Last updated 29 October 2026
Choose a consultant who does not also sell you the certificate. Under ISO/IEC 17021-1, the standard that accredited certification bodies are themselves held to, a certification body is not allowed to offer or provide management system consultancy, and where consultancy has been provided it cannot certify that system for at least two years afterwards. So a single company in Pakistan offering to build your system and hand you an accredited certificate at the end of it is describing something that cannot happen.
That one test does more work than any amount of comparing brochures. Everything below is the detail behind it, the things worth checking once a consultant has passed it, and the questions that tend to produce revealing answers.
Can the same company consult and certify you?
No, not if the certificate is to be accredited. ISO/IEC 17021-1:2015 is the international standard for bodies that audit and certify management systems, and it is what an accreditation authority assesses a certification body against. Three of its impartiality clauses matter to you as a buyer.
| Clause | What it requires | What it means for you |
|---|---|---|
| 5.2.5 | A certification body shall not offer or provide management system consultancy. | Your consultant and your certification body have to be two different organisations. |
| 5.2.6 | Internal audits performed by the certification body are a significant threat to impartiality. It cannot certify that system for at least two years after those audits end. | Do not let the body that will certify you run your internal audit programme. |
| 5.2.7 | Where consultancy has been provided, the body shall not certify that management system for at least two years after the consultancy ends. | A bundled “implementation plus certificate” offer cannot produce an accredited certificate. |
This is not a technicality and it is not an Axora preference. It is the reason the whole system is worth anything to the buyer at the other end of your supply chain. An auditor who helped write your procedures is auditing their own work.
What a bundled offer actually is
When one company in this market quotes you a single price that includes the certificate, one of two things is true. Either it is reselling an audit from a body that is not accredited by any recognised authority, in which case your buyer cannot verify it. Or there is an accredited body involved and the arrangement breaches its own impartiality rules, which is the body’s problem until the day it becomes yours.
What does accredited actually mean on a Pakistani certificate?
Accreditation is a check on the checker. A certification body audits you. An accreditation authority audits the certification body against ISO/IEC 17021-1. Without that second layer, a certificate is a document a company printed about another company.
In Pakistan, the national accreditation authority is the Pakistan National Accreditation Council, which accredits certification bodies against ISO/IEC 17021 and is a signatory to the multilateral recognition arrangements of Global ACI, the body that replaced the International Accreditation Forum (IAF) in January 2026, and of the Asia Pacific Accreditation Cooperation (APAC), which replaced the Pacific Accreditation Cooperation (PAC) in 2019, covering quality and environmental management systems. Many certificates held by Pakistani companies instead carry foreign accreditation, from authorities such as UKAS in the United Kingdom or ANAB in the United States, which is equally valid and sometimes what a specific buyer asks for.
What matters is not which authority, but that there is one, that it is a member of Global ACI, the body that replaced the International Accreditation Forum (IAF) in January 2026, and that the scope on the certificate covers the standard you are claiming. Ask which authority accredits the body, for which standards, and get it in writing before you sign.
How to verify a certificate yourself
IAF CertSearch is a public database built for exactly this, and it still runs under that name now that the IAF has become part of Global ACI. ISO publishes its own guidance on verifying an accredited certification. Not every certificate appears there, because it depends on the certification body uploading its data, so an absence is a question rather than a verdict. If a certificate is not listed, ask the certification body directly, using contact details you found yourself rather than ones printed on the certificate.
Which of these has your consultant told you?
Tick the statements you have actually heard. The tool below says which are red flags and why, with the clause behind each one where there is a clause.
Consultant claim checker
Eight things consultants in this market say. Six of them should worry you.
-
Red flag
Certification is included in the price. The body that audits and certifies you cannot be the body that implemented your system. ISO/IEC 17021-1 clause 5.2.5 says a certification body shall not offer or provide management system consultancy, and clause 5.2.7 bars it from certifying for at least two years after any consultancy ends. If certification is bundled into one price, either the certificate is not accredited or the audit is not independent.
-
Red flag
We will run your internal audit and then certify you. Clause 5.2.6 treats this as a significant threat to impartiality and bars the body from certifying that system for at least two years after the internal audits stop. The internal audit is yours to own, with or without help.
-
Red flag
We guarantee you will pass. Nobody outside the certification body can promise its decision. A consultant can make you ready. A guarantee of the outcome means either the audit is not independent or the promise is empty.
-
Correct
We will arrange the certification body audit separately and you contract with them directly. This is what a compliant arrangement looks like. Two suppliers, two invoices, one of them independent of the other. Axora works this way and so should anyone else you are considering.
-
Red flag
You will have the certificate within a week. An accredited route runs a Stage 1 readiness audit and a Stage 2 audit, with time in between to close findings. A week does not fit, and a certificate that arrives in a week did not come through that route.
-
Correct
Here is the accreditation mark on the certificate and the certification body’s reference. Good answer, and now verify it. Look the body up with its accreditation authority and check the certificate in the IAF CertSearch database. A consultant who volunteers this detail expects to be checked.
-
Red flag
Accreditation does not really matter, the certificate is the same. Accreditation is the only thing that makes the certificate checkable by someone who does not know you. Your buyer’s procurement team is the audience for it, not your reception wall.
-
Red flag
We will write the manual and the procedures, you do not need to be involved. The auditor interviews your staff and samples your records, not your consultant’s documents. A system nobody inside the company recognises fails at Stage 2 or fails at the first surveillance visit.
Nothing is submitted and nothing is stored. The checker runs entirely in your browser.
Why are there two fees and not one?
Because there are two suppliers. The consultancy fee pays for building the system, training your people and getting you ready. The certification body’s audit fee pays for the independent assessment and the certificate, and it recurs, because accredited certification carries surveillance audits through the cycle.
Anyone quoting you one all in number is either absorbing the audit fee into their margin, which means they are buying the cheapest audit available, or not telling you about the second invoice yet. The honest version of this answer names both and tells you which one is recurring.
Axora Global quotes a consultancy fee band after a free gap analysis and arranges the certification body audit separately. The cost of the consultancy itself depends on your organisation’s size, number of locations and the complexity of your operation, so the only responsible way to give you a figure is to look at your situation first. Book a free consultation for an exact quote.
How long should it take?
Most small and medium businesses in Pakistan complete implementation in about 6 to 12 weeks, and the certification body’s Stage 1 and Stage 2 audits sit after that, with time in between to close any findings. The variable is almost never the consultant’s speed. It is how quickly your own people produce records, because a management system is evidenced by what you did, and evidence takes calendar time to accumulate.
Treat any promise of a certificate inside a week or two as a statement about the certificate rather than about the consultant.
What should the consultant actually hand over?
- Yours
A system your staff can run without them. Documented procedures in your own language and your own process names, not a renamed template from another client.
- Yours
A completed internal audit and management review, with the records to prove both happened. These are the two things organisations most often fail on at the first surveillance audit.
- Yours
Trained people, including at least one person who can run the next internal audit cycle on their own.
- Yours
A clear handover of what happens next, naming the surveillance dates, the recertification year and who is responsible for each.
What should you ask before you pay?
-
Ask
Which certification body will audit us, and who accredits them? A consultant who cannot name the body, or who says they will decide later, is keeping the choice for a reason. You want the body’s name and its accreditation authority before you sign anything.
-
Ask
What is the certification body’s audit fee, separately from your fee? If the answer merges the two, ask again. If it stays merged, assume the audit is the cheapest one available.
-
Ask
Who performs our internal audit in the first cycle, and who performs it after that? The right answer trains someone of yours to do it. An answer that keeps the internal audit with the people who will also certify you runs into clause 5.2.6.
-
Ask
How many hours of our staff’s time will this take, and whose? A consultant who says almost none is describing a document exercise. An auditor samples your people and your records, so the time has to come from somewhere.
-
Ask
What happens at the first surveillance audit, and is support for it included? Certification is a cycle, not an event. This question separates the consultants who have been through surveillance audits with clients from the ones who sell certificates and move on.
-
Ask
Can we speak to a client of yours in our sector whose certificate is currently valid? Currently valid is the operative phrase. A reference whose certificate lapsed after the first year tells you what happened to the system once the consultant left.
Frequently asked questions
Can an ISO consultant also issue my certificate?
Not an accredited one. ISO/IEC 17021-1 clause 5.2.5 prohibits a certification body from offering or providing management system consultancy, and clause 5.2.7 bars it from certifying a system for at least two years after any consultancy ends. A consultant and a certification body have to be separate organisations.
Is a certificate without accreditation valid?
It exists as a document, and some buyers never look further than the logo. But it cannot be independently verified, it is not covered by any recognition arrangement, and a procurement team that checks will find nothing behind it. If the point of the certificate is to satisfy a customer, unaccredited is a false economy.
Does Pakistani accreditation count internationally?
The Pakistan National Accreditation Council is a signatory to the multilateral arrangements of Global ACI, formerly the International Accreditation Forum (IAF), and of the Asia Pacific Accreditation Cooperation (APAC), which replaced the Pacific Accreditation Cooperation (PAC) in 2019, for quality and environmental management systems, which is the mechanism by which accreditation is recognised across borders. For other standards, or where a specific buyer names an authority, certificates accredited by foreign authorities are common in Pakistan and equally valid.
How do I check that a certificate is real?
Look it up in IAF CertSearch, the public database of accredited certificates, and check the accreditation authority’s own register for the certification body. ISO publishes guidance on verifying accredited certification. If the certificate is not listed anywhere, contact the certification body using details you found independently and ask them to confirm it.
How long does ISO certification take?
Most small and medium businesses in Pakistan complete implementation in about 6 to 12 weeks, with the certification body’s Stage 1 and Stage 2 audits following, plus time between them to close findings. Your own team’s pace in producing records is usually what decides the total.
What does ISO certification cost in Pakistan?
There are two separate costs, the consultancy and the certification body’s audit fee, and the audit fee recurs through the certification cycle. The consultancy cost depends on your organisation’s size, number of locations and complexity. Axora Global quotes a consultancy fee band after a free gap analysis and arranges the certification body audit separately. Book a free consultation for an exact quote.
Do I need a consultant at all?
No. Plenty of organisations implement a standard in house, and if you already have someone who has done it before, that is often the better route. What a consultant buys you is speed and the avoidance of rework, particularly on scope, risk assessment and the documents an auditor will actually ask for. If you have the internal capability, use it.
What happens after the certificate arrives?
Accredited certification runs on a cycle with annual surveillance audits and a full recertification audit at the end of it. The internal audit and management review have to keep happening. Ask any prospective consultant what post certification support is included and what it costs, because a system that is not maintained fails at the first surveillance visit.
Sources
- ISO/IEC 17021-1:2015, Conformity assessment, Requirements for bodies providing audit and certification of management systems, Part 1, Requirements. Clauses 5.2.4 to 5.2.7 on impartiality, consultancy and internal audits.
- Pakistan National Accreditation Council, accreditation of certification bodies under ISO/IEC 17021 and its signatory status to the Global ACI, formerly International Accreditation Forum (IAF), and Asia Pacific Accreditation Cooperation (APAC, formerly PAC) multilateral recognition arrangements.
- International Accreditation Forum, IAF CertSearch, the public database of accredited management system certifications.
- ISO, guidance on how to verify an accredited certification.
Ask us the questions in this article
We will tell you which certification bodies operate in your sector, who accredits them, and what the audit fee is likely to be, before you commit to anything. The consultancy is ours. The certificate is not, and that is the point.