IAF ConsultancyISO certification is good for an IT business when the standard matches the risk the client is actually worried about. It is a poor purchase when the certificate is bought to win a bid and the system behind it does not exist. The question is not whether ISO is good. It is which standard, for which client, and whether the business can run the system after the auditor leaves.
What Does an IT Client Actually Worry About?
An IT business sells access, uptime, and trust. The client's worry depends on what is being handed over.
- A managed service provider holding client systems and data: the worry is security and who can reach what.
- A software shop delivering a project: the worry is whether the work is planned, tested, and handed over cleanly.
- A support desk: the worry is whether incidents are recorded and resolved, not just closed.
Each worry points to a different standard. Buying the wrong one produces a certificate that does not answer the question the buyer is asking.
Which Standard Fits Which IT Business?
ISO 27001 for security and data handling
ISO 27001 is the standard most IT buyers recognise when the contract involves client data, hosted systems, or access to another company's network. It asks the business to identify its information risks and show controls that address them. For a managed service provider, this is usually the standard that matters.
ISO 9001 for delivery and support quality
ISO 9001 fits a business whose client cares about consistent delivery: projects that finish, tickets that close, changes that are recorded. It is a quality management system, not a security standard. It does not answer a security questionnaire.
ISO 20000 for service management
ISO 20000 is built around IT service management. It suits a support or service desk operation where the client wants evidence that incidents, changes, and service levels are controlled. It overlaps with ISO 27001 but is not a substitute for it.
When Is Certification a Bad Buy?
- The client never asked for it, and no contract requires it.
- The business cannot name who owns the system after certification.
- The scope would be written so narrowly that it describes a department, not the service the client receives.
- The plan is to pass the audit and then stop maintaining records.
A certificate that is not maintained becomes a liability at the next surveillance audit. The cost does not end at the initial certification.
What Does an IT Audit Sample?
An auditor follows real work rather than reading policy documents in isolation.
- One client engagement, from contract or onboarding through delivery.
- One incident or security event, and how it was handled and closed.
- One change, and whether the record matches what was actually deployed.
- Access rights for a leaver or a new starter.
If those records do not exist, the audit finds it. The system has to be running before the audit, not written for it.
How Do You Start?
Certification with IAF Consultancy begins with an application. The offer names the scope, the days, and the price. Stage 1 reviews the documented system. Stage 2 samples the system in operation. When the audit supports certification, an accredited certification body issues the certificate. IAF Consultancy does not issue it. The sequence is described in how certification works.
For the standard-by-standard comparison, see which standard fits an IT business. The broader view is in how ISO certification helps businesses.