Independent ISO certification body, UK-wide
Certification that stands up to scrutiny.
Hexa Certifications audits and certifies management systems against ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and seven more international standards, for organisations across England, Scotland, Wales and Northern Ireland.
- Impartial third-party audits
- Fixed three-year quotes
- All four UK nations
11
ISO standards certified
Quality to AI governance
4
UK nations covered
On-site audits nationwide
3-year
Certificate cycle
With annual surveillance
7
Certification services
Across 8 industry sectors
"We audit. We never consult on what we certify."
Our impartiality principle
Why organisations choose Hexa
A certificate is only worth the audit behind it.
Buyers, insurers and regulators rely on your certificate because they trust the process that produced it. We run that process with rigour, clear communication and no conflicts of interest.
- Impartial by design
- We never consult on the systems we certify. Audit and certification decisions are separated, and conflicts of interest are recorded and managed by an impartiality committee.
- Auditors who know your sector
- Audit teams are selected for competence in your technical area, from construction and manufacturing to software, healthcare and food.
- Fixed, transparent quotations
- Audit days are calculated from the accreditation rules and shown in your quotation. The price for the full three-year cycle is agreed before you start.
- Reports you can act on
- Clear findings with objective evidence and plain-English explanations, so your team knows exactly what was seen, what was missing and why it matters.
ISO certification services
ISO standards we certify
Hexa audits and certifies 11 international management system standards. Choose a standard to see what it covers and who it is for.
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Environment & Energy
ISO 14001:2026Environmental Management
ISO 14001:2026, published in April 2026 to replace the 2015 edition, specifies the requirements for an environmental management system. It helps an organisation identify the environmental aspects of its activities, products and services, understand its compliance obligations, and manage significant impacts through planning, operational control and evaluation. The standard takes a life cycle perspective, so organisations consider stages they can control or influence, such as purchasing, transport, use and end-of-life treatment, as well as their own sites.
- Supply chain and tender credibility
- Structured legal compliance
- Control of significant impacts
- Resource and waste efficiency
Health & Safety
ISO 45001:2018Occupational Health and Safety Management
ISO 45001:2018 sets out requirements for an occupational health and safety management system. Its aim is to prevent work-related injury and ill health and to provide safe and healthy workplaces. The standard places strong emphasis on leadership, the consultation and participation of workers, hazard identification and the hierarchy of controls. It replaced OHSAS 18001 and follows the Harmonized Structure, so it integrates readily with ISO 9001 and ISO 14001.
- Prequalification and tenders
- Worker involvement
- Systematic hazard control
- Clear legal oversight
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Environment & Energy
ISO 50001:2018Energy Management
ISO 50001:2018 specifies requirements for an energy management system (EnMS). It requires an organisation to understand how it uses and consumes energy, identify significant energy uses, set an energy baseline and energy performance indicators, and plan actions to improve energy performance. Unlike some other management system standards, ISO 50001 requires an organisation to demonstrate continual improvement in energy performance itself, not only in the management system.
- ESOS compliance route
- Measured energy performance
- Focus on significant uses
- Cost control
Resilience & Governance
ISO 22301:2019Business Continuity Management
ISO 22301:2019 specifies requirements for a business continuity management system (BCMS). It helps an organisation prepare for, respond to and recover from disruptive incidents when they occur. The core of the standard sits in clause 8, which requires a business impact analysis and risk assessment, business continuity strategies and solutions, documented plans and procedures, an exercise programme and evaluation of business continuity capability. It follows the Harmonized Structure and integrates with other management system standards.
- Evidence for customers
- Clear recovery priorities
- Tested plans
- Understanding dependencies
Sector-specific
ISO 22000:2018Food Safety Management
ISO 22000:2018 specifies requirements for a food safety management system for any organisation in the food chain, from feed and primary production through processing, storage, transport, retail and food service, as well as packaging and equipment suppliers. It combines the Harmonized Structure management system clauses with HACCP principles from Codex Alimentarius, prerequisite programmes (PRPs) and interactive communication across the food chain. The standard uses two linked Plan, Do, Check, Act cycles: one for the management system and one for operational hazard control.
- Structured hazard control
- Applies across the food chain
- Management system discipline
- Communication across the chain
Sector-specific
ISO 13485:2016Medical Devices Quality Management
ISO 13485:2016 specifies requirements for a quality management system where an organisation needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. It applies to manufacturers and to organisations involved in other stages of the device life cycle, such as design, distribution, installation, servicing, sterilisation and component supply. The standard places particular emphasis on risk management, process validation, traceability and regulatory reporting.
- Supports regulatory submissions
- Supply chain requirements
- Risk management throughout
- Validated processes
Information & Technology
ISO/IEC 20000-1:2018IT Service Management
ISO/IEC 20000-1:2018 specifies requirements for establishing, implementing, maintaining and continually improving a service management system (SMS). It covers the planning, design, transition, delivery and improvement of services to meet agreed requirements. Clause 8 sets out the operational processes, grouped into service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. The 2018 edition follows the Harmonized Structure, which allows integration with ISO/IEC 27001 and ISO 9001.
- Procurement credibility
- Consistent service delivery
- Clear service agreements
- Controlled change
Information & Technology
ISO/IEC 42001:2023Artificial Intelligence Management
ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) within an organisation that develops, provides or uses AI systems. It requires AI risk assessment, AI risk treatment and AI system impact assessment, considering effects on individuals, groups and society. Annex A provides reference controls covering areas such as AI policy, resources, impact assessment, the AI system life cycle, data and third-party relationships.
- Evidence of responsible AI governance
- Structured risk and impact assessment
- Clear roles and accountability
- Life cycle controls
Resilience & Governance
ISO 37001:2025Anti-Bribery Management
ISO 37001 specifies requirements for an anti-bribery management system. It helps an organisation prevent, detect and respond to bribery, whether by the organisation, its personnel or business associates acting on its behalf, and bribery of the organisation. Requirements include an anti-bribery policy, top management and governing body oversight, an anti-bribery compliance function, bribery risk assessment, due diligence, financial and non-financial controls, gifts and hospitality controls, and processes for raising and investigating concerns. The second edition, ISO 37001:2025, was published in February 2025.
- Supports adequate procedures
- Risk-based controls
- Due diligence on third parties
- Clear governance oversight
What we do
Certification services for every stage
- Initial CertificationIndependent Stage 1 and Stage 2 certification auditsLearn more
- Surveillance AuditsAnnual audits that keep your certificate validLearn more
- Recertification AuditsRenew your certificate for a further three-year cycleLearn more
- Certificate TransferMove an existing accredited certificate to HexaLearn more
- Integrated Management SystemsCombined audits for several ISO standardsLearn more
- Pre-assessmentAn optional readiness check before certificationLearn more
- Management System TrainingPublic awareness and internal auditor coursesLearn more
- Certificate VerificationConfirm a Hexa certificate is genuine and currentLearn more
The certification process
From first call to certificate, without surprises.
Every stage follows ISO/IEC 17021-1, the international standard for bodies certifying management systems. You always know what is next, who is coming and what they need to see.
- 1
Within 2 working days
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Readiness review
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
On site
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Independent review
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Three-year cycle
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Benefits
What ISO certification does for your organisation
Certification is more than a badge. Done well, it gives you a management system that keeps improving and a certificate that opens doors.
Qualify for more tenders
Answer pre-qualification questions on quality, environment, safety and security with independent evidence buyers accept.
Meet supply chain demands
Satisfy prime contractors and major customers who require certified suppliers, and spend less time on their audits.
Reduce risk and incidents
A system built on risk assessment and corrective action catches problems early, before they reach customers or people.
Work more efficiently
Defined processes, clear responsibilities and measured objectives cut rework, errors and wasted effort.
Stay on top of compliance
Certified systems require you to identify and evaluate legal obligations, which supports conversations with regulators.
Strengthen your reputation
Display a verifiable certificate that tells customers, insurers and investors your organisation is well run.
Audit planner
Get an indicative audit profile in seconds
Audit time is calculated from published accreditation rules, not guesswork. Move the slider to see the typical audit days for ISO 9001 at your size.
- Based on the IAF MD 5 quality management table
- Adjusted for complexity, sites and shifts in your quote
- Integrated audits can reduce combined time
- Initial certification
- 3days
- Stage 1 + Stage 2
- Each surveillance
- 1days
- Years 1 and 2
- Recertification
- 2days
- Year 3
Indicative only. Final audit duration is confirmed in your quotation after reviewing scope, risk, sites and shifts. Larger organisations are quoted individually.
Get my exact quoteIndustries
Audited by people who understand your work.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
Independent means no consultancy, no shortcuts and no conflicts.
Under ISO/IEC 17021-1, a certification body must not design, write or implement the management systems it certifies. Hexa keeps audit, review and decision-making separate, screens every auditor for conflicts of interest and publishes how complaints and appeals are handled.
- Decisions made by a reviewer independent of the audit team
- No auditor assigned to a client they advised in the previous two years
- An open, documented route for complaints and appeals
UK-wide coverage
Wherever you operate, our auditors come to you.
From London to Inverness and Cardiff to Belfast, we audit on site across the UK. Each location page explains how certification supports the local economy and its supply chains.
- England
- 62
- Scotland
- 7
- Wales
- 4
- Northern Ireland
- 4
- London
- Birmingham
- Manchester
- Leeds
- Glasgow
- Edinburgh
- Cardiff
- Belfast
- Bristol
- Liverpool
- Newcastle upon Tyne
- Sheffield
- Nottingham
- Southampton
- Cambridge
- Aberdeen
Standards update
What's changing in ISO standards
- Published April 2026ISO 14001:2026 environmental managementThe revised ISO 14001 is now available. Organisations certified to the 2015 edition keep their certificates during a transition period expected to run for about three years.Read more
- Published September 2026ISO 9001:2026 quality managementThe new edition of ISO 9001 has been released. Transition requirements are set by the accreditation community, and we will plan your transition audit around your existing cycle.Read more
- Transition completeISO/IEC 27001:2022 information securityThe transition from the 2013 edition ended on 31 October 2025. Certificates now reference the 2022 edition and its 93 Annex A controls.Read more
FAQs
ISO certification, answered
Clear answers to the questions we hear most often from organisations preparing for certification.
What does a certification body like Hexa actually do?
A certification body independently audits your management system against an international standard such as ISO 9001 or ISO/IEC 27001. If the system meets every requirement and works in practice, we issue a certificate and then carry out surveillance audits to confirm it continues to work. We are the independent third party, separate from you and from any consultant you use.
How long does it take to get ISO certified?
Most of the time is spent building and running your management system before the audit. Once your system has operated for a few months, with an internal audit and a management review completed, the Stage 1 and Stage 2 audits and the certification decision usually take six to twelve weeks from booking.
How much does ISO certification cost?
Fees are driven by audit duration, which depends on headcount, the number of sites, the standards in scope and the complexity and risk of your activities. Every Hexa quotation is fixed and itemised for the full three-year cycle, including Stage 1, Stage 2, both surveillance audits and travel, so there are no surprises.
Is the certificate valid for three years?
Yes. A management system certificate is valid for three years, provided you pass the surveillance audits held at least once each calendar year. Before the certificate expires we carry out a recertification audit to renew it for a further three years.
Can you write our management system for us?
No. Certification bodies must stay impartial, so we cannot design, write or implement the system we certify. You can build it yourself or with any consultant you choose. We can offer an optional pre-assessment that identifies gaps, without telling you how to fix them.
What happens if the auditor finds a nonconformity?
Nonconformities are graded as major or minor. You submit a root-cause analysis and corrective action plan, and for majors you also provide evidence the fix is effective before certification can be granted. Minors are normally verified at the next audit. Your auditor explains the process clearly at the closing meeting.
Can we certify several standards at the same time?
Yes. If your quality, environmental, health and safety or information security systems share processes, we can audit them together as an integrated management system. This usually reduces the total days on site and means one audit plan, one report and one point of contact.
Can we move our existing certificate to Hexa?
Yes. A valid certificate from another certification body can normally be transferred. We carry out a pre-transfer review of your current certificate, latest audit reports and any open nonconformities, then issue a certificate that keeps your existing cycle dates where possible.
Do audits happen on site or remotely?
Stage 2, surveillance and recertification audits are normally on site, because auditors need to see work being done. Some document review and Stage 1 activity can be carried out remotely where the scheme rules allow, which can reduce travel without reducing the quality of the audit.
Do you cover the whole of the UK?
Yes. Hexa audits organisations in England, Scotland, Wales and Northern Ireland, from single-site businesses to multi-site groups. Browse our location pages to see how certification supports organisations in your city and region.
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.