Walk into your ISO audit ready, with a system your teams run every day.
We help you prepare for recognised management-system standards: gap assessment, scope, documents, controls, training, internal review and audit readiness. The certification audit itself is carried out by an accredited certification body that you choose.
Why organisations adopt ISO standards
A management system is the set of roles, processes, records and reviews that keeps important work consistent. ISO standards give it a shape that customers and auditors recognise.
Meet customer and tender requests
Some customers and tenders ask suppliers for ISO certification or for evidence of a working management system.
Work the same way every time
Clear processes, owners and records mean less depends on one person, and new staff learn faster.
See and treat risks
One shared way to find, rank and treat risks across teams, sites and suppliers.
Keep improving
Internal audits, management reviews and corrective actions keep the system useful after the first audit.
Standards we support, by goal
Pick the goal that matters most to you. Several standards can share one system, so you do not need to start again for each one.
ISO 9001
Quality management: clear processes, consistent service, quality checks, customer feedback and corrective action.
ISO 14001
Environmental management: your environmental aspects and obligations, objectives, operating controls and records.
ISO 45001
Occupational health and safety: hazard identification, risk assessment, incident handling and worker consultation.
ISO 37001
Anti-bribery management: bribery risk mapping, due diligence, conflict-of-interest handling and reporting channels.
ISO 31000
Risk management guidance: risk criteria, owners, risk registers, treatment tracking and reporting to management.
ISO 22301
Business continuity: business impact analysis, continuity and recovery plans, and regular exercises.
ISO/IEC 27001 and 27701
Information security and privacy information management: scope, risk assessment, controls, evidence, rights handling and vendor reviews.
ISO/IEC 27017, 27018 and 42001
Cloud security and cloud privacy controls, and AI management: cloud responsibilities, personal data controls, an AI inventory and AI risk reviews.
ISO work and your DPDP Act work
Data privacy is our main focus, and ISO/IEC 27001 and 27701 fit closely with it. Planned together, much of the same work serves both.
One set of records, two uses
- Maps of the personal data you hold and where it goes
- Risk assessments and the controls chosen to treat them
- Access control, logging and other security safeguards
- Vendor and processor reviews and contracts
- Incident and breach response procedures
Good to know
ISO certification and DPDP Act readiness each have their own checks. Planning them together saves repeat work and gives your teams one way of doing things.
See privacy servicesFrom first steps to certificate: who does what
Certification has four stages. We support you in three of them. The audit and the certification decision belong to the certification body.
Get ready
Gap assessment, scope, policies and procedures, controls, records and staff training.
You and FidelioraRun it and check it
Use the system in daily work for a period, then hold an internal audit and a management review.
You, with our supportCertification audit
An accredited certification body that you choose audits the system, usually in two stages, and decides on certification.
Certification bodyKeep it going
The certification body returns for regular surveillance audits. We help you fix findings and keep records up to date.
You, with our support
How we deliver
Understand your request
We review the request you send through the website, by email or in a meeting.
Define the scope
Which activities, sites, teams, assets, data and systems the system will cover, and what interested parties expect.
Find gaps and risks
We compare current practice with the standard and support risk assessment and treatment planning.
Write the documents
Policies, procedures, registers, templates, control lists and evidence trackers your teams will use.
Put controls in place
Practical changes across people, processes, technology, vendors and governance.
Train, review and improve
Staff training, internal review, management review, corrective actions and continual improvement.
Typical outcomes
Depending on the scope: a gap assessment, a defined scope, risk assessments, policies and procedures, implementation guidance, audit-ready evidence, internal audit and management review support, a certification-readiness review and ongoing maintenance support.
Common questions
Who issues the ISO certificate?
The accredited certification body you choose carries out the audit and decides on certification. We prepare you for it.
Can one system cover several standards?
Often, yes. Most ISO management-system standards share a common structure (the Harmonized Structure, set out in Annex SL), so one set of policies, reviews and internal audits can serve several standards.
Which standards can be certified?
We confirm this for your scope before work starts. ISO 31000 is guidance, so organisations use it but are not certified to it. ISO/IEC 27017 and 27018 give guidance on cloud controls and are usually assessed within the scope of an ISO/IEC 27001 certification. Since its 2025 edition, ISO/IEC 27701 can be certified on its own or together with ISO/IEC 27001.
Which standard should we start with?
Usually the one your customers or tenders ask for, or the one that covers your biggest risk. We can help you compare options during the first review.
How long does it take?
It depends on your size, scope and starting point, and on how long the system runs before the audit. The proposal sets out a timeline after we review your request.
Can you train our staff?
Yes. Awareness sessions for all staff and focused sessions for process owners and internal audit teams, scoped per engagement.
How the proposal is prepared
To prepare a suitable proposal, we review what you tell us in the proposal request form: what you need and when you would like to start, your organisation's size and country, which standards you need, the number of sites and staff in scope, the standards you already hold, what you are aiming for and your target date. Before we prepare it, we may ask about your systems, departments and current documents.
Opens the Contact Us page and its proposal request form.