An ISO consultant in Malaysia is an advisory service that helps a company build and implement a management system, while a certification body is an independent, accredited organization that audits that system and formally issues the ISO certificate — and the two roles are kept structurally separate specifically because a party that helped design a system cannot credibly also judge it. This separation is not an informal industry convention; it is written directly into the international standard, ISO/IEC 17021-1, that governs how certification bodies must operate, and Malaysia's own accreditation framework enforces it through the Department of Standards Malaysia. This article breaks down exactly what each party does, why the line between them cannot be blurred, and how Malaysian companies should structure their relationship with both.

What Is the Core Difference Between an ISO Consultant and a Certification Body?

The core difference is that an ISO consultant provides advisory support to help a company design, document, and implement a management system, while a certification body is an independent third party that audits the finished system against the relevant ISO standard and issues a certificate confirming conformity. ISO/IEC 17021-1, the international standard governing certification bodies, formally classifies this kind of independent audit as third-party conformity assessment, distinct from first-party assessment (a company evaluating itself through internal audit) and second-party assessment (a customer evaluating its supplier) — with third-party certification carrying the most credibility precisely because of that independence (The ANSI Blog, 2026).

A consultant, by contrast, has no accreditation requirement and no formal conformity-assessment role; their relationship with a client is a commercial advisory engagement, similar to hiring any other business consultant. This means a consultant can be as involved as a client wants — attending meetings, drafting documents, training staff directly — in ways a certification body's auditor never can, since the auditor's entire value depends on maintaining distance from exactly that kind of hands-on involvement.

Can a Single Company Legally Offer Both Consulting and Certification Services?

A single company can offer both consulting and certification services under different divisions in principle, but not to the same client for the same certification, and in practice most accredited certification bodies avoid offering consulting at all, since ISO/IEC 17021-1 requires that a certification body be responsible for the impartiality of its conformity assessment activities and not allow commercial, financial, or other pressures to compromise that impartiality (European Accreditation, 2018). Many potential certification bodies that also perform consulting work struggle to pass this impartiality requirement during their own accreditation review, which is why so few accredited bodies attempt to offer both services simultaneously.

Why Does ISO/IEC 17021-1 Specifically Prohibit This Kind of Overlap?

ISO/IEC 17021-1 prohibits this overlap because a certification body's core value to the market rests on the assumption that its audit is not influenced by any financial stake in the client's success — allowing a certification body to also sell consulting services would create exactly the kind of conflict of interest the standard is designed to eliminate. The standard specifically requires certification bodies to have a process to identify, analyze, evaluate, treat, monitor, and document risks related to conflicts of interest arising from their relationships on an ongoing basis, consulting with a balanced range of interested parties rather than allowing any single interest to dominate (International Accreditation Forum, n.d.).

This requirement replaced an earlier approach in previous versions of ISO/IEC 17021 that relied on establishing a dedicated internal committee to safeguard impartiality, reflecting how seriously the accreditation community treats this particular risk (International Accreditation Forum, n.d.). A certification body found to be providing consulting-like services to its own certification clients risks losing its accreditation entirely, which is a considerably more severe consequence than a single failed audit.

Does This Mean a Certification Body's Auditor Can Never Offer Any Advice During an Audit?

An auditor conducting a certification audit can identify nonconformities and explain what the standard requires, but cannot tell a company specifically how to fix a problem or design a solution, since doing so would cross from objective assessment into the kind of advisory role that compromises impartiality. This distinction — pointing out a gap versus prescribing the fix — is a genuine, practiced skill among competent auditors, and it is precisely the boundary a consultant exists to work on the other side of.

How Does Malaysia's Accreditation Structure Enforce This Separation?

Malaysia enforces this separation through the Department of Standards Malaysia, which serves as both the country's National Standards Body and its National Accreditation Body, providing credible standardization and accreditation services recognized for global commerce (Department of Standards Malaysia, n.d.). As Malaysia's national accreditation body, Standards Malaysia is itself a signatory to the International Accreditation Forum's mutual recognition arrangements, meaning certification issued by a Standards Malaysia-accredited body is recognized internationally on the same basis as certification issued in other IAF member countries.

This creates a clear chain of accountability: the International Accreditation Forum sets the overarching framework for accreditation body recognition, the Department of Standards Malaysia accredits specific certification bodies operating in the country against standards including ISO/IEC 17021-1, and those accredited certification bodies then audit and certify individual companies. A consultant sits entirely outside this chain, since consultants are not accredited by Standards Malaysia and do not need to be, given that their role carries no formal conformity-assessment authority.

Are International Certification Bodies Operating in Malaysia Held to the Same Standard as SIRIM QAS?

Yes, international certification bodies operating in Malaysia — such as SGS, TÜV SÜD, Bureau Veritas, or BSI — are held to the same ISO/IEC 17021-1 impartiality requirements as SIRIM QAS International, regardless of whether their Malaysian operations are accredited directly by Standards Malaysia or by an equivalent recognized accreditation body such as UKAS, IAS, or JAB in their home jurisdiction. The specific accrediting body may differ, but the underlying impartiality and competence requirements these certification bodies must meet are internationally standardized rather than varying by market.

What Specific Services Does an ISO Consultant Provide That a Certification Body Cannot?

An ISO consultant such as Wellkinetics provides gap analysis, documentation drafting, staff training, and hands-on implementation guidance — services a certification body is structurally prevented from offering to its own certification clients. A consultant can sit alongside a company's team while writing quality procedures, actively coach internal staff through their first internal audits, and directly advise on how to correct a specific weakness identified during a mock audit, none of which a certification body's auditor can do without compromising the credibility of the eventual certification decision.

This distinction matters practically because most Malaysian companies pursuing ISO certification for the first time need exactly this kind of hands-on guidance, not simply an assessment of whether they meet the standard. A consultant's engagement is judged by whether the company successfully builds a working management system; a certification body's credibility is judged by whether its audit conclusion is trustworthy and independent, regardless of whether the company passes or fails.

Can a Consultant Also Serve as a Company's Internal Auditor?

A consultant can help train a company's staff to become internal auditors, and can even assist with conducting internal audits during the implementation phase, but this internal audit role remains distinct from the external certification body's independent audit — internal audits are a first-party activity performed by or on behalf of the organization itself, while the certification body's audit is a genuinely independent third-party assessment. A company should still ensure its internal auditors, even if trained by an external consultant, maintain some independence from the specific processes they audit within the organization, consistent with good internal audit practice generally.

How Do Malaysian Companies Typically Structure Their Relationship With Both Parties?

Malaysian companies typically engage an ISO consultant first, working through gap analysis, system design, documentation, and staff training over a period of several months, before separately selecting and engaging an accredited certification body to conduct the formal Stage 1 and Stage 2 certification audits. The consultant and certification body operate as two entirely separate contractual relationships, each billed independently, with the consultant's engagement typically concluding once the certification body issues the certificate — though many companies retain consultant support afterward specifically to prepare for annual surveillance audits.

A well-run engagement keeps these two relationships clearly separated throughout: the consultant helps the company get ready, and the certification body independently judges whether that readiness meets the standard. Companies that blur this boundary — for instance, by asking their certification body's auditor informally for implementation advice during a pre-audit visit — risk compromising the very independence that gives their eventual certificate its credibility in the market.

What Happens if a Company Tries to Use the Same Party for Both Roles?

If a company attempts to use the same party for both consulting and certification, the resulting certificate carries meaningfully less credibility, and in a genuinely accredited certification process, the certification body itself would likely decline to proceed, since accepting such an engagement would violate its own accreditation obligations under ISO/IEC 17021-1. Sophisticated buyers, auditors of the certification body itself, and export market authorities increasingly scrutinize this kind of conflict, meaning a company attempting this shortcut risks having its certification challenged or rejected by parties relying on it later.

What Are the Common Points of Confusion Between These Two Roles?

The most common point of confusion is companies assuming that hiring a well-regarded consultant guarantees certification, when in fact the certification body's audit remains a genuinely independent assessment that can still identify nonconformities regardless of how thorough the preceding consulting engagement was. Some Malaysian companies, particularly first-time applicants, mistakenly treat the consultant's sign-off as equivalent to certification readiness, only to encounter unexpected findings during the certification body's actual Stage 1 or Stage 2 audit.

A related confusion arises around marketing language, since some providers describe themselves ambiguously in ways that make it unclear whether they are offering consulting services, certification services, or both — a distinction Malaysian companies should clarify explicitly before engaging any provider, given how much the credibility of the eventual certificate depends on this separation being genuine rather than merely nominal.

What Are the Common Criticisms of How This Separation Works in Practice?

The most common criticism of the consultant-certification body separation is that it can create redundant cost and coordination overhead for smaller companies, who must manage two entirely separate relationships, contracts, and timelines rather than working with a single provider capable of guiding them from start to finish. Some critics argue that particularly for smaller, resource-constrained SMEs, this separation — while protecting audit integrity — adds complexity and cost that a more integrated (though less independent) single-provider model might reduce.

Defenders of the current structure argue that this cost is a reasonable price for maintaining the credibility that makes ISO certification valuable in the first place, since a certificate that could plausibly have been influenced by the same party that designed the system would carry far less weight with customers, regulators, and international buyers relying on it. The more balanced view is that the separation genuinely protects certification integrity, but Malaysian companies can still minimize coordination overhead by choosing a consultant experienced in liaising with certification bodies on a client's behalf, even though the two engagements remain contractually and organizationally distinct.

How Should a Malaysian Company Choose Both a Consultant and a Certification Body?

A Malaysian company should choose its ISO consultant based on industry-specific experience, transparent pricing, and a genuine track record of successful certifications, while choosing its certification body based on accreditation status — confirming it holds valid accreditation from the Department of Standards Malaysia or an internationally recognized equivalent — and on whether that certification body's international recognition matters for the company's specific export markets or customer requirements. These two selection processes should happen largely independently, since the consultant's suitability has no bearing on which certification body ultimately audits the company, and vice versa.

Companies exporting into markets where a specific certification body carries stronger local recognition may want to select their certification body somewhat earlier in the process, so their consultant can prepare documentation and evidence in whatever format that specific certification body's auditors are most accustomed to reviewing, even though the two relationships remain formally separate throughout.

Conclusion

An ISO consultant and a certification body serve fundamentally different, deliberately separated functions in Malaysia's ISO certification landscape — one helps a company build its management system, the other independently verifies it — and this separation is enforced not just by market convention but by the international standard, ISO/IEC 17021-1, that certification bodies must meet to remain accredited. Malaysian companies that understand and respect this boundary, engaging a genuinely independent consultant for implementation support and a properly accredited certification body for the audit itself, end up with a certificate that carries real, defensible credibility with customers, regulators, and international trading partners, rather than one whose independence could later be called into question.

References

• Department of Standards Malaysia. (n.d.). Standards Malaysia - DSM - IAF accreditation body. https://www.iafcertsearch.org/accreditation-body/be39a7c9-3a78-5157-a96e-1aadf7fb3ff5
• European Accreditation. (2018, September). Certification Committee: EA/CC FAQs. https://european-accreditation.org/wp-content/uploads/2018/10/eacc-faq.pdf
• International Accreditation Forum. (n.d.). Accreditation Auditing Practices Group guidance on auditing a CAB's conformity to ISO/IEC 17021-1 Clause 5.2.3. https://committee.iso.org/files/live/sites/tc176/files/documents/Accreditation%20Auditing%20Practices%20Group%20docs/AAPG-Auditing_ISOIEC_17021-1_Clause_5.2.3.pdf
• The ANSI Blog. (2026, June). ISO/IEC 17021-1:2015 — Requirements for certification bodies. https://blog.ansi.org/anab/iso-iec-17021-1-2015-certification-bodies/
• Oxebridge Quality Resources. (2025, August). How to implement ISO 17021 for a certification body. https://www.oxebridge.com/emma/how-to-implement-iso-17021-for-a-certification-body/
• SIRIM QAS International. (n.d.). Achieve excellence with ISO 9001 quality management system. https://www.sirim-qas.com.my/service/iso-9001-quality-management-system-qms/