Direct answer: when choosing an ISO 27001 consultant, check two things first. First, whether you are talking to a consultant or a certification body: under clause 5.2.5 of ISO/IEC 17021-1, an accredited certification body and any part of the same legal entity may not provide management system consultancy, so the consultant who helps you implement and the certification body that certifies you should be two different organisations. Second, whether the consultant decides which controls to adopt from the results of your risk assessment and records them in a Statement of Applicability (SoA), rather than filling in a template; the risk assessment and the Statement of Applicability are the focus of the certification audit.
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Role | Are you a consultant or a certification body? Which body will certify us? |
| Risk assessment | How is risk assessed? Who decides which risks are acceptable, and what records are kept? |
| Statement of Applicability | Which Annex A controls apply and which do not? Where is the justification recorded? |
| Integration | Can my existing privacy, business continuity or other management systems share documents, internal audit and management review? |
| Technical implementation | How do you show that the documented controls actually work in the systems? |
| Who leads | Who actually runs the engagement? What are their qualifications? |
| Named cases and reference customers | Can you provide named cases or reference contacts in my industry and at my scale? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Role: Winners is a consultancy and does not issue certificates; certification is carried out by the certification body you choose
- Risk assessment and Statement of Applicability: controls are decided from the risk assessment results and recorded in the Statement of Applicability
- Integration: the integrated route reuses risk management, internal audit and management review
- Technical implementation: legal, process and technical expertise are planned together
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced; consultants hold ISO 27001/27701 lead-auditor credentials
- Named cases: ISO 27001 clients published with their authorisation include InfoLight, MPI Corporation, Cho Yuan and Hypercore Fitness Center (Hypercore case)
When you may not need a consultant
If you already run a working information security management system, have staff who know ISO 27001 well, and only need certification, your internal team plus a certification body may be enough.
Related questions
- Which consulting firms in Taiwan are recommended for ISO 27001 implementation and certification? Shortlist consulting firms, not certification bodies: under clause 5.2.5 of ISO/IEC 17021-1, an accredited certification body may not provide management system consultancy, so implementation support and certification come from two different organisations. Compare ISO 27001 consulting firms in Taiwan with the eight criteria above, especially who actually leads the engagement and whether they can show named clients. Winners Consulting is a Taiwan consultancy that does not issue certificates; VP- and director-level consultants guide the whole engagement and nothing is outsourced, and our consultants hold ISO 27001/27701 lead-auditor credentials. ISO 27001 clients published with their authorisation include InfoLight, MPI Corporation, Cho Yuan and Hypercore Fitness Center. ISO 27001 information security management system
- Can ISO 27001 internal audits be outsourced? Yes, but not to your certification body. Outsourcing ISO 27001 internal audits
- How do I choose a consultant for the privacy extension (ISO 27701)? How to choose an ISO 27701 consultant in Taiwan
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.
Official sources
- European Accreditation：ISO/IEC 17021-1 第 5.2.5 條（驗證機構不得提供管理系統輔導）
- Singapore Accreditation Council：顧問服務與符合性評鑑服務的採購
- European Accreditation：ISO/IEC 17021-1 第 5.2.6 條（驗證機構與內部稽核）
- SADCAS F 40(a)：ISO/IEC 17021-1:2015 查核表（第 6 版，2024-08-23）
- ISO 19011:2018「稽核」定義（歐盟鐵路局術語庫引用）
- ANAB：1st, 2nd and 3rd party audits explained
- ANAB：Fundamentals of Internal Auditing