Consultant vs Certification Body: Who Does What in Certification?

Who is involved in a certification, and what does each party do?

Six parties, none of which can play another’s role. The company builds its system and remains responsible for it. The consultant helps build it. The certification body audits it and decides. The accreditation body oversees the certification body. The scheme owner writes the rules. The buyer decides whether to accept the certificate.

Two clarifications clear up the most frequent confusions. ISO publishes standards but certifies no company: an “ISO 9001 certificate” is always issued by a certification body. Nor does the GFSI (Global Food Safety Initiative) certify anyone: it recognises certification programmes, twelve today according to its official page, from BRCGS to SQF.

The authorities come on top of these six parties. For a Moroccan food business, sanitary approval or authorisation from ONSSA (Office National de Sécurité Sanitaire des Produits Alimentaires, the national food safety office) is a legal obligation; no certification replaces it, as our food safety page explains.

A chain of trust, link by link

A certificate is credible because each link is checked by the next. The site is audited by the certification body; the body is assessed by its accreditation body; the accreditation body is evaluated by its peers; the scheme owner monitors the bodies it has approved, and the GFSI benchmarks the scheme. If a link is missing, a non-accredited body or an accreditation body nobody recognises, the document is just paper: it attests what its issuer claims, nothing more.

This is exactly what buyers check. Our case study of an exporter whose certificate was rejected shows what a missing link costs, and our checklist for checking a certification body and a certificate shows how to avoid it.

Why must the consultant and the certification body stay separate?

Because nobody can impartially judge a system they built. An auditor who wrote the procedures they assess is auditing their own work; a body that sells both the consultancy and the certificate has an interest in the audit succeeding. Accreditation rules close both doors.

ISO/IEC 17021-1, the standard that management system certification bodies must meet, makes this an impartiality requirement. The assessment checklist of SADCAS, the accreditation body of the Southern African Development Community (form F 40 (a), Issue 6, August 2024), restates its control points for the 2015 edition. Our guide to choosing an ISO consultant in Morocco turns them into questions to put to a consultancy; the table below reads them from the point of view of roles.

The independent consultant is not exempt. In its FAQ (Question 33.1, answer of March 2017), European Accreditation considers that an individual running their own consultancy company is a body within the meaning of the standard: the two-year rule applies, or a similar mitigation. The table summarises these requirements without reproducing the text of the standard, which is sold.

The last rule has a practical consequence that is often overlooked: the auditor is not the decision-maker. The decision belongs to persons or a committee who did not carry out the audit. A consultant who “knows the auditor well” therefore does not know the decision, and a promised certificate has no basis.

What remains allowed matters just as much. A consultant may also audit as a third party for a certification body, provided they never audit a site they advised. That is often what gives them a genuine auditor’s eye, the one expected of them in a mock audit.

What do BRCGS, IFS and FSSC 22000 say about consultancy and impartiality?

None of them forbids using a consultant, and all of them protect the audit against conflicts of interest. The GFSI-recognised food safety standards add their own rules to those of accreditation.

BRCGS. Food Safety Issue 9 allows a site that lacks the appropriate in-house knowledge to use external expertise, food safety consultants for example, but the day-to-day management of the food safety systems remains the responsibility of the company (clause 1.2.4 of the self-assessment checklist, French version). Packaging Materials Issue 7 sets the same rule for packaging (clause 1.3.3). The consultant is also a provider like any other: Food Safety Issue 9 lists product safety consultants among the suppliers of services to be approved and monitored on the basis of risk (3.5.3.1). The certification route published by BRCGS presents consultancy as an option, to be obtained “if needed”, and points to selecting a BRCGS-approved certification body.

IFS. The IFS Food Version 8 standard requires the certification body to ensure that its auditors have not acted as consultants for, or had involvement with, the audited company during the previous two years, and that no auditor performs more than three consecutive full IFS Food audits at the same production site (Part 3, chapter 2.6). At every audit, the auditor signs a confirmation of independence and absence of conflict of interest, which covers any association with the company, current or within the last two years. A voluntary pre-audit is possible, but it cannot be uploaded to the IFS Database and the subsequent audit must be performed by a different auditor (Part 1, chapter 2).

FSSC 22000. Version 7 of the scheme, published in May 2026, requires for every audit an integrity declaration signed by the senior representative of the site and by the auditors: no actual or perceived conflict of interest, integrity of the audit not compromised, audit conducted in an ethical manner (Part 3, section 6.3). An auditor may not perform more than two three-year certification cycles at the same organisation (Part 3, section 5.9). And consultancy experience counts for six months at most of the two years’ experience required of an auditor, provided it is food safety consultancy (Part 4, section 3.5.1). What Version 7 changed on this point is summarised in our article on certification impartiality in 2026.

How impartiality holds when a consultant also audits

ACG is a case in point. Our founder, Dr. Ismail Idrissi, a registered BRCGS consultant since 2014 according to the BRCGS list of consultants, also audits as a third party for Eurofins and URS. The principle that makes the two activities compatible is simple: he never carries out a certification audit at a site ACG has advised, and he declares his links to the body he audits for, as the declarations required by IFS and FSSC 22000 provide. The auditor’s eye serves the consultancy; it never serves a certification audit at an ACG client.

Product or system certification: which body for which standard?

The scheme sets the accreditation standard for the body. The GFSI benchmarking requirements, version 2024, allow two routes: ISO/IEC 17065 for bodies that certify products, ISO/IEC 17021-1 with ISO 22003-1 for those that certify management systems (Key Changes, version 2024). They also require certificates to be issued by bodies accredited by accreditation bodies that are signatories to the multilateral recognition arrangement for the appropriate scope.

Global ACI (Global Accreditation Cooperation Incorporated) took over the role of the International Accreditation Forum (IAF); its mutual recognition arrangement (MRA) is what makes an accreditation granted in one country count in another. For a company in Morocco, two facts matter. SEMAC (Service Marocain d’Accréditation, the Moroccan Accreditation Service) accredits management system certification bodies to NM ISO/IEC 17021-1, and the Ministry of Industry and Trade publishes their lists on its online documents and services page (in French). But as of 5 November 2026, the Global ACI associate members page lists the Moroccan accreditation service among the accreditation bodies that are not yet signatories of its MRA, and the list of accreditation bodies under agreement with the Foundation FSSC, 46 bodies in 45 countries, does not include Morocco. A Moroccan site certified to FSSC 22000 is therefore certified by a body accredited by a foreign accreditation body. For an ISO standard, ask your customer whether it accepts the accreditation shown on the certificate, before choosing the body. Outside Morocco, put the same two questions to any national accreditation body: does it accredit the body for your standard, and does it sign the recognition arrangement your customer relies on?

How do you work with each party, from first contact to certificate?

By keeping each one in its role at every stage, and asking for it in writing. The table shows who does what, from the buyer’s requirement to maintaining the certificate.

With the consultant

A contract that lists the deliverables, names the people involved and contains a declaration of independence from any certification body. Selection criteria and the tender itself are covered in our guide to choosing an ISO consultant and our request for proposal checklist for an ISO consultancy assignment.

With the certification body

An accurate application, then a contract. The body must make publicly accessible its audit and certification processes, its impartiality policy and its process for handling complaints and appeals (ISO/IEC 17021-1, 8.1.1). For IFS Food, the contract covers at a minimum the agreed audit scope, the audit duration, the report and certificate details, and a reference to the IFS Integrity Program. Do not ask the body how to correct a nonconformity: it cannot advise you. Do ask it, however, for the written justification of its audit time, which the standard requires it to record (9.1.4), and for the auditors’ names: it must give them to you early enough for you to object to one of them, a former consultant of your site for example (9.2.3.5).

With the accreditation body

Rarely directly, but it matters. It is the body you consult to check an accreditation and its scope, and the one to which you send a complaint about a certification body if an appeal to the certification body itself has achieved nothing.

Who pays whom, and who guarantees what?

The company pays the consultant, if it uses one, and the certification body. The certification body pays for its accreditation and, for a private scheme such as IFS Food or FSSC 22000, signs a contract with the scheme owner. Nobody guarantees the certificate.

These flows are public in principle. In Morocco, the accreditation fees that SEMAC charges conformity assessment bodies are set by a notice from the Ministry of Industry and Trade (in French). IFS Food Version 8 requires the body to sign a framework agreement with IFS Management GmbH before any audit, and the Foundation FSSC prohibits promoting or selling its services without a signed licence agreement. These contractual links never go through the consultant: an offer that bundles consultancy and the certificate into one price mixes two roles that the rules keep apart.

On guarantees, each party commits only to what it controls. The consultant commits to a method, deliverables, a presence on site and a schedule. The body commits to a process, a justified audit time and a decision based on evidence. The breakdown of spending, including your teams’ time, is in our article on the real cost of certification.

Which checklist assigns the roles without conflicts of interest?

This one, to go through at project launch and again before the certification audit.

• The buyer’s requirements are in writing: standard, version, audit programme, any expected grade.
  
• The consultant has signed a declaration of independence from any certification body.
  
• No one from the consultancy will take part in the certification audit of your site.
  
• The certification body is accredited, or approved by the scheme owner, for your standard and your sector.
  
• Its accreditation body is recognised for this scope and accepted by your buyers.
  
• The body’s offer contains no consultancy, and the consultancy’s offer no certificate.
  
• The audit time is justified in writing, on the basis of an accurate questionnaire.
  
• You have asked for the auditors’ names and checked that none of them has worked for you in the past two years.
  
• Your process owners can answer on their own; day-to-day management of the system stays in-house.
  
• You know the body’s appeals and complaints process.