Australia
ISO certification consultancy in Australia
Australia's certification demand is driven by resources, regulated construction and government buying. Mining and energy operators in Western Australia and Queensland run contractor prequalification systems that treat safety management as a threshold, not a differentiator. Work health and safety law imposes duties across the supply chain and industrial manslaughter provisions apply in several jurisdictions. State infrastructure agencies operate their own contractor accreditation covering quality, safety and environment. Federal and state government technology contracts require assessed information security and data hosting arrangements. Grocery retailers and export markets require recognised food safety scheme certification from suppliers and processors.
- States and territories
- 8
- Priority standards
- 20
- Delivery
- Onsite, remote, hybrid
Trusted in Australia
Organisations we have taken through certification, here and elsewhere.
Every organisation above started the same way you are starting: a requirement they had to meet and no certificate yet.
Standards most asked for in Australia
Organised by the sectors that drive certification in this market, because what you are asked for depends on the work you do. Every name opens the page for that standard or that industry.
Asked of every sector: ISO 9001.
Certification in Australia, sector by sector
Who asks for certification in Australia
Almost nobody certifies because they woke up wanting to. In Australia, as everywhere, the request arrives from outside: a customer's procurement pack, a tender condition, a regulator, or a parent company applying a group policy. Which of the four is asking changes the answer, because each wants something slightly different and each will accept something slightly different.
ISO 9001 is asked of organisations in Australia whatever they do. Beyond that, what you are asked for depends on your sector, and the sections below set out what each of the industries that drive certification in Australia is actually asked to hold.
Manufacturing in Australia
A factory is usually pushed into certification by its customers rather than by a regulator. The first serious buyer sends a supplier questionnaire, the second sends an auditor, and by the third it is cheaper to hold the certificate than to keep hosting audits.
What an organisation in this sector in Australia is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 41001 — ISO 41001 Facility Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- ISO 50001 — ISO 50001 Energy Management System
- IATF 16949 — IATF 16949 Automotive Quality Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Manufacturing.
Construction in Australia
Prequalification is where this sector meets certification: the certificates are a condition of being invited to bid, long before anyone looks at what you would charge.
What an organisation in this sector in Australia is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 41001 — ISO 41001 Facility Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 50001 — ISO 50001 Energy Management System
- ISO 37001 — ISO 37001 Anti-Bribery Management System
The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.
More on this sector: Construction.
Energy in Australia
Two pressures at once: the cost of what is consumed, and what has to be reported about it. Certification gives the first a method and the second an auditable basis.
What an organisation in this sector in Australia is typically asked to hold:
- ISO 50001 — ISO 50001 Energy Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO/IEC 17025 — ISO/IEC 17025 Testing and Calibration Laboratories
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 37001 — ISO 37001 Anti-Bribery Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Energy.
Oil and Gas in Australia
Contractor prequalification decides who is allowed on site. Operators screen on safety performance before they screen on price, and an uncertified contractor usually does not reach the second conversation.
What an organisation in this sector in Australia is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- ISO 50001 — ISO 50001 Energy Management System
- ISO 26000 — ISO 26000 Social Responsibility Guidance
- ISO 37001 — ISO 37001 Anti-Bribery Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Oil and Gas.
Automotive in Australia
Nothing enters an automotive supply chain uncertified. It is the one sector where the scheme is effectively a condition of trading rather than a differentiator.
What an organisation in this sector in Australia is typically asked to hold:
- IATF 16949 — IATF 16949 Automotive Quality Management System
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.
More on this sector: Automotive.
Transport and Logistics in Australia
Freight and warehousing sit inside somebody else's supply chain, and the people who own that chain audit it. Certification is how a provider stops being the weak link in the assessment.
What an organisation in this sector in Australia is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- CTPAT — CTPAT Supply Chain Security
- ISO 22000 — ISO 22000 Food Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Transport and Logistics.
Information Technology in Australia
Software buyers stopped taking assurances some years ago. What they ask for now is evidence held by somebody who is not you — which is why a certificate closes a deal that a well-written policy does not.
What an organisation in this sector in Australia is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- SOC — SOC 1 and SOC 2 Readiness
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 41001 — ISO 41001 Facility Management System
- ISO 22301 — ISO 22301 Business Continuity Management System
- CMMI — CMMI Appraisal Readiness
- PCI DSS — PCI DSS Compliance
Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.
More on this sector: Information Technology.
Telecommunication in Australia
Operators are asked for two things at once: that the network stays up, and that what crosses it stays private. Licence conditions cover some of it, enterprise customers and their own audit departments cover the rest.
What an organisation in this sector in Australia is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 22301 — ISO 22301 Business Continuity Management System
- CMMI — CMMI Appraisal Readiness
- SOC — SOC 1 and SOC 2 Readiness
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
- ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Telecommunication.
Banking and Finance in Australia
Financial services buy certification because their own supervisors and their payment partners each ask for evidence, and because an outsourcing arrangement transfers the work but not the accountability.
What an organisation in this sector in Australia is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- PCI DSS — PCI DSS Compliance
- ISO 41001 — ISO 41001 Facility Management System
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 22301 — ISO 22301 Business Continuity Management System
- SOC — SOC 1 and SOC 2 Readiness
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Banking and Finance.
Choosing a certification body in Australia
A certification body is not a supplier of certificates. It is the organisation whose name sits beside yours, and whose accreditation decides whether the certificate means anything to the buyer in Australia who asked for it.
Accreditation is the first question and it has a local edge to it. A certificate is issued by a certification body, but the body is itself accredited by an accreditation body, and it is that second name the buyer's procurement team checks. Where an accreditation body is a signatory to the IAF Multilateral Recognition Arrangement, certificates issued under it are intended to be recognised in the other signatory countries — which is what matters if you are in Australia and selling abroad, or selling into Australia from outside it.
After that: sector competence, because an auditor who has audited your industry asks better questions and wastes less of your time; whether the party that triggered this names particular bodies, which is worth asking before you shortlist rather than after; and the diary and the travel, which in a market the size of Australia can decide the timetable more than the audit itself. Audit days are set by your headcount and scope, so quotes should be comparable — if one is far cheaper, look at the audit days before you look at the price.
Among the bodies most widely recognised, in no particular order: BSI, TÜV, SGS, SIS Certifications, Intertek, DNV, BVQI.
MSCi works with a pool of accredited certification bodies rather than one, and it is worth being plain about why that helps you: bodies differ in audit-day rates, in what it costs to get an auditor to your site, in how soon they can get one there, and in the sectors they are accredited for. Having several to approach means your scope goes to the ones that actually fit it and you get comparable quotes back, rather than taking the first number offered.
What it does not change is the audit. We cannot influence a finding and would not try — the body's independence is the entire value of the certificate, and a consultancy offering otherwise is selling something worthless. We prepare you so the audit is uneventful, and the body decides. Accreditation rules also prohibit the organisation that builds your management system from being the one that certifies it, which is why we prepare and never certify.
Where to start in Australia
The sequence below is the one that survives the audit. It is deliberately not "buy a set of documents", which is where most projects begin and the reason most of them take twice as long as they should.
- Find out precisely what has been asked for, and by whom. A tender in Australia naming a standard, a customer's security annex and a regulator's requirement are three different jobs.
- Fix the scope in writing — which sites in Australia, which activities, which products. Scope drives cost more than any other single decision, and widening it after the audit is booked is re-work.
- Score yourself against the standard with the free readiness assessment on this site, then have the gaps confirmed on evidence rather than on a questionnaire.
- Close the gaps in the work before closing them on paper. A procedure written to satisfy an auditor, rather than to describe what the people doing the job actually do, is the gap an auditor finds.
- Choose the certification body with the accreditation your buyer recognises, and book the audit against a date the closure plan can actually meet.
We work across Australia onsite, remotely and as a mix of the two, and the choice is usually decided by where your sites are rather than by preference.
Scroll inside the panel for the rest of it.
Free · 15 minutes · assured discount
Score your certification in Australia readiness out of 100
Answer the questions an auditor would ask and see where you stand before anybody quotes you a price.
States and territories we work across
Financial services, construction, government procurement and coal export infrastructure with heavy prequalification requirements.
Food manufacturing, healthcare, logistics and infrastructure projects with state contractor accreditation systems.
Coal, liquefied natural gas and mining services where operator safety prequalification controls all contractor access.
Iron ore, gas and resources projects with the most demanding contractor management regimes in the country.
Defence shipbuilding, wine, grain and mining, where defence supply chain and export buyer rules apply.
Federal government contracts where information security assessment and hosting conditions decide vendor eligibility.
Aquaculture, dairy and speciality food producers exporting to Asian and European buyers under scheme certification.
Gas processing, mining and remote construction with logistics, heat and emergency response challenges built into contracts.
Resources contractor prequalification and work health and safety duties
Mobilising to a Pilbara or Bowen Basin site means passing operator prequalification and then surviving audit. Operators examine risk management for specific high consequence tasks, fatigue management for fly in fly out rosters, journey and vehicle controls, contractor management of subcontractors, and evidence that investigations get to causes. Legal duties fall on officers personally in most jurisdictions. We help Australian contractors build work health and safety management that matches remote operations, with emergency and drill programmes that reflect distance from help, and internal audit that finds issues before an operator's audit team does.
Government contracts, food supply and environmental reporting
Selling technology or services to Australian government buyers means answering detailed questions on information security, data location and supplier risk before a contract is signed. Food manufacturers and primary producers face supermarket requirements for recognised scheme certification, with audit outcomes affecting listings. Larger energy users and emitters face reporting obligations that make measured energy and emissions data a compliance requirement rather than a sustainability nicety. We help organisations implement information security, food safety and energy management with the measurement and record keeping these obligations actually depend on.
Why bring in a consultant here
A date you can actually commit to
Knowing which parts of certification in Australia can be compressed and which cannot is the difference between meeting a tender deadline and explaining why you missed it.
Findings get closed, not logged
Most certification in Australia audits produce findings. What matters is whether they are closed with genuine corrective action or papered over, because the next auditor reads the last report first.
Surveillance never stops
A certification in Australia certificate is the start of a three year cycle, not the end of a project. Building for the surveillance audits from day one costs far less than rebuilding before each one.
Template packs fail on contact
Downloaded certification in Australia documentation describes a company that does not exist. Staff do not recognise the process, records never get made, and the gap shows up on audit day.
What clients in Australia say
Every engagement above ended with an independent assessor, not with us. We prepare you for the audit; the certificate is granted by an accredited body, and that separation is what makes the preparation worth paying for.
Each of these letters was written after the audit was passed, not before it was booked. Tell us your deadline and we will tell you honestly what reaching it takes.
Working to a deadline in Australia?
Tell us the date and what is being asked for, and we will tell you whether it is achievable before we quote.