Implementing 27001 needs senior management commitment. Adopting these principles can be painful, if employees within the business see the senior management not following the principles and not leading by example then they will believe there is no point doing it themselves; it will be a case of them sitting and nodding their heads until you as the person implementing the system, run out of momentum and then everything will get shelved and forgotten. Equally even if you have your system already well established and in place, without visible and consistent support from leadership, the management system and its processes will lack authority. Without buy-in from management you also face issues with lack of resources being made available to implement/maintain the system and it will ultimately lack the strategic alignment needed to keep it going long term.

How you can avoid this

Make sure the business case for having ISO 27001 is established but also clearly and succinctly communicated to leadership. Know your market, if your senior management are all about brass taxes then bring it back to money, having 27001 may cost X but it opens Y markets and could potentially save you Z costs from being sued/fined for a data breach.

If you want to go further, demonstrate how it aligns with business goals such as regulatory compliance, customer trust, and operational resilience.

Building off the first pitfall, lack of support. Failing to embed the ISMS into your daily ops means that at an employee/staff level; if people aren’t interacting with the system regularly then they wont pick it up, use it or potentially even understand it. If people don’t understand why, you’ve put the system in place (or if they are just stubborn old mules!), then they are likely to also be resistant to that change; they might view it as an unnecessary extra burden that will just slow down their work during the day for little perceived gain.

Some companies like to treat ISO 27001 as a one-off project that they only need to think about once or twice a year; the result of that, security controls aren’t always maintained, compliance degrades fairly quick (but if you’re lucky you’ll find all those issues during your internal audits a week before your surveillance visit right?) and again people can also be resistant to adopting the system if it disrupts their routine and is then ‘only’ used during audits.

How you can avoid this

Daily beatings and public executions! I joke of course… no, the best way to avoid resistance to change is comprehension; teaching, training and helping people to understand why these processes are being put in place, then obviously also, maintaining their consistent use. Build information security into a core culture of the business, establish regular reviews, monitor key aspects of the system and provide updates about the system to all staff; get their buy-in, align it with other business processes or perhaps even as one of the metrics used in performance-based reward systems if you have that kind of thing in place.

Another pitfall that builds on the other two (you can see a trend amongst the biggest reasons, right?) is lack of awareness and training. People are often one of the biggest risks to information security. If employees aren’t aware of your policies, they don’t comprehend what is considered information/data they need to protect; or if they don’t know what to do in order to protect it then even the greatest technical controls in the world will fail.

How you can avoid this

Develop and implement awareness training that is comprehensive and structured; you also need to tailor this to your employees, their roles and responsibilities as well as their level of access to specific data and don’t just drop everyone infront of a 3-hour presentation covering you’re A-Z. A cleaner doesn’t need to know the finer points of secure code writing and peer review, but they do need to know about physical access control and securely destroying physical records (making sure paper records are shredded etc before just chucking them out) or making sure they don’t unplug the server so they can plug in the vacuum! Believe us, its happened before.

An easy mistake to make is underestimating the resource needs. Implementing and then maintaining the ISMS does require time, expertise and financial investment/commitment. Learning the standard and how it applies to your business, having the people with the correct knowledge and using their time and your own, etc. If you misjudge the demands it can lead to delays, overworked employees (and yourself) and ultimately subpar results.

How you can avoid this

Take a step back, slow your roll for a minute and try to develop a realistic project plan that covers staffing, training, tools and other stuff. Which, granted, is a lot easier said than done; like really, how do you plan a project if you’ve never done something like it before? Definitely a non-answer answer right. So personally, I’d say you should opt to use us, your friendly neighbourhood consultants! Asking someone with experience is a fantastic way of helping to gauge resource needs.

Internal audits are a key requirement of many ISO management systems not just 27001. But, it’s very easy to leave them till the last minute and end up often being rushed or treated as mere checkboxes. Without some genuine internal auditing and follow-up, problems can go unnoticed and your system will stagnate until you get slapped in the face with minor or major non-conformities at your surveillance visits.

How you can avoid this

Super easy, plan ahead and schedule in regular internal audits; do this as part of your annual financial / management planning at the start of each year and stick to it. OH and make sure you are using trained personnel ideally who are also as impartial as they can be to whats being audited (get someone from team/department A to audit team/dept. B, etc.). You should then also treat these findings as opportunities for improvement rather than failures, nobody likes being derided for failing. (we can also do internal audits for you instead if you want!)

This can be a fairly common mistake and it can be quite a nuanced skill to write and frame scopes for management systems; we help define scopes all the time for our clients so I’ve only seen a few of these situations in person. That being said, scoping down too narrow can miss critical systems or not accurately reflect the operations of your business. With accredited certifications you’ll get a certificate with the scope of your management system printed front and centre on it (if you want to know more about accredited certification we have another blog post here about it).

Equally, if you go too broad then it can become unmanageable and you’ll be auditing for weeks on end, both internally and externally! Basically, an improperly scoped ISMS leads to gaps in your systems coverage or excessive complexity.

How you can avoid this

Set aside some time to sit and think about what your company’s risks are (what your risk profile is) and what your operational needs are, consider your legal, contractual and stakeholder requirements and try to be as specific as possible about which parts of the organisation need to be included within your scope. Write your scope down, leave it for a while, come back and read it back or fire it around the office/other managers to see what other people think about it. (if you are implementing 27001 for a specific customer contract it might be worth getting clarity from them around what they are looking for the cert to cover)

Risk assessments are a foundational aspect of ISO 27001. However, many companies can wind up only doing superficial or generic assessments that don’t accurately reflect their real risks. As a result, your controls may be misaligned or irrelevant.

How you can avoid this

Break down your assessments to look at context-specific aspects of the business. Look specifically at just hardware, or just software, physical, people, etc. then talk them through with people from different teams / roles in the business to see if they have different risks they associate with those aspects. Use a consistent structure for how you score your risks; tie them back to the SOA within 27001 and ensure that risks are regularly reviewed and updated (build this into your internal auditing schedule!).

Documentation is an important component of ISO 27001; within the standard there are sections that state “‘X’ shall be available as documented information”. However, overemphasising it at the expense of actual implementation is a big pitfall, especially with purchased toolkits (don’t get me started, just ask me about the dark abyss of toolkits if you ever get chance!). Some companies can end up producing extensive and sometimes unnecessary documentation that then ends up never being understood or even read by employees, it will weigh your system down and will likely cause you more non-conformities during external audits because they’ve not been maintained correctly or at all.

How you can avoid this

Focus on meaningful, usable documentation. Policies and procedures should reflect actual practices and be integrated into daily operations. Train your staff on how to apply them. Consultants like ourselves can also help you trim the fat when it comes to documentation if needed. Understanding whats actually required to be documented vs what isn’t is helpful information to have when doing all the different ISOs.

A bit more a niche issue, change management is an easy one to miss. And IT guys, this doesn’t just mean your change control processes for managing code updates and deployments. This relates to practical business changes, updates to the management system, changes to internal business processes, personnel and technologies. Yeah, its cool you’ve found some new software or you’re in the process of moving your entire filing directory to the cloud but have you actually planned it out and recorded what you are doing? Something perceived as innocuous as moving an employee between departments does have information security implications (permission levels changing in data accessibility, that person’s knowledge for X task, the availability of information they have, if they are the only person helping Y customer and they move, who’s got access to the information needed to continue helping that person, etc.) and you need to manage that.

How you can avoid this

I know you’re probably busy running the business and doing the changes on the fly but you should integrate your change management into the lifecycle of the ISMS; build the system so that changes are reviewed during the management review or do monthly Informal’s to flag changes and keep a track record of changes, record planned changes and conduct risk assessments for those planned changes.

Security incidents are the dreaded bane of todays digital world however many companies still find themselves taking the hope and pray approach. Emergency response and business continuity planning are great buzz phrases but are very easy to end up being only basic top-level plans around how you will respond. Having a weak and untested system can lead to confusion, delayed reactions to issues and ultimately a greater extent of damage during a breach.

How you can avoid this

Develop a response plan AND TEST IT. Run that thing through ringer! Plans should ideally include specifically defined roles so people know what they are doing and who to report to, communication strategies for if you need to contact specific people (including customers) and also make sure you do a proper post-incident analysis; make sure you learn from the incident and try to stop it happening again. As I say, test your plan regularly, do this by running simulations and adjust it based on lessons learned, oh and make sure you cover different types of incidents not just the same old easy to do scenario.

Hopefully you’ve found this interesting. ISO 27001 implementation is a powerful way to build trust, reduce risk and enhance your operational resilience. But the journey is not without its challenges. By being aware of the common pitfalls and proactively addressing them, we reckon you should be able to avoid costly missteps and create a management system that works for you and that delivers lasting and reliable value.

Successful implementation is less about checking boxes and more about embedding a culture of security throughout the company. With proper planning, commitment and continuous improvement, ISO 27001 can become a cornerstone of your company’s success in managing information security.

If you’d like help with getting your system off the ground or if you’d just like a little guidance or hell, just some internal audits doing. Then hit us up using our contact us webform or give us a ring.

For those of you who aren’t familiar, heres a quick and simple explanation of ISO 14001.

Key principles of ISO 14001 include:

As I mentioned before, the construction and architectural industries are inherently impactful due to their use of raw materials, energy consumption, waste generation, and land use. Here’s how ISO 14001 is especially relevant:

Like any industry there are certain nuances but a general method to the madness would follow this:

We’ve got a climate that is changing, already this is one of the warmest springs we’ve had in a long time and that winter before was just bizarre. The emphasis on climate change and carbon neutrality is therefore going to continue being a focus point and will likely become more prominent than ever over the next few years.

ISO 14001 is vital to get ahead with its ability to help you seize the opportunities coming. There is an upcoming revision, expected to appear some time in January 2026. But even when that comes out, you’ll have 3-year transition period before having to adopt the new standard, so don’t let that stop you from getting a jump on it now (the changes expected are further emphasis on climate-related risks and opportunities, aligning closely with the global sustainability goals agreed at the big boy tables our politicians spend so much money going to!).

For the construction and architectural industries, embracing ISO 14001 isn’t just about compliance; it’s a strategic move toward innovation, resilience and long-term value creation.

In a world where green credentials increasingly matter, ISO 14001 provides the blueprint for building not just structures, but a better tomorrow. Well, that’s the idea anyway.

Quick! Run for cover; they’ve heard us talking about them!

In the UK, the United Kingdom Accreditation Service (UKAS) is the national accreditation body. There are other legitimate international accreditation bodies that are members of the IAF (the International Accreditation Forum) or members of ILAC (the International Laboratory Accreditation Cooperation) BUT UKAS are the only national body recognised in the UK. Accredited bodies like UKAS ensure that test and inspection providers (the people who issue the certificates) meet the requirements in these standards and that their inspection results are valid and reliable.

We’ve said many times in the past that SMEs are the backbone of the UK, and that remains the same despite the government’s latest attempts to cut small businesses down at the ankles.

Many of these small businesses either complete inspection works themselves (like asbestos inspectors) or they use products or services that have inspection works carried out (use any tools to measure stuff in your work? If so, how do you know they are accurate, have they been calibrated? Or, have you ever been PAT tested?).

The kinds of SME we’ve seen interested in this standard have included:

17021, as mentioned, is the standard that applies to certification bodies (CBs); if you want ISO 9001, 14001, 45001 or any of the many other standards, these are issued by CBs instead. Those CBs do however need to checked to make sure they are doing a proper job. This is where UKAS become involved; companies like BSI and ISOQAR get audited by UKAS to check their competence, independence and that they are doing there assessments properly too.

Labs and calibration businesses also have to be considered competent and reliable so 17025 was developed just for them with a focus on the accuracy and reliability of the measurements that they take on top of their own competency levels. This standard can get very technical in some fields, like calculating the degrees of uncertainty in a reading based on the impacts of temperate on the measurement equipment etc. A standard not for the faint of heart, we’d recommend you have in house resources for this standard.

How Accreditation Standards Affect SME’s

17020, 17021 and 17025 (and others in this series) provide a structured framework for conducting inspections, tests and certifications effectively and impartially. Key requirements include:

When you follow these principles and document evidence to support them, it helps demonstrate your credibility, builds the trust your customers will have in you and can also improve your efficiency in the work you complete.

In the UK, the United Kingdom Accreditation Service (UKAS) is the national accreditation body responsible for assessing and certifying organisations against ISO 17020. There are other legitimate accreditation bodies that are members of the IAF (the International Accreditation Forum) or members of ILAC (the International Laboratory Accreditation Cooperation) BUT UKAS are the only national body recognised in the UK. Accredited bodies like UKAS ensure that inspection bodies (the people who issue the certificates) meet the stringent requirements set out in the standard and that their inspection results are valid and reliable.

Despite my earlier quip, whilst UKAS are certainly not perfect, we’d still rather have them operating in the UK and regulating industry properly, than having a free-for-all where you have no idea of the competence or honesty of the people providing our goods and services.

In our experience UKAS can be bureaucratic and expensive at times; but this is how the process works:

1. Application and Assessment:

Following initial contact, UKAS will want to know basic information from you like number of employees, what kind of work it is you are planning to do etc. you’ll then be asked to fill out an application form detailing the formal scope of inspection/certification/test activities you want to do and some information about your processes. They’ll send you a quote for the process, then draft up a Customer Agreement which is essentially a terms and conditions/contract that you’ll need to sign and send back to them. UKAS will then schedule in an initial assessment to review your management system documentation and your on-site activities.

1. Application and Assessment:

Following initial contact, UKAS will want to know basic information from you such as number of employees, what kind of work it is you are planning to do etc. you’ll then be asked to fill out an application form detailing the formal scope of inspection/certification activities you want to do and some information about your processes. They’ll send you a quote for the process, then draft up a Customer Agreement which is essentially a terms and conditions / contract that you’ll need to sign and send back to them. UKAS will then schedule in an initial assessment to review your management system documentation and your on-site activities.

2. Audits and Compliance Checks:

You will be visited by UKAS auditors to verify your compliance, they will check personnel competence records, your levels of impartiality to the people you are inspecting/certifying and your overall adherence to your own documented methodologies. This visit can be intense and usually UKAS send auditors in pairs, one being knowledgeable about management systems, and the other an industry/technical expert for the industry that YOU work in. For example, grain inspections on cargo ships, they will send someone with experience of grain and international shipping etc. Obviously, this can be a challenge for very specialised industries; one “expert” we have met was well into his seventies and came out of retirement just to do the visit. The number of days this process takes are based on the complexity and size of your org.

3. Accreditation and Monitoring:

If successful (when successful if you use us!), you’ll receive your accreditation, valid for a specified period. UKAS will then conduct periodic surveillance visits to ensure continued compliance. This can include them coming with you to your customers to witness your inspections. UKAS attendance during CB customer audits is very common (there have been several times we’ve had customers undergoing certification for ISO 9001/14001/27001 etc. only to find the auditor was also being assessed by UKAS).

Obtaining UKAS accreditation is a big and sometimes scary process; but it’s a brilliant way of demonstrating your professional credibility and gaining access to larger clients and government contracts.

Many SMEs across a plethora of diverse industries and sectors can find themselves needing to demonstrate their impartiality, credibility and technical competence. These ISOs are a great way prove you’ve got those aspects within your business.

UKAS are the UK’s ONLY national accreditation body, don’t be fooled. They provide independent verification of compliance and are recognised by the UK government and the IAF. If you want to establish yourself as a trusted provider of these types of service in the UK, then UKAS are your best bet.

We’ve got significant practical experience in dealing with UKAS and taking our customers through accreditation to these standards. If you are interested in going through this process yourselves or just have any extra questions burning away in your head then feel free to drop us a message using our contact form.

An UKAS accredited ISO 9001 certificate is a way of doing that. You are showing the world that your internal ways of working have been validated by an independent third party, and that third party has been confirmed and validated on behalf of the UK government. This kind of certification tells your customers that you are serious about the work you do; that you are looking towards the future of the business, it’s growth and also that you don’t plan on disappearing with their money.

For the vast majority of people raised in the UK; the tragedy at Grenfell Tower is a core moment in history. Many are also aware that since 2017 there have been ongoing legal battles between people and companies looking for those culpable. These investigations and suits come with enormous costs to the people and the companies involved. It is almost inevitable that with these investigations, someone somewhere may not have followed the correct legal processes; and they will likely be left holding the bill if they aren’t behind bars.

ISO 9001, ISO 14001, ISO 45001 and ISO 27001 now all insist on managing legal compliance. So using suppliers and sub-contractors that hold these kinds of certification is a simple, practical and a cost-effective way of ensuring somebody checks your suppliers are behaving correctly, giving you some level of protection.

Tendering and bidding can be expensive and time-consuming activities; but without them how do you get into the larger markets and more lucrative contracts? Holding properly accredited ISO certificates can greatly simplify this process along with the data you need to provide to support your bids. For instance, an ISO 14001 Environmental Management Certificate can save you having to answer pages and pages of questions about your emissions and reduction plans, etc. it also means you shouldn’t need to sink hours into finding the evidence to support your answers. When it comes to tendering and bidding ISO certification generally pays for itself just in your saved time fairly quickly. Having ISO can also be mandatory in some markets, so, it could also give you access to markets and contracts you simply wouldn’t get into without it.

ISO management systems are now based around the objectives and targets you set for your business; they support and help maintain all aspects of performance monitoring and so can support drives to reduce cost, increase sales and use resources more effectively.

Properly structured and installed, any of these management systems can be maintained with little impact on work or resources, but as explained above, they should also give you many advantages through access to new markets, reduced risk etc.