Choosing
Doing certification in-house: when it works and when it does not
Nothing about a management system requires a consultant. The question is whether the people who would build it have the time and the pattern knowledge.
Facts checked — 2026-09-11
When does doing certification in-house work?
In-house works when somebody senior can give it sustained attention, when there is appetite to read the standard properly, and when the deadline is soft. The cost is not the standard’s difficulty — it is the months of a senior person, and the two or three expensive detours that pattern knowledge would have avoided.
It works badly when a date is fixed and unfamiliar, because the expensive mistakes in these programmes are scoping errors and evidence errors, and both are discovered late. Whoever runs it, the requirement is the same: the system has to be operated by your team afterwards.
The bottom line
If the deadline is soft, in-house is a genuine option. If it is fixed and this is your first time, the risk is in the scoping, not the writing.
Related services
ISO/IEC 27001 — Information Security Management
Build an information security management system that survives Stage 2 — and the three years of surveillance that follow.
Related insights
Choosing
SOC 2 Type 1 or Type 2: which one to get, and what each can evidence
A blocked contract argues for a Type 1. Very little else does — and the minimum period you have been told about is not a rule.
Choosing
SOC 2 or ISO 27001 first? A commercial question wearing a technical costume
Your pipeline decides this, not the frameworks — and the two produce very different things to hand a customer.
Choosing
Accredited and unaccredited certification are not the same product
Both produce a certificate. Only one carries independent oversight of the auditor — and it is checkable.