Software versus consultancy alone
A consultant brings judgement. Software brings continuity. The failure mode of consultancy alone is a certified system nobody can operate a year later; the failure mode of software alone is a well-structured system built on the wrong scope.
What each is genuinely good at
Consultancy is strongest where interpretation matters: setting scope, deciding what risk appetite means in your business, arguing an Annex A exclusion, preparing people for an audit conversation. Software is strongest where repetition matters: keeping ownership visible, chasing evidence, mapping one control to several standards, producing the same reliable export in month one and month thirty.
| Consideration | Consultancy only | Software, with advisory where needed |
|---|---|---|
| Interpretation and judgement | Strong — experienced human decision | Guided templates plus advisory support when wanted |
| Speed to first certificate | Often fast, driven by the consultant | Comparable when the team engages with the work |
| Where records live | Documents produced during the engagement | Linked records owned by your organisation |
| After the engagement | Maintenance falls to whoever is available | Owners, reminders and review cycles continue |
| Surveillance audits | Frequently a fresh scramble, sometimes re-engaged | Current position exportable at any time |
| Adding a second standard | A new engagement | Mapping onto the existing control set |
| Answering buyers between audits | Manual, from documents | From the same controls and evidence |
| Cost shape | Project fee, repeated when help is needed | Published subscription, advisory bought only as required |
The combination most SMEs end up with
Buy judgement where it is genuinely needed — scope, risk method, audit preparation — and keep the operating system in one place your own team can run. If you want that judgement from us, it is set out on consultancy and advisory; if you would rather bring your own adviser, the consultant workspace is designed for exactly that.
Deciding how to run it
Where spreadsheets hold up, and where traceability breaks.
One register across standards, or one system per standard.
What each approach leaves behind after certification.
Scope, configuration effort and who actually operates it.
Answers buyers, procurement and auditors want
Can a consultant get us certified without software?+
Yes, and many do. Certification requires records and a working system, not a platform. The question is who maintains those records after the engagement ends.
Can software replace a consultant?+
Not entirely. Software structures the work and keeps it current; it cannot make judgement calls about scope, risk appetite or how a requirement applies to your business. Some organisations have that judgement in house, others buy it in.
Does iso-standard.app certify organisations?+
No. Certification is awarded independently by an accredited certification body following its own audit. We prepare and evidence the management system behind that audit, and offer separate advisory support if it is wanted.
See how your existing risks, controls and evidence could become one integrated management system
Bring what you already have — a part-finished risk register, a folder of policies, last year's audit findings — and see it mapped across the standards you need.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.