United Kingdom
ISO certification consultancy in the United Kingdom
UK certification demand is dominated by retailer power, regulated sectors and public procurement. Supermarket supply chains require recognised food safety scheme certification, and audit grades affect listings directly. Central government and NHS buyers assess suppliers on information security, and public tenders commonly require quality, environmental and safety certification alongside social value commitments. Offshore energy operators in Aberdeen run their own contractor safety approval. Manufacturers selling into both Great Britain and the European Union now manage two conformity marking regimes. Data protection is enforced actively, and modern slavery reporting duties have pushed larger buyers to audit their suppliers on labour practices.
- Nations and regions
- 8
- Priority standards
- 22
- Delivery
- Onsite, remote, hybrid
Standards most asked for in the United Kingdom
Organised by the sectors that drive certification in this market, because what you are asked for depends on the work you do. Every name opens the page for that standard or that industry.
Asked of every sector: ISO 9001.
Certification in the United Kingdom, sector by sector
Who asks for certification in United Kingdom
Almost nobody certifies because they woke up wanting to. In United Kingdom, as everywhere, the request arrives from outside: a customer's procurement pack, a tender condition, a regulator, or a parent company applying a group policy. Which of the four is asking changes the answer, because each wants something slightly different and each will accept something slightly different.
ISO 9001 is asked of organisations in United Kingdom whatever they do. Beyond that, what you are asked for depends on your sector, and the sections below set out what each of the industries that drive certification in United Kingdom is actually asked to hold.
What United Kingdom asks for that other markets do not
Most of what follows in this brief applies wherever you trade. These do not — they are specific to United Kingdom, and an organisation that has worked through an international standard elsewhere can still arrive here and find something it has never been asked for before.
- GDPR — GDPR Compliance
These sit alongside the international standards rather than replacing them, and they are usually the ones that hold up a launch, because they are the ones nobody planned for.
Automotive in United Kingdom
The tiers set the rules. A supplier's own standards matter less than the OEM's, and the OEM's requirements are written as a certification scheme with no room to negotiate.
What an organisation in this sector in United Kingdom is typically asked to hold:
- IATF 16949 — IATF 16949 Automotive Quality Management System
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
- ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
- GDPR — GDPR Compliance
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Automotive.
Manufacturing in United Kingdom
Supplier approval is where this starts. A plant that cannot show a system is one that gets audited by every customer separately, which costs more over a year than certification does.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- IATF 16949 — IATF 16949 Automotive Quality Management System
- BRC — BRC Global Standards
- CTPAT — CTPAT Supply Chain Security
The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.
More on this sector: Manufacturing.
Energy in United Kingdom
Energy-intensive operations certify because efficiency has become a reporting obligation as well as a cost line, and reported figures now attract the same scrutiny as financial ones.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO 50001 — ISO 50001 Energy Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO/IEC 17025 — ISO/IEC 17025 Testing and Calibration Laboratories
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 37001 — ISO 37001 Anti-Bribery Management System
Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.
More on this sector: Energy.
Oil and Gas in United Kingdom
This sector certifies because the operators demand it of their supply chain, and because the consequences of the incident that certification is meant to prevent are borne publicly.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- ISO 26000 — ISO 26000 Social Responsibility Guidance
- ISO 37001 — ISO 37001 Anti-Bribery Management System
- ISO 50001 — ISO 50001 Energy Management System
Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.
More on this sector: Oil and Gas.
Public Sector in United Kingdom
Accountability is the driver. A department can be asked to demonstrate how it protects information or maintains a service, and an answer that rests on individual diligence does not survive the question.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
- ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 22301 — ISO 22301 Business Continuity Management System
- ISO 26000 — ISO 26000 Social Responsibility Guidance
- ISO 41001 — ISO 41001 Facility Management System
The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.
More on this sector: Public Sector.
Transport and Logistics in United Kingdom
Cargo owners and their insurers ask how goods are handled, how drivers are managed and how the chain is secured. A logistics provider answers those questions on every tender, or once, with a certificate.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO 45001 — ISO 45001 Occupational Health and Safety Management System
- ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
- ISO 22301 — ISO 22301 Business Continuity Management System
- CTPAT — CTPAT Supply Chain Security
- ISO 22000 — ISO 22000 Food Safety Management System
- ISO 14001 — ISO 14001 Environmental Management System
The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.
More on this sector: Transport and Logistics.
Information Technology in United Kingdom
Nothing here is driven by a regulator. It is driven by the customer's procurement team: a security questionnaire before the contract, an annex naming a standard inside it, and a right to audit that somebody will eventually use. The certificate is what stops each of those becoming a three-week project.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- SOC — SOC 1 and SOC 2 Readiness
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
- ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
- GDPR — GDPR Compliance
- ISO 22301 — ISO 22301 Business Continuity Management System
These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.
More on this sector: Information Technology.
Telecommunication in United Kingdom
Carrier contracts and enterprise tenders in this sector both tend to name standards directly, and the interconnect agreements that sit underneath them assume a management system is already there.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
- ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
- GDPR — GDPR Compliance
- ISO 22301 — ISO 22301 Business Continuity Management System
- CMMI — CMMI Appraisal Readiness
The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.
More on this sector: Telecommunication.
Banking and Finance in United Kingdom
Banks, insurers and NBFCs carry two burdens: what the regulator requires and what the card schemes require, and the second is not optional for anybody who touches cardholder data. Certification is how both are demonstrated to somebody who will not take your word for it.
What an organisation in this sector in United Kingdom is typically asked to hold:
- ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
- PCI DSS — PCI DSS Compliance
- ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
- ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
- GDPR — GDPR Compliance
- ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
- ISO 22301 — ISO 22301 Business Continuity Management System
The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.
More on this sector: Banking and Finance.
Choosing a certification body in United Kingdom
A certification body is not a supplier of certificates. It is the organisation whose name sits beside yours, and whose accreditation decides whether the certificate means anything to the buyer in United Kingdom who asked for it.
Accreditation is the first question and it has a local edge to it. A certificate is issued by a certification body, but the body is itself accredited by an accreditation body, and it is that second name the buyer's procurement team checks. Where an accreditation body is a signatory to the IAF Multilateral Recognition Arrangement, certificates issued under it are intended to be recognised in the other signatory countries — which is what matters if you are in United Kingdom and selling abroad, or selling into United Kingdom from outside it.
After that: sector competence, because an auditor who has audited your industry asks better questions and wastes less of your time; whether the party that triggered this names particular bodies, which is worth asking before you shortlist rather than after; and the diary and the travel, which in a market the size of United Kingdom can decide the timetable more than the audit itself. Audit days are set by your headcount and scope, so quotes should be comparable — if one is far cheaper, look at the audit days before you look at the price.
Among the bodies most widely recognised, in no particular order: BSI, TÜV, SGS, SIS Certifications, Intertek, DNV, BVQI.
MSCi works with a pool of accredited certification bodies rather than one, and it is worth being plain about why that helps you: bodies differ in audit-day rates, in what it costs to get an auditor to your site, in how soon they can get one there, and in the sectors they are accredited for. Having several to approach means your scope goes to the ones that actually fit it and you get comparable quotes back, rather than taking the first number offered.
What it does not change is the audit. We cannot influence a finding and would not try — the body's independence is the entire value of the certificate, and a consultancy offering otherwise is selling something worthless. We prepare you so the audit is uneventful, and the body decides. Accreditation rules also prohibit the organisation that builds your management system from being the one that certifies it, which is why we prepare and never certify.
Where to start in United Kingdom
The sequence below is the one that survives the audit. It is deliberately not "buy a set of documents", which is where most projects begin and the reason most of them take twice as long as they should.
- Find out precisely what has been asked for, and by whom. A tender in United Kingdom naming a standard, a customer's security annex and a regulator's requirement are three different jobs.
- Fix the scope in writing — which sites in United Kingdom, which activities, which products. Scope drives cost more than any other single decision, and widening it after the audit is booked is re-work.
- Score yourself against the standard with the free readiness assessment on this site, then have the gaps confirmed on evidence rather than on a questionnaire.
- Close the gaps in the work before closing them on paper. A procedure written to satisfy an auditor, rather than to describe what the people doing the job actually do, is the gap an auditor finds.
- Choose the certification body with the accreditation your buyer recognises, and book the audit against a date the closure plan can actually meet.
We work across United Kingdom onsite, remotely and as a mix of the two, and the choice is usually decided by where your sites are rather than by preference.
Scroll inside the panel for the rest of it.
Free · 15 minutes · assured discount
Score your certification in the United Kingdom readiness out of 100
Answer the questions an auditor would ask and see where you stand before anybody quotes you a price.
Nations and regions we work across
Financial services, professional firms, technology and government contracting, where security and privacy assurance decide supplier selection.
Automotive assembly and components with carmaker supplier requirements and engineering quality expectations.
Chemicals, pharmaceuticals, food manufacturing and logistics serving national retailers and export customers.
Food processing, steel, energy and port operations, with retailer audits and industrial safety obligations.
Offshore oil and gas services, whisky, seafood and financial services, each with distinct audit regimes.
Agriculture, food packing, aerospace and pharmaceuticals supplying supermarkets and regulated export markets.
Aerospace, defence, nuclear supply chain and dairy processing with rigorous supplier qualification.
Automotive components, food processing and engineering, with Northern Irish exporters facing dual market requirements.
Retailer supply, food safety grades and dual market conformity
Selling to UK supermarkets means holding a recognised food safety certification and defending the grade at unannounced audits, where hygiene, allergen control, foreign body prevention, authenticity and traceability are examined line by line. Manufacturers of regulated products face a further complication since leaving the European Union, because goods sold in Great Britain and goods sold into the European market can require different conformity routes and documentation. We help organisations run food safety and quality systems that hold their grade, and keep product conformity files aligned to whichever markets they actually ship to.
Public sector contracts, offshore energy and data protection
Bidding for central government, local authority or NHS work means answering standard supplier questionnaires covering quality, environmental management, health and safety, carbon reduction commitments and information security. Offshore operators in the North Sea run separate contractor safety and competence assurance before mobilisation. Data protection enforcement means organisations holding personal data need demonstrable governance, not policies alone. We help UK organisations put together evidence that satisfies procurement, operator assurance teams and the regulator, with continuity and incident arrangements tested rather than assumed.
Why bring in a consultant here
Integration saves real money
If certification in the United Kingdom sits alongside other standards you hold, running them as one system means one document set and one audit rather than paying for the same work several times over.
Your team already has a day job
Running certification in the United Kingdom in house means taking your most capable people off revenue work for months. For most organisations that hidden cost is larger than the fee for doing it properly.
Someone has to own the detail
certification in the United Kingdom generates a large amount of small, unglamorous work. Left to whoever has a spare afternoon it drifts for months. Given an owner with a plan it takes weeks.
Self assessment is generous
Everyone marks their own certification in the United Kingdom homework kindly. An outside gap analysis tells you the uncomfortable part while it is still cheap to fix rather than three weeks before the audit.
Working to a deadline in the United Kingdom?
Tell us the date and what is being asked for, and we will tell you whether it is achievable before we quote.