You can implement ISO 27001 without a consultant, and companies of ten to two hundred people do it every year. The audit fee is the same either way: for a 20-person company, roughly seven auditor days at €1,200 to €2,000 each, set by the certification body from ISO/IEC 27006 and not by who wrote your policies.

What changes when you go alone is your internal time, the judgement you have to absorb, and the risk that the first audit finds the things a first-timer does not know to look for. This page is the honest split, then the sequence, then the list of what people miss.

What a consultant is actually selling

What you are buying What it is
Scope Wrong in either direction is expensive.
A risk assessment that survives contact Not the register itself but a method an auditor accepts, applied consistently, with criteria you can defend when asked why a 3 is a 3.
Knowing what the auditor will ask This is experience and it is genuinely hard to get from reading.
Someone to argue with An outside view on whether a control is implemented or merely written down.

What a good consultant is actually selling

Not the documents. Policy templates are everywhere and a generated policy set gets you to roughly the same place. What a good consultant sells is judgement in four places, and it is worth naming them because they are the four places you have to supply it yourself.

Scope. Wrong in either direction is expensive. Too wide and you pay for auditor days covering systems no customer cares about. Too narrow and a customer's security team reads the certificate, sees that the product they buy is outside it, and rejects it. The scope statement is a paragraph; it is the most consequential paragraph in the whole system.

A risk assessment that survives contact. Not the register itself but a method an auditor accepts, applied consistently, with criteria you can defend when asked why a 3 is a 3.

Knowing what the auditor will ask. This is experience and it is genuinely hard to get from reading. It is the difference between passing Stage 2 and being told to come back in three months, and three months without a certificate is tenders you cannot bid and deals stalled at security review. That wait is the real cost of a failed round, far more than the fee.

Someone to argue with. An outside view on whether a control is implemented or merely written down.

If you have someone internal who has been through an audit before, you have most of this. If you do not, the sections below are where to get it, and where to buy a day of it.

The sequence, because out of order is where the time goes

  1. Scope and context (clauses 4.1 to 4.3). Which parts of the company, which locations, which systems, which customers' data. Interested parties and what they require. Write it down and have it approved.
  2. Policy and roles (clause 5). One information security policy, approved and dated, and named owners for the ISMS, the risk register and the internal audit.
  3. Risk assessment and treatment (6.1.2, 6.1.3). Your method, your criteria, your register, and a treatment plan that names a control for each risk you decided to treat.
  4. The Statement of Applicability (6.1.3 d). For each of the 93 Annex A controls: applicable or not, why, and whether it is implemented. This is the document the auditor reads first and the one a customer's security team asks for after the certificate.
  5. Implement and run (clause 8). The controls actually operating, producing evidence with dates.
  6. Measure, audit, review (clause 9). Monitoring results, an internal audit, a management review, all recorded.
  7. Certification audit. Stage 1 reviews the documents and readiness; Stage 2 tests that the system operates. Then a surveillance audit every year and recertification every three.

Steps taken out of order get redone. The most common version is writing policies before scope is settled, then discovering that half of them describe systems that are now excluded.

The two places to buy a day anyway

Going without a consultant does not have to mean going without help. Two specific things are worth buying by the day, and costly to get wrong.

The internal audit (clause 9.2). It has to happen before certification and the auditor must not audit their own work. In a ten-person company where the person who built the ISMS is the only one who understands it, that is genuinely hard, and it is the single most common reason people bring someone in for a day rather than a programme. A contracted internal auditor for one or two days a year is normal, accepted, and a day's work rather than a programme.

A Stage 1 rehearsal. An hour with someone who has sat on the auditor's side, walking your scope, your SoA and your risk method, before the real Stage 1. They will find the exclusion you cannot justify and the criteria you cannot explain. That hour is the most useful part of a consultancy engagement, and you can buy it on its own.

What first-timers miss

This is the list the reader is really here for. It comes from reviewing questionnaires and draft SoAs for small companies, and the same five things come up nearly every time.

Policies that exist but were never approved. A policy without an approver and a date is a draft, and a draft is a finding. Every policy needs a name and a date on it, and a review date after that.

Monitoring and logging described in the future tense. "We will centralise logs" is a gap. Controls A.8.15 and A.8.16 want logs that exist and are reviewed, with evidence that someone looked.

Suppliers listed but never assessed. Almost everyone can list their subprocessors. Almost nobody can show they assessed one before signing. Controls A.5.19 to A.5.23 want the assessment, the agreement, and the periodic review, dated.

"Not applicable" without a reason. In a customer questionnaire that is fine. In a Statement of Applicability an unjustified exclusion is a finding, and the justification has to be an argument, not a preference. "We are eight people and have no physical office" is an argument. "Not relevant" is not.

Evidence that operated once. A control that ran eighteen months ago is not operating. Auditors sample by date, and a screenshot from the month before the audit tells them exactly when the system was last touched.

Then the sixth, which is not a control but is the thing that decides whether the certificate survives its first year: the records stop after the audit. Certification is not the finish. Surveillance audits come every year and the auditor expects the register, the reviews and the evidence to have dates in between. Companies that certify successfully alone are the ones that kept records as they went rather than assembling them before each visit.

What will I miss? Read the register

The question underneath all of this is "what will I miss", and the honest answer is that any tool, template or consultant covers some clauses fully and others less so, and the difference is rarely written down. We wrote ours down.

The ISO 27001 coverage register lists every clause of the standard, what the product holds for it, and where an entry was only partly covered and has since been closed, in plain language, with the history kept. It exists because "what will I miss" deserves a list rather than a reassurance, and because a register that flattered us would not be worth reading.

Use it as a checklist whether or not you use the product. Every clause on it is a clause the auditor will ask about.

The cost that does not change

The audit. Auditor days come from the ISO/IEC 27006 tables by scope and headcount, so a 20-person company is around seven days whether a consultant was involved or not, at a day rate the certification body sets. The arithmetic, with worked examples. Doing it yourself changes your internal cost and the judgement you absorb. It does not change the audit fee, and anyone who tells you the software makes the audit cheaper is selling you the easy half.

The recommendation

Doing it yourself is a reasonable choice, particularly if someone internal has done it before or the scope is small. Doing most of it yourself and buying the internal audit and a Stage 1 rehearsal is what a lot of companies actually do, and it is the arrangement with the best ratio of judgement bought to money spent. Hiring a full engagement is reasonable when nobody internal can own it and the certificate is blocking revenue now.

What is not reasonable is deciding based on the software. No tool replaces the four judgements above. What a tool should do is make the recurring half survivable: policies with dates and owners, evidence collected on a schedule from the systems where it already lives, an SoA that is a living document, and a calendar that does not go quiet between the certificate and the first surveillance visit.

Records that are complete, dated and unmodified on the day the auditor asks for them. That is the whole job, and it is a year-round one.

Sources

  • ISO/IEC 27001:2022, clauses 4 to 10, 6.1.3 d) (Statement of Applicability), 9.2 (internal audit; objectivity and impartiality), Annex A controls 5.1, 5.19 to 5.23, 8.15, 8.16.
  • ISO/IEC 27006-1:2024, Annex C (audit time), via How many auditor days does ISO 27001 take.
  • ISO/IEC 17021-1:2015, clause 9.6 (surveillance at least once a calendar year; recertification cycle).
  • The "what first-timers miss" list: the method in our free questionnaire review, applied to small-company SoAs and questionnaires.