A consultant can facilitate scope definition, gap assessment, risk assessment, Statement of Applicability development, policy and procedure work, control implementation planning, internal audit preparation, and corrective-action tracking. The engagement should build internal capability rather than leave the organization dependent on the consultant.
Consultant vs. Certification Auditor
A consultant advises and supports the organization. A certification auditor evaluates conformity on behalf of a certification body. The consultant should not control the certification decision, and the certification body should protect its independence and impartiality. Clarify these roles before work begins.
