Choosing an ISO 27001 Certification Body in Canada: Accreditation, Audit Days and Proposals

An ISO 27001 certification body in Canada should be accredited for information security management systems by an accreditation body that signs the IAF Multilateral Recognition Arrangement. In Canada that is usually the Standards Council of Canada. Check the accreditation, then compare proposals on audit days, auditor experience in your sector, the three-year fee, and how the body handles your locations.

Choosing a certification body looks like a procurement exercise, and it partly is. But the body you pick decides how many days your auditors spend on site, how hard they sample, which certificate logo your customers see, and who you will deal with for at least three years. This guide covers how to shortlist one and what a proposal should contain. TrazTech prepares companies for certification. We are not a certification body and we do not issue certificates.

Accredited, not just "certified": why it matters

Anybody can print a certificate. What makes an ISO 27001 certificate worth something to your customers is that the certification body has itself been assessed by an accreditation body, and that accreditation body is recognised internationally.

The chain works like this:

• The certification body audits you against ISO/IEC 27001 and issues your certificate.
• The accreditation body assesses the certification body against ISO/IEC 17021-1 (requirements for bodies certifying management systems) and ISO/IEC 27006-1 (the extra requirements for information security). The Standards Council of Canada's ISMS accreditation programme uses exactly these standards.
• The International Accreditation Forum (IAF) runs a Multilateral Recognition Arrangement. Accreditation bodies that sign it recognise each other's accreditations. SCC is listed as a signatory for ISO/IEC 27001 under the ISO/IEC 27006 sub-scope.

Because of the IAF arrangement, a certificate from a body accredited by another signatory, such as a US or UK accreditation body, is generally recognised in Canada too. You do not have to use a body accredited by SCC. You do have to use one accredited by an IAF signatory for ISMS, and you should confirm the specific scope covers ISO/IEC 27001.

An unaccredited certificate is not illegal, but a procurement team that checks will discount it, and many do check. You can look up accredited certificates in IAF CertSearch, the IAF's global database. Ask any body you are considering whether your certificate will appear there.

How to find an ISO 27001 certification body in Canada

Start from the accreditation bodies, not from search ads. SCC publishes a directory of the certification bodies it accredits, and other IAF signatories do the same. Filter for ISO/IEC 27001 in scope, then build a shortlist of three to four bodies that:

1. Hold ISMS accreditation from an IAF MLA signatory, with ISO/IEC 27001 in scope.
2. Have auditors who are available in your region or who can audit remotely where the rules allow it.
3. Have audited companies in your sector and of your size.
4. Can audit in the language your ISMS is written in. For Quebec companies, ask whether the audit can run in French.
5. Have transitioned to the current accreditation standard. ISO/IEC 27006-1:2024 replaced the earlier edition, and accreditation and certification bodies were required to complete that transition by 31 March 2026 under IAF rules, according to ANAB's transition notice.

What should a certification body's proposal include?

A proposal from a certification body is effectively the statement of work for the next three years. A good one lets you compare bodies line by line. Ask for these items, and treat a missing one as a question:

Item	What to look for
Scope statement	The organization, locations, products and services the certificate will name. It should match what your customers buy from you.
Audit days per stage	Separate figures for Stage 1, Stage 2, each surveillance audit and recertification. Ask how they were calculated.
Headcount basis	The number of people in scope used to size the audit. The 2024 revision of ISO/IEC 27006-1 widened who counts, including people outside your payroll who work within the ISMS.
Site coverage	Which sites will be visited, and whether any will be sampled.
Remote versus on-site	How much of the audit is remote and which parts must be in person.
Three-year fee	Every audit in the cycle, plus certificate, administration and travel charges.
Change terms	What happens to the fee if your headcount or scope changes during the cycle.
Nonconformity handling	Timeframes for corrective action and the cost of a special visit if one is needed.
Auditor profile	Who is likely to audit you and their experience in your sector.
Contracting entity	Which legal entity signs and under which jurisdiction's law.

The three-year view is the one that catches people. A low Stage 2 fee paired with high surveillance and recertification charges costs more over the cycle. Ask every body to quote the whole cycle so you compare totals.

How audit days are worked out

Audit time is not a number a sales rep picks. ISO/IEC 27006-1 requires certification bodies to calculate audit time based mainly on the number of people working under the organization's control within the ISMS scope, then adjust it for complexity: the number of sites, the business and regulatory risk, the technology in use, outsourcing, and how mature the ISMS is.

Two practical points follow. First, if two bodies quote very different days for the same scope, ask both to show their inputs. Usually one has a different headcount or site count than the other. Second, you cannot negotiate audit days below what the standard requires. A body that offers to cut them substantially without a reason grounded in the standard is offering something its accreditation body would question.

The certification cycle you are signing up for

ISO 27001 certification runs on a three-year cycle under ISO/IEC 17021-1:

1. Stage 1: the auditor reviews your ISMS documentation and readiness, and confirms the scope and plan for Stage 2.
2. Stage 2: the certification audit itself, testing whether the ISMS is implemented and effective. Certification follows once any nonconformities are addressed.
3. Surveillance audits: at least once a calendar year in years two and three, narrower than Stage 2. Our guide to preparing for an ISO 27001 surveillance audit covers what they focus on.
4. Recertification: before the certificate expires, a fuller audit that starts the next cycle.

Note that the transition from ISO/IEC 27001:2013 to the 2022 edition ended on 31 October 2025, so any new certificate today is to ISO/IEC 27001:2022. If a body quotes against the 2013 edition, it is out of date.

Questions to ask on the shortlisting call

• Which accreditation body accredits you for ISO/IEC 27001, and will our certificate carry its mark?
• Will our certificate be listed in IAF CertSearch?
• How many audits have you run for companies of our size and sector in the last two years?
• Who will lead our audit, and will the same lead auditor return for surveillance?
• How did you calculate the audit days, and what headcount did you use?
• Which sites will you visit, and will you sample any?
• What is the total fee over three years, including travel and administration?
• What does a special visit cost if a major nonconformity needs verification?
• Can the audit run in French?
• What is your process if we want to transfer to another body mid-cycle?

Picking the body before or after readiness work?

Pick the certification body once you have a clear scope and a realistic idea of when the ISMS will have operated long enough to show internal audit and management review results. Booking a Stage 1 date gives the project a deadline, which helps. Booking it before you know your gaps tends to produce a rushed Stage 1 and a long list of findings.

Most companies benefit from a gap assessment first. It sets the scope you will quote on, and it shows how far the ISMS has to travel. Our walkthrough of how to get ISO 27001 sets out the order of work, and what ISO 27001 costs in Canada covers the budget, including the certification body's share. If a single customer is driving this, read what to do when procurement wants an ISO 27001 certificate first.

Common questions about choosing an ISO 27001 certification body in Canada

Does my certification body have to be accredited by the Standards Council of Canada?

No. A body accredited for ISMS by any signatory to the IAF Multilateral Recognition Arrangement issues certificates that are generally recognised internationally, including in Canada. What matters is that the accreditation covers ISO/IEC 27001 specifically. Check the accreditation scope, not just the body's name, and confirm with key customers if they have a preference.

How do I verify an ISO 27001 certificate is real?

Look it up. Accredited certificates can be searched in IAF CertSearch, and the certificate should name the certification body, the accreditation body, the scope and the dates. You can also contact the certification body to confirm the certificate is current. A certificate with no accreditation mark and no searchable record deserves more questions.

Can a consultant who helped us prepare also certify us?

No. Certification bodies must be impartial, and ISO/IEC 17021-1 restricts them from certifying management systems they have consulted on. Your readiness partner and your certification body should be separate organizations with no shared commercial arrangement that would compromise that impartiality.

Can we switch certification bodies during the three-year cycle?

Yes, through a transfer. The receiving body will review your current certificate and recent audit reports before accepting it, and it generally expects the certificate to be valid with no open major nonconformities. Plan a transfer around a surveillance audit rather than in the middle of corrective action.

How many certification bodies should I get quotes from?

Three is a good number. Give each the same scope description, headcount, site list and target Stage 1 date so the audit days and three-year fees are comparable. Ask each to show how it calculated audit time, which makes differences easy to explain.