one management review covering every standard. ISO 9001, 14001 and 45001 are the most common combination, particularly in manufacturing, construction and facilities management. Whether the certification audits themselves can be combined is for the certification body to decide, so we confirm it for your scope before you commit.
ISO certification by sector
Which certificates matter depends on who you sell to. These are the combinations we see asked for most often:
| Sector | Standards usually asked for | Read more |
|---|---|---|
| Manufacturing | ISO 9001, ISO 14001, ISO 45001 and ISO 50001, with ISO 27001 where customers share designs or data | Manufacturing cyber security |
| SaaS and IT services | ISO 27001 and ISO/IEC 20000-1, often alongside SOC 2 for North American customers | SaaS security and compliance |
| Healthcare and medical devices | ISO 13485 for device makers, ISO 27001 for suppliers handling patient data | Healthcare cyber security |
How it works
How to get ISO certification in five steps
- 1
Choose the standard and scope
Confirm which standards your customers, tenders or regulators ask for, and agree which sites and activities the certificate will cover.
- 2
Gap analysis
Assess your current practices against each chosen standard and agree one combined plan.
- 3
Implement
Put documentation, processes and training in place with our support, and start keeping the records auditors will check.
- 4
Internal audit and review
We audit the system and support your management review, both required before certification.
- 5
Certification audit
An independent certification body carries out the Stage 1 and Stage 2 audits and makes the certification decision, followed by annual surveillance audits. For ISO 9001, 14001, 45001, 27001, 22301 and 20000-1 that is our partner, MQA International.
Why Sovereign Secure
Why choose Sovereign Secure for ISO certification?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- ISO 27001 certified ourselves. We run our own certified management system, so we prepare you for the kind of audit we go through ourselves.
- Independent certification. MQA International audits and certifies, which keeps consultancy and audit separate.
- Joined up with PCI DSS and Cyber Essentials. As a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body, we reuse evidence across frameworks.
- Where we work. Across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
What is ISO certification in the UK?
The same as anywhere else: an independent certification body audits your management system against an ISO standard, such as ISO 9001, ISO 14001 or ISO 27001, and issues a certificate after a two-stage audit, maintained through annual surveillance audits. Certification bodies are themselves accredited by an accreditation body, and many UK tenders and supply chains ask for a certificate from an accredited certification body, so check the wording of yours. For ISO 9001, 14001, 45001, 27001, 22301 and 20000-1, our partner MQA International is accredited by IAS, the International Accreditation Service.
How do I get ISO certification?
Choose the standard and scope, run a gap analysis, implement and document the system, then complete an internal audit and management review. A certification body then audits you in two stages (Stage 1 and Stage 2) and issues the certificate if you meet the requirements.
How do I check whether an ISO certificate is valid?
Ask the organisation for its certificate and check the certification body, the standard and edition, the scope and the expiry date. Then confirm it on the certification body's own register of certified organisations and, for accredited certificates, on the accreditation body's database.
Is ISO certification a legal requirement?
No. No UK law requires ISO certification in general. It becomes a requirement when a customer, tender or supply chain makes it a condition, and some schemes accept it as a route to compliance, such as ISO 50001 for ESOS.
Who issues the certificate?
An independent certification body, never the consultant. For ISO 9001, 14001, 45001, 27001, 22301 and 20000-1 that is our partner, MQA International; for other standards we confirm the certification body for your scope when we quote. We provide the consultancy and preparation; the certification body carries out the audit and issues the certificate if you meet the requirements.
Do we need an ISO consultant to get certified?
No. Some organisations implement a standard themselves. An ISO consultant shortens the path with a proven method and an outside view before the auditor arrives. Under ISO/IEC 17021-1, the standard for certification bodies, a certification body may not offer consultancy on the management systems it certifies, which is why consultancy and certification come from separate organisations.
How long does ISO certification take?
Typically three to six months for a single standard in a small or medium organisation, depending on your starting point. Adding a standard to an existing management system is usually quicker than starting from scratch.
How much does ISO certification cost?
It depends on the standard, your headcount, the number of sites and how much is already in place. For information security, our ISO 27001 cost guide shows the typical fees at each stage. For any standard, we give you a fixed quote after a short call.
How long does an ISO certificate last?
Three years. The certification body carries out surveillance audits in years two and three, then a recertification audit before the certificate expires, so the management system has to keep working between audits.
Can we certify to several ISO standards at once?
Yes. Because the standards share a common structure, an integrated management system lets you work towards, for example, ISO 9001, 14001 and 45001 together, with one set of policies, internal audits and management reviews. Whether the certification audits can be combined is for the certification body to decide, so we confirm it for your scope before you commit.
Which ISO standard do we need?
It depends on what your customers, tenders and regulators ask for. ISO 9001 covers quality, ISO 14001 environmental management, ISO 45001 health and safety, ISO 22301 business continuity and ISO 27001 information security. If you are unsure, we will confirm it with you in a short call before any work starts.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Guides and tools in this section
- ISO 27701ISO 27701:2025 explained: the standalone privacy standard, controller and processor controls, how it maps to UK GDPR and what 2019 certificate holders do next.
- ISO 42001ISO 42001 explained: what the AI management system standard requires, its 38 Annex A controls, who needs it and how ISO 42001 certification works.
- ISO 9001 vs ISO 27001ISO 9001 vs ISO 27001 compared: purpose, risk approach, Annex A controls and audits, which to get first, and how to run both as one integrated management system.
Related services
- ISO 27001 consultancyISO 27001 consultants from a UK firm that is ISO 27001 certified itself: gap analysis, ISMS build, internal audit and certification via MQA International.
- ISO 9001 certificationISO 9001 consultant support in the UK: gap analysis, QMS build, internal audit and certification through MQA International, with costs explained. Get a quote.
- What is ISO 9001?What is ISO 9001? The quality management standard explained: what it stands for, its requirements, the 7 quality principles, the 2026 edition and how to certify.
- ISO 27001 certification costISO 27001 certification cost in the UK for 2026: consultancy, Stage 1 and 2 audits, surveillance and recertification by company size. Get a fixed quote.
- ISO 27001 gap analysisISO 27001 gap analysis against the 2022 standard: clauses 4 to 10 and all 93 Annex A controls, scored into a risk-ranked roadmap. Free template or a fixed quote.
- Cyber Essentials vs ISO 27001Cyber Essentials vs ISO 27001, compared by an IASME certification body that is ISO 27001 certified: scope, cost, timescales and which one your buyers need.
Standards we cover
Consultancy and certification services
- ISO/IEC 27001:2022Information securityOur core ISO service. Build and certify an ISMS that also supports PCI DSS and Cyber Essentials. →
- ISO 9001:2026
Quality management
The most widely adopted management system standard. Build a quality management system that controls your processes and suppliers, tracks customer satisfaction and improves continually. The 2026 edition was published in September 2026. Certificates to ISO 9001:2015 stay valid during a three-year transition, so certified organisations have until September 2029 to move across, and a system built to the 2015 edition carries forward.
- ISO 14001:2026
Environmental management
Identify and control your environmental impacts, meet your compliance obligations and set measurable objectives. Often certified alongside ISO 9001 and ISO 45001 as one integrated system. The 2026 edition was published in April 2026. Certificates to ISO 14001:2015 stay valid during a three-year transition, so certified organisations have until 30 April 2029 to move across.
- ISO 45001:2018
Occupational health & safety
The international standard that replaced OHSAS 18001. Identify hazards, reduce workplace risk, involve workers and show clients and regulators a safe working environment.
- ISO 22000:2018
Food safety management
Food safety controls across the supply chain, from producers to retailers, combining HACCP principles and prerequisite programmes with a management system.
- ISO/IEC 20000-1:2018
IT service management
Plan, deliver and improve IT services to agreed levels. It shares its structure and many processes with ISO 27001, so the two are often run together.
- ISO 13485:2016
Medical device quality
Quality management for medical device design, manufacture and supply, widely used to support regulatory requirements for medical devices.
- ISO 50001:2018
Energy management
Measure and reduce energy use and cost with a structured plan-do-check-act management system and energy performance indicators.
- ISO 55001:2024
Asset management
Get the most value from physical assets across their whole life cycle.
- ISO 39001:2012
Road traffic safety
Reduce road traffic incidents for fleets, logistics and transport operators.
- ISO 22301:2019
Business continuity
Prepare for, respond to and recover from disruption with tested continuity plans. Often paired with ISO 27001 and PCI DSS, and a natural next step for an existing ISMS.
- ISO 21001:2025
Educational organisations
Management system for training providers, schools and universities.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“We are satisfied with the quality of work delivered by Sovereign Secure and would happily recommend them to any company that requires consultancy and guidance in obtaining their ISO 27001 certification.”
Call +44 161 523 5276
Email [email protected]