Auditor-led ISO consultancy: implement the system, then keep it alive

A lot of UK businesses buy ISO as a project. Templates arrive, a consultant fills folders, the certification body visits, the certificate goes on the wall, and twelve months later nobody can find the last management review.

That pattern is expensive. Surveillance audits do not care how hard the original project felt. They care whether the system still works.

What auditor-led means in practice

Auditor-led consultancy starts from how an IRCA auditor actually looks at a business, not from a generic documentation pack.

That means:

• Scope and processes that match how you really operate


• Risk thinking that is specific to your work, not copied from another sector


• Evidence trails a Stage 1 and Stage 2 visit can follow


• An internal audit and management review cycle that already ran before the CB arrives


• A plan for year two, not only for certification day

The goal is not a thicker folder. It is a system your people can run without calling the consultant every Friday.

Implement first, then keep it alive

Implementation is the expensive part if you do it twice. Getting ISO 9001, 14001, 45001, 27001, or 42001 across the line once is hard enough. Doing it again after a weak surveillance visit is worse.

Keeping the system alive is the quieter half of the job: competency records that stay current, CAPA that actually closes, supplier and asset evidence that matches the kit on the floor, and dry runs before the CB returns.

A structured pre-audit dry run in half a day finds more than months of passive document review, because it copies the auditor’s method rather than the checklist.

Where human consultancy ends and the living platform starts

TAC’s job is human implementation and audit support. Someone who has sat the other side of the table, who can challenge weak evidence before the CB does, and who will not pretend a template pack is a management system.

Once the system needs a permanent home for documents, registers, audits, and CAPA, we recommend PICMS as the living platform. Consultancy builds the system. The platform keeps the evidence organised so it does not scatter back into inboxes and shared drives.

Those are separate brands on purpose. You get auditor-led support from TAC, and software from PICMS when you are ready for it. Neither replaces the certification body.

Who this is for

UK SMEs and consultants who want ISO work that survives surveillance, not just Stage 1 paperwork. Construction, diving, cyber, and multi-standard scopes are the usual reasons people call, but the method is the same: implement properly, then keep it alive.

Next step

If you are heading for first certification, a multi-standard scope, or a surveillance visit you are not confident about, talk to TAC. We will tell you plainly whether you need implementation support, a dry run, or both.