ISO Consultant in Morocco: How to Choose the Right Firm

What does an ISO consultant do on a project, and what must it never do?

It prepares your company for a standard and makes it self-sufficient; it does not certify it and decides nothing in your place. A good ISO consultant measures your gaps, builds the system with your process owners, trains your teams, checks that everything works before the audit, then helps you keep the certificate. The certification audit and the certification decision belong to an accredited certification body, which you choose.

Our QHSE and ISO systems page sets out how roles are shared between the company, the consultant, the certification body and the accreditation body. On a real assignment, the line is drawn task by task. The table traces it for the topics that cause the most misunderstandings at the start.

These limits are not a matter of wording. At stage 2, the auditor questions your process owners and operators, not the consultant. A system written by an outsider, which nobody has made their own, shows from the first interviews.

Do you need a consultant at all? Not always. A company with an experienced quality manager who has already been through a certification can run an ISO 9001 project alone and simply bring in an external mock audit. A consultant earns its place when the team lacks time, audit experience or competence on a standard (environment, health and safety), when a customer imposes a short deadline, or when several standards and several sites must be integrated. If the need is lasting rather than one-off, the function can be covered part-time: see outsourced QHSE.

Why is independence from the certification body the first criterion?

Because a certificate is only worth the impartiality of whoever issues it, and accreditation rules organise that impartiality precisely. ISO/IEC 17021-1, the standard that management system certification bodies must meet, keeps consulting and certification strictly apart. These rules come from an international standard, not from Moroccan law: they bind any accredited certification body, wherever your site is.

The assessment checklist that SADCAS, the accreditation body of the Southern African Development Community, applies to certification bodies (SADCAS form F 40 (a), Issue 6, August 2024) restates the control points of the 2015 edition of the standard:

• the certification body, and any part of the same legal entity, does not offer or provide management system consultancy;
• it does not provide internal audits to its certified clients, and does not certify a system on which it provided internal audits within the two years that follow their end;
• it does not certify a client when its relationship with a consultancy poses an unacceptable threat to its impartiality;
• it does not outsource audits to a management system consultancy;
• its activities are neither marketed nor presented as linked with consultancy, and it does not imply that certification would be simpler, easier, faster or less expensive with a specified consultancy;
• it manages its personnel’s conflicts of interest, with a two-year rule.

European Accreditation sets out the recognised mitigation when a related body has provided consultancy: not certifying the system for at least two years after the end of consultancy provided by a related body. It adds that an individual consultant running their own consultancy company is considered a body within the meaning of the standard.

For you, this comes down to four questions to put in writing to each consultancy:

1. Does the firm have a legal, ownership or commercial link with a certification body?
2. Do any of its consultants also audit for a certification body? If so, do they commit never to take part in the audit of your site?
3. Does the firm steer you towards a specific body, with the promise of an “easier” or shorter audit? That is exactly what the standard forbids the body to imply.
4. Does the offer combine consulting and the certificate in a single price?

A consultant who also works as a third-party auditor is not a problem in itself: that is often what gives them a genuine auditor’s eye. The problem starts if they audit a site they advised. Finally, check the body itself. Morocco’s Ministry of Industry and Trade publishes, on its online documents and services page (in French), the lists of certification bodies accredited to NM ISO/IEC 17021-1 by SEMAC (Service Marocain d’Accréditation, the Moroccan Accreditation Service). A “certificate” issued by a non-accredited entity does not carry the same weight with your customers. Outside Morocco, run the same check with the accreditation body that accredited the certification body.

Which criteria should you check before choosing an ISO consultant?

Seven criteria, each with evidence to request. Price comes afterwards: comparing prices before comparing methods means comparing different services.

Named qualifications, not a brochure

Ask who will actually work on your site, not only who signs the offer. For each consultant: auditor training on the target standard, real audit experience, projects delivered. An auditor certification issued by a body such as IRCA (CQI) is a good benchmark. Distinguish the certificate of completion of a Lead Auditor course, which proves training, from individual auditor certification issued by IRCA, which is a separate status: ask which of the two the consultant holds, with the supporting document.

For an integrated system, check competence on each standard. An excellent quality consultant is not necessarily at ease with environmental aspects analysis, the register of compliance obligations, or occupational risk assessment under the Moroccan Labour Code.

References you actually call

A wall of logos proves nothing. Ask for two or three comparable references, same standard and same size, same industry if possible, then call them. Three questions are enough. Was the consultant announced the one who came? Does the system hold without them? What went wrong, and how did the firm react? A serious consultancy does not publish a client’s name without permission; it can, however, put you in touch with a client willing to talk. A published success rate should be read with its definition: how many projects, which standards, over what period.

A method that starts on the shop floor

A consultant who prices a full assignment without having seen your site is guessing. The gap analysis must take place on your premises: interviews with management and the future process owners, an order or a complaint traced from end to end, a walk through the workshops and risk areas. It produces a prioritised gap report that separates what is missing, what exists without evidence and what is already solid. That report is what the schedule and budget rest on; the factors that move both are covered in our article on ISO consultancy fees and duration.

Training, and how it is funded

The system lives through your process owners and internal auditors. Check that the consultancy knows how to train, with written course outlines, an assessment of learning and sessions in French, Arabic or English depending on the role. In Morocco, also check that it is eligible for the special training contracts (contrats spéciaux de formation, CSF) run by OFPPT, the national vocational training office. The rule: training actions written into the training plan can be reimbursed at the rates of the CSF procedures manual (May 2006, amended by Amendment No. 2 of 2 June 2014), within a ceiling linked to the vocational training tax (taxe de formation professionnelle, TFP) the company has declared; consulting is not a training action. No consultancy can promise you an amount: it can simulate your case, as explained on our CSF and GIAC funding page. For a company based outside Morocco, these funding mechanisms do not apply; every other criterion stays the same.

Casablanca, Rabat, Tangier, Agadir: does proximity matter?

Less than planned presence. What matters is that the consultant is on your site at the stages that require it (gap analysis, workshops, internal audits, mock audit, audit day) and that the rest moves forward remotely without losing pace. Ask for the number of on-site days, the rule for travel costs and the name of the deputy. For a group with plants in Tangier and Agadir, a consultancy working nationwide with a single lead consultant is better than two providers who do not talk to each other. The same reasoning holds for the subsidiary of a foreign group with several sites in the region: one lead consultant beats a patchwork of local providers.

Which warning signs should make you reject an offer?

Any promise about something the consultant does not control: the body’s decision, the length of the audit, the amount of a reimbursement. The most frequent signs:

• A guaranteed certificate. The decision belongs to the certification body, after its audits.
• A fixed timeline with no gap analysis. Duration depends on your starting point, on the time your teams can devote and on the body’s schedule. For certification to ISO 9001:2026, a body can issue an accredited certificate only after its accreditation body’s transition decision, by 30 September 2027 at the latest according to the transition document of Global ACI, the body that took over the work of the International Accreditation Forum (IAF).
• A “document kit”. Generic procedures nobody applies; the auditor sees it when questioning operators.
• A “recommended” body with an audit presented as easier, or an offer that includes the certificate.
• A consultant who will answer for you during the audit.
• No consultant’s name, or undeclared subcontracting of the assignment.
• A price per document or per page, which rewards producing paper rather than a system.
• A promised CSF amount, when funding depends on rules and ceilings specific to your company.
• No training planned: the know-how leaves with the consultant.

How does an assignment with an ISO consultant unfold?

In six phases, from gap analysis to maintenance, with shared steering: a project manager on your side, a lead consultant on the firm’s side, and a progress review on fixed dates. The table shows who does what at each phase.

Three steering rules prevent most drift. Measure progress on facts (gaps closed, documents approved by their owner, people trained) rather than on days consumed. Keep ownership of, and access to, every document produced, including after the assignment. Require a written report after every on-site visit.

The target edition matters too. A new project goes straight for ISO 9001:2026 and ISO 14001:2026; ISO 45001:2018 remains the version in force. Our ISO 9001 certification guide for Morocco details the certification route, and our article on the ISO 9001:2026 transition explains what the new version changes for a site that is already certified.

One standard, three standards, several sites: does the choice of consultant change?

Yes: the wider the scope, the more multi-standard competence and organising capacity count. ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018 share the same clause structure, which allows an integrated QHSE management system and a combined audit. The consultant must then prepare you for the real rules of that audit, not for a sales promise. According to Global ACI-TECH-3-008, audit time is calculated standard by standard and then added up, and the reduction for integration is capped at 20%. A consultant who tells you the audit will be half as long because “everything is integrated” is wrong.

Three questions separate consultancies on a multi-standard or multi-site project:

• Who covers each standard? A lead consultant, and named expertise for environment and for health and safety, with knowledge of the applicable Moroccan texts.
• How does the schedule account for the transitions? The deadline is 30 April 2029 for ISO 14001:2026 and 30 September 2029 for ISO 9001:2026; an ISO 45001 revision is expected in 2027, with no transition period set to date. What these deadlines change is summarised in our article on ISO consultancy in 2026-2027.
• How are the sites handled? One common system, local requirements per site, a single internal audit programme, and presence on each site at the key stages.

Our case study of a multi-site manufacturer shows how these questions arise in a real tender.

Which checklist should you use to compare offers?

This one, applied to every offer received on the basis of the same request for proposal. To write that request and build the scoring grid, see our article on the ISO consultancy request for proposal.

• The offer contains a declaration of independence from any certification body.
  
• The lead consultant and their deputy are named, with their CVs and auditor certificates.
  
• Each target standard is covered by identified expertise.
  
• Two or three comparable references can be reached, and you have called them.
  
• An on-site gap analysis precedes the overall price, or forms its first phase.
  
• Deliverables are listed, with their format, and remain yours.
  
• The split of work between the consultant and your teams is in writing.
  
• The number of on-site, remote and training days is specified, as are travel costs.
  
• Planned training has course outlines and an assessment of learning, and can be written into the training plan.
  
• The offer promises no certificate, no timeline without a gap analysis and no reimbursement amount.
  
• Post-certification maintenance is offered, as an option or in the contract.