Industries · Professional Services
ISO certification for professional services
ISO 9001, ISO/IEC 27001, ISO 37001 and ISO 22301 certification for law firms, accountants, consultancies and other professional service providers.
- ISO 9001 quality
- ISO 27001 information security
- ISO 37001 anti-bribery
- ISO 22301 business continuity
Overview
Certification for law, accountancy and consultancy firms
Professional services firms are increasingly asked to evidence how they manage quality, protect client information and prevent bribery. Corporate and public sector clients often include these topics in panel reviews and tenders, and ISO certification provides independent, recognised evidence that a firm's management system meets an international standard. This can shorten responses to due diligence questionnaires and support applications to client panels and public sector frameworks.
Information security is a common driver. Law firms, accountants and consultancies hold confidential and commercially sensitive data, and ISO/IEC 27001 offers a risk-based framework for protecting it. ISO 9001 supports consistent client service, while ISO 37001 helps organisations put proportionate anti-bribery controls in place, relevant to the Bribery Act 2010. ISO 22301 can add assurance that client work will continue through disruption such as a system outage or loss of premises.
Certification sits alongside professional regulation. Law firms remain regulated by the Solicitors Regulation Authority or the relevant regulator, and accountancy firms by their professional bodies. Lexcel, the Law Society's practice management standard, is a separate accreditation that Hexa Certifications does not provide. Many firms find that ISO certification complements these requirements. Auditors will expect the system to take account of professional rules as part of the firm's compliance obligations.
Recommended
- ISO 9001
- ISO 27001
- ISO 37001
Sector challenges
Where certification makes the difference
The pressures organisations in professional services face most often, and how a certified management system helps answer them.
Client confidentiality
Firms hold sensitive client data and must protect it against cyber attack, error and misuse, making ISO/IEC 27001 particularly relevant.
Panel and tender requirements
Corporate and public sector clients often ask for certified systems when appointing advisers to panels and frameworks.
Bribery and financial crime risk
Firms must consider their exposure under the Bribery Act 2010 and related legislation, which ISO 37001 helps address systematically.
Consistency across teams
Service quality must be consistent across partners, offices and practice areas, which is what ISO 9001 is designed to support.
Remote and hybrid working
Hybrid working changes how information is accessed and supervised, requiring clear controls and continuity arrangements.
Recommended standards
Standards most requested in professional services
Choose a standard to see what it covers. Several can be combined into one integrated audit.
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Resilience & Governance
ISO 37001:2025Anti-Bribery Management
ISO 37001 specifies requirements for an anti-bribery management system. It helps an organisation prevent, detect and respond to bribery, whether by the organisation, its personnel or business associates acting on its behalf, and bribery of the organisation. Requirements include an anti-bribery policy, top management and governing body oversight, an anti-bribery compliance function, bribery risk assessment, due diligence, financial and non-financial controls, gifts and hospitality controls, and processes for raising and investigating concerns. The second edition, ISO 37001:2025, was published in February 2025.
- Supports adequate procedures
- Risk-based controls
- Due diligence on third parties
- Clear governance oversight
Resilience & Governance
ISO 22301:2019Business Continuity Management
ISO 22301:2019 specifies requirements for a business continuity management system (BCMS). It helps an organisation prepare for, respond to and recover from disruptive incidents when they occur. The core of the standard sits in clause 8, which requires a business impact analysis and risk assessment, business continuity strategies and solutions, documented plans and procedures, an exercise programme and evaluation of business continuity capability. It follows the Harmonized Structure and integrates with other management system standards.
- Evidence for customers
- Clear recovery priorities
- Tested plans
- Understanding dependencies
How it works
Your route to certification
- 1
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
Professional Services: certification questions
Is Lexcel the same as ISO 9001?
No. Lexcel is the Law Society's legal practice quality mark for firms in England and Wales, with its own assessment process. ISO 9001 is an international quality management standard applicable to any organisation. Some firms hold both. Hexa Certifications certifies to ISO standards and does not offer Lexcel accreditation.
Why do law and accountancy firms seek ISO/IEC 27001?
Firms hold confidential client information and are attractive targets for cyber criminals. Clients, particularly in financial services and the public sector, increasingly ask advisers about their security arrangements. ISO/IEC 27001 provides an independently audited framework for managing these risks and answering such questions consistently.
Does ISO 37001 provide a defence under the Bribery Act 2010?
Section 7 of the Bribery Act 2010 provides a defence where an organisation had adequate procedures to prevent bribery. ISO 37001 certification can help show that procedures are in place, but it does not guarantee that a court would consider them adequate. Whether procedures are adequate depends on the facts of each case.
Can a small consultancy be certified?
Yes. Standards are designed to apply to organisations of any size, and audit time reflects headcount, scope and risk. A small consultancy can meet the requirements with a proportionate, lightweight system, and much of the audit may be suitable for remote delivery where appropriate.
Does certification affect our professional regulation?
No. Certification is voluntary and sits alongside regulation by bodies such as the Solicitors Regulation Authority, ICAEW or ACCA. It does not change your regulatory obligations. Your management system should, however, take account of those obligations as part of your legal and other requirements.
Should we also hold Cyber Essentials?
Many professional services firms hold Cyber Essentials as well as ISO/IEC 27001. Cyber Essentials certifies basic technical controls and is required for some UK government contracts involving certain types of information. ISO/IEC 27001 is broader, covering risk management and governance. Hexa Certifications does not issue Cyber Essentials certificates.
How do auditors handle privileged or confidential material?
Auditors do not need to read the substance of privileged advice. They sample records to confirm processes are followed, such as file opening, conflict checks, supervision and file review. Sensitive content can be redacted or viewed with you present, and all auditors are bound by confidentiality obligations.
Is ISO 22301 useful for professional services firms?
ISO 22301 helps firms plan for and recover from disruption, such as loss of systems, premises or key people. Clients with critical dependencies on their advisers sometimes ask about continuity arrangements, and the standard provides a structured, auditable approach that integrates well with ISO/IEC 27001.
Other industries we audit
All industries
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.