Short reads on ISO certification.

ISO certification is not one audit. It is two, and each answers a different question.

Stage 1: is the system ready?
The auditor reviews your documented management system, confirms the scope and sites, and checks you are ready for Stage 2. Gaps found here can be fixed before Stage 2, which is why Stage 1 saves time and money.

Stage 2: does it work in practice?
The auditor tests how the system actually runs, through records, evidence and interviews with the people doing the work.

Then the decision.
A certification decision is made by someone who did not take part in your audit. That separation is what gives the certificate its weight.

After that, a surveillance audit in each of the next two years keeps the certificate current, and recertification renews it in year three.

See how the process works with us, step by step.

The 2025 edition of ISO/IEC 27701 changed one thing that matters to a lot of Australian organisations: it is now a standalone management system standard.

Until now, 27701 was an extension of ISO/IEC 27001. You could only certify your privacy program if you already held, or were getting, an information security certificate.

From the 2025 edition:

• It has its own management system clauses and its own privacy controls
• It covers PII controllers and PII processors
• ISO/IEC 27001 is no longer a prerequisite
• If you do hold 27001, both can still be audited together

Who this suits: software and cloud providers handling customer data, health and community services, and suppliers asked about privacy in tenders.

One thing certification does not do: it shows your privacy management system works. It does not confirm compliance with the Privacy Act.

Read the full explainer: ISO/IEC 27701:2025 explained.

Whether you are an IT provider answering security questionnaires or a healthcare organisation protecting patient information, a certificate is only as good as the audit behind it.

1. Independence. The body that certifies you should not have built your system. If the same firm wrote your policies and now audits them, the certificate proves very little.
2. The full three-year price. A certificate needs surveillance audits in years two and three, then recertification. Compare quotes on all three years, in writing.
3. Audit time. Audit days are set by international requirements based on headcount and complexity. A quote far below the others usually means fewer days of audit.
4. Sector experience. Ask who will audit you and what kinds of systems they know, such as cloud platforms, managed services or clinical information systems.
5. Acceptance. Confirm the certificate will meet the requirement of the customer, contract or tender that asked for it.

Warning signs:

• A guaranteed pass, or a certificate by a fixed date whatever the audit finds
• One company offering to write your system and certify it
• A consultant steering you to one certification body because it is "easier"

See what you can hold us to.

Audit & Certification Services is an Australian certification body. We audit and certify management systems against four standards:

• ISO/IEC 27001 – information security
• ISO/IEC 27701 – privacy
• ISO/IEC 42001 – AI management
• ISO 9001 – quality

We do one thing: certification. We do not write your policies, build your system or run your internal audits. Keeping that separation is what makes a certificate worth trusting.

How we work:

• You tell us your scope, sites and headcount.
• We confirm one fixed price for the full three-year cycle, in writing, before you sign.
• No sales call.
• Stage 1 and Stage 2 audits, then a certification decision made by someone who did not audit you.

Estimate your price or request a quote.