ISO 9001 consulting is often sold as a document package. The work that decides whether you pass is gap assessment, internal audits and a mock audit. Here is how to tell the two apart.
By Onega Ulanova · 8 min read · Topics: ISO 9001, Consulting, Certification, Internal Audits
There are two kinds of ISO 9001 consultants. One sells you a documentation package and leaves. The other builds a system your own people can run, audits it against the standard before the registrar does, and hands you the findings while you can still fix them. The price is often similar. The audit outcome is not.
What does an ISO 9001 consultant do? An ISO 9001 consultant assesses your operation against ISO 9001:2015 clause by clause, defines the scope and process map, writes documented information that matches how you actually work, sets up risk-based planning and objectives, runs an internal audit cycle and management review, and performs a mock certification audit so findings are closed before the registrar arrives. A consultant cannot issue a certificate; certification comes only from an accredited certification body, which must remain independent of the consulting work.
Key takeaways
The deliverable that matters is a working system with records, not a folder of procedures.
A gap assessment against every clause should come first and should be written down.
Internal audit (clause 9.2) and management review (clause 9.3) are mandatory inputs before certification and are where unprepared companies fail.
A mock audit run the way a registrar runs it is the single highest-value item in a consulting scope.
Ask for the consultant''s auditor credentials, certificate number and the standards they have actually audited against.
Nobody can guarantee certification. Anyone who does is describing something other than an accredited audit.
The six things a consultant should actually deliver
Gap assessment. A clause-by-clause read of what exists, what is missing, and what must change, with the effort estimated. Without this, everything after it is guesswork.
Scope, context and process map. Clauses 4.1 to 4.4. Your scope statement, interested parties, and the interaction of your processes with their inputs, outputs, owners and measures.
Documented information that matches reality. Procedures written from how your shop actually works, so operators recognize them. Generic templates are the leading cause of findings, because the audit compares practice to the document you wrote.
Risk-based planning. Clause 6.1 risks and opportunities tied to processes and objectives, not a spreadsheet parked next to the manual.
Internal audits. A full internal audit cycle by a competent auditor, with findings that become corrective actions and evidence of effectiveness (clauses 9.2, 10.2).
Management review and mock audit. A real management review with the required inputs, then a mock certification audit graded the way a registrar grades it.
Deliverable to evidence, clause by clause
Deliverable ISO 9001:2015 clause Evidence the auditor will ask for
Gap assessment Project input, not a clause Written assessment and the closure of each gap
Scope, context, process map 4.1 to 4.4 Scope statement, interested parties, process interactions with owners
Documented information 7.5 Controlled, current procedures that match observed practice
Risks and objectives 6.1, 6.2 Risk register linked to processes, measurable objectives with progress
Competence 7.2 Competence records for people performing work affecting quality
Internal audit 9.2 Audit program, reports, findings, closure and effectiveness checks
Management review 9.3 Minutes covering every required input, with decisions and actions
Corrective action 10.2 Root cause, action, verification of effectiveness
Why internal audits are the pivot point
Certification auditors sample. They pick a job, a supplier, a nonconformance, a calibration record, and follow it. An internal audit program run properly is the same activity performed by your side first. Companies that pass on the first attempt almost always did one complete internal audit cycle, closed the findings and can show the effectiveness check. Companies that fail usually have an internal audit procedure and no audit records.
This is also why a consultant who is a certified lead auditor is worth more than one who is not. Auditing is a distinct competence from writing procedures, and it is the competence that predicts your outcome.
What a consultant cannot do
Issue a certificate. Only an accredited certification body can.
Audit you for certification after consulting for you. Independence rules forbid it.
Guarantee a pass. Anyone who guarantees certification is describing something other than an accredited audit.
Run your system permanently. If the system depends on the consultant, the first surveillance audit after they leave will show it.
Cost and timeline, honestly
For a small to mid-size manufacturer or distributor, expect a consulting engagement in the range of a few thousand dollars for a gap assessment and a defined project fee for full implementation support, plus separate certification body fees for the Stage 1 and Stage 2 audits and annual surveillance. Timeline from a standing start is typically four to six months of real work, and it can be compressed to about 120 days when leadership assigns a named owner and the evidence is captured as work happens rather than reconstructed later.
Two cost drivers dominate: how many sites and processes are in scope, and how much of the record keeping your team can carry themselves. Software matters here because the fee you pay a consultant to assemble evidence by hand is money spent once and lost.
Questions to ask before you hire
Are you a certified lead auditor, and against which standards? What is your certificate number?
How many certification audits have you personally participated in?
Will you run our internal audit and a mock audit, or only write documents?
What will our team own at the end, and how will you train them to own it?
Which of our processes will you observe on site or on video before writing anything?
What happens if we receive a finding after your engagement ends?
Warning signs
A quote that lists only documents, with no audit and no mock audit.
A guaranteed certificate, or a promise of certification in a few weeks.
The same manual delivered to every client, with your name in the header.
An offer to also be your certification auditor.
No auditor credential you can verify.
Do you need a consultant at all?
Not always. An organization with an experienced quality lead, disciplined record keeping and software that structures the standard can certify without external help. A consultant earns the fee in three situations: nobody in the building has been through a certification audit, the deadline is a customer requirement you cannot move, or a previous attempt produced findings you do not know how to close.
Frequently Asked Questions
What does an ISO 9001 consultant do?
They assess your system against ISO 9001:2015, define scope and process interactions, produce documented information that matches your operation, set up risk-based planning, run an internal audit cycle and management review, and perform a mock certification audit before the registrar arrives.
Can an ISO 9001 consultant certify my company?
No. Certification is issued by an accredited certification body that must be independent of your consultant. A consultant prepares you and can run internal and mock audits.
How much does an ISO 9001 consultant cost?
It varies with scope, sites and how much record keeping your team carries. Gap assessments are usually a small fixed fee; full implementation support is a project fee. Certification body audit fees are always separate.
How long does ISO 9001 certification take with a consultant?
Four to six months is typical, and roughly 120 days is achievable when leadership assigns a named owner and evidence is captured as work happens.
What credentials should an ISO 9001 consultant have?
Lead auditor certification from a recognized body such as IRCA, a verifiable certificate number, audit experience in your industry, and references from companies that passed certification.
Can a consultant also be our internal auditor?
Yes. ISO 9001 allows an external competent auditor to perform internal audits, and many small companies use one. The same person cannot then audit you on behalf of a certification body.
Do we still need a consultant if we use QMS software?
Software structures the standard and holds the evidence, which removes most of the assembly work. A consultant is still useful for the first certification audit, a fixed customer deadline, or closing findings from a failed attempt.
Sources
ISO 9001:2015, Quality management systems, Requirements
ISO 19011, Guidelines for auditing management systems
IRCA, auditor certification schemes
More reading
ISO 9001 consultant and IRCA-certified lead auditor
ISO 9001 explained
Certification-ready in 120 days
ISO 9001:2026 transition center
Free quality management gap checklist
QMS2GO is the audit-ready operating system for ISO 9001 manufacturers — documentation, registers, internal audits, CAPA, suppliers, production, and QuickBooks data in one connected quality management system. Manufacturing teams use it to build, run, and prove their ISO 9001 system without spreadsheets or scattered SharePoint folders.
Browse all articles · See the QMS software · Book a demo · Get a free ISO 9001 roadmap