Why do professional services firms certify?
- Tenders and frameworks: one certificate replaces the security section of every bid, at a quality a questionnaire answer cannot match.
- Client trust: regulated clients increasingly require it contractually from firms with access to their systems and data.
- Questionnaire load: as my questionnaires guide explains, a certificate converts a hundred questions into an attachment.
- Discipline: joiners, leavers, associates and client-access hygiene are real risks in this sector; the ISMS makes them routine.
What is different about ISO 27001 in this sector?
People controls carry the weight. Screening, confidentiality terms, awareness and (above all) offboarding that actually revokes client system access are where consultancy audits succeed or fail (Annex A 6.1 to 6.6, 5.15 to 5.18). Auditors follow leavers through your systems, so make sure the trail is short and dated.
Client information needs handling rules people follow. Classification, approved transfer and storage channels, and restrictions on personal drives and messaging apps (5.10 to 5.14, 8.10 to 8.12). In a consultancy the policy is only real if partners model it on live engagements.
Key-person risk is an information security risk. When one expert holds the client relationship and all the working papers, continuity controls (5.29, 5.30) mean named deputies, a document repository someone else can restore, and handover records. Auditors ask about this more often than firms expect.
Your own suppliers mirror your clients' questions. The accounting platform, CRM, IT support provider and any subcontracted delivery all need proportionate assurance: the same diligence your clients apply to you, one level down.
What is the route to certification for a consultancy?
- Scope by service line, agreed with the partners whose clients will rely on it.
- Gap analysis focused on people, client-information handling and associate controls.
- Risk assessment run with practice leads, using real engagement scenarios.
- Slim policy set written around how engagements actually run, including client-site work.
- Evidence period: access reviews per engagement, closure checklists, supplier checks.
- Internal audit, management review, then Stage 1 and Stage 2.
A consultancy of up to about 50 staff usually sits in the smallest implementation band, and my UK cost guide has the figures. My small business guide covers the proportionate approach in more detail, and firms that would rather not build internal ISMS capacity often keep the system running afterwards through virtual CISO services.
For how this ran in practice, I have written up my implementation of ISO 27001 at Lean Tree, the employee-owned digital transformation consultancy.