ISO consultant and certification body directory

There are no firms listed here yet. This page explains what the directory will hold, why consultants and certification bodies are listed separately, and how to get your firm in it.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

The directory is empty. No firms have been listed, no listings have been claimed, and nothing has been verified, because we would rather say that than publish a page of scraped company names dressed up as a shortlist. If you came here for a list of firms to contact today, the honest route is the matching form, which goes to a person rather than a database.

What follows is what the directory is for, the distinction it enforces between consultants and certification bodies, how a listing works, and what to check before you shortlist anyone from any directory, including this one.

What the directory lists

Two separate sets of organizations, kept apart on purpose.

Consultants and readiness firms. Companies that help you build the management system: scoping, risk assessment, policy and procedure work, control implementation, internal audit, and getting you ready for the certification audit. This covers both ISO 27001 and ISO 42001 work, and the two are listed as separate capabilities because a firm with a decade of ISMS experience is not automatically equipped for an AI management system.

Certification bodies. The organizations that audit you and issue the certificate. There are far fewer of them than there are consultants, their accreditation status is a matter of public record, and the useful facts about them are different: which accreditation body accredited them, for which standards, whether they have Canadian auditors, and how far out their audit calendar is booked.

How listings work

Three states, and the badge on a listing tells you which one you are looking at.

Free listing. Any Canadian firm doing ISO 27001 or ISO 42001 work can be listed at no cost. A listing carries the firm name, the provinces or regions it serves, the standards it works on, and a short description. There is no payment involved and no placement to buy: paying does not move a firm up the page.

Unclaimed. A listing we created from public information that the firm has not confirmed. It is marked unclaimed so you know nobody at that company has checked it. Claiming a listing means someone with a company email address confirms the details and takes responsibility for keeping them current.

Verified. A claimed listing where we have checked the things a buyer would otherwise have to check themselves. For a consultant that means the firm exists as a registered Canadian business, the named people hold the certifications the listing claims, and the firm has completed work of the kind it says it does. For a certification body it means we have confirmed the accreditation on the accreditation body's own public register, for the specific standard. Verified is not a recommendation and it is not a quality ranking. It means the claims on the listing were checked against a source.

What a listing will look like

Both rows below are invented for illustration. The firms do not exist, the details are placeholders, and nothing here is a real company or a real credential.

How to choose from any directory

Directories are a starting point for a shortlist and a bad basis for a decision. Four things separate firms in a way a listing cannot show.

Ask who does the work. The person in the sales meeting is frequently not the person who will be in your risk workshops. Ask for the name and the background of the consultant who will actually be assigned, and ask how many ISO 27001 or ISO 42001 engagements they personally have run.

Ask what the deliverable is. A fixed-fee readiness quote can mean a set of policy templates emailed to you, or it can mean somebody sitting with your engineers until the controls are running. Both are sold with the same words. Get the deliverable list and the number of hours in writing, and ask specifically who writes the Statement of Applicability and who runs the internal audit.

Check the accreditation yourself for certification bodies. Do not take a body's word for it and do not take ours. Ask which accreditation body granted the accreditation and for which standard, then look it up on that accreditation body's public register. In Canada the national accreditation body is the Standards Council of Canada, and certificates from bodies accredited by its international peers are accepted here as well. For ISO 42001 this check matters more, because the pool of bodies accredited for that standard is small and still changing.

Ask about the scope they will recommend. A firm that proposes certifying your entire organization before asking what your customers are demanding is selling audit days. A narrow first scope covering the product that buyers ask about is usually the right first certificate, and the certification process page explains how scope drives the audit.

Adding your firm

Listings are free and we are building the first set now. If you are a Canadian consultancy doing ISO 27001 or ISO 42001 work, or a certification body accredited for either standard, send the firm name, the regions you serve, the standards you work on and a contact using the form, or write to [email protected] directly. Certification bodies should include the accreditation body and the scope of accreditation so we can check it against the public register before the listing goes up.

We will not list a firm that offers to both build and certify the same management system as though it were one service, and we will not publish a listing that claims accreditation we cannot find on a register.

Common questions