knowledge

ISO 27001 Guide

ISO 9001 Guide

ISO 45001 Guide

ISO 14001 Guide

<h1>Unlock Your Business Potential</h1>
Finding your way through the ISO maze can be confusing. If you are at the start of your journey have a look at our guides for ISO 9001, ISO 14001, ISO 27001 and ISO 45001 for a comprehensive but common-sense explanation of the requirements.

World Quality Week 2024!

Chris Passmore of 2SB with the F E Burman team

It’s 2SB’s 18th anniversary!

Earth Day 2024

Lick using FSC® to strengthen eco-friendly range

2SB supports local charity Dandelion Time

Today is World Mental Health Day! 

Week in the life of a 2SB consultant

It’s World Accreditation Day 2023!

TechMed achieves ISO 9001 certification

Internal Auditing Support at Tarkett

F E Burman recertified for the 3rd time

Rhino Exteriors successfully ISO 9001 recertified

It’s World Quality Week!

Seacourt success at annual ISO external audit

It’s 2SB’s 16th anniversary!

All Hands on Deck at 2SB’s Away Day

Bansal flows back to ISO

It’s World Accreditation Day!

2SB is a corporate supporter of Kent Wildlife Trust

Earth Day 2022

UK 2022 Plastic Packaging Tax: What does this mean for you?

Jacked Supplements Achieve ISO 9001

2SB away day on the Medway

Arden Lea get FSC

Xpress keeps moving forward

Burmans benefits from external certification

Standard Plant Hire delivers a high quality Service

Wilmot-Budgen working to the highest of standards

ISO System leads to Global Projects

PJ Keary achieve 100% for third year in Achilles audit

The World can dance on FSC® floors

Planet positive printer supports responsible forest management

100% remote implementation

Hughes Pumps keep up the pressure

Obart Pumps gets flexible support

Setting the Standard – 2SB Consultant Embarks on NEBOSH Diploma

Albion let UKAS accredited certification take the strain

Lucent lights up the environment

UKAS accredited certification gives confidence to clients during lockdown

Hydraulic Engineering Services achieve success under pressure

2SB recommended for continued certification to ISO 9001 & 14001

Agency making good use of their time

Is Covid-19 reportable under RIDDOR 2013?

What should I do about my ISO audit during the Covid-19 outbreak?

Coventry Scaffolding gets support from 2SB

Practical Business Continuity Planning for Covid-19

Tyk ISO 27001 Certification

ISO supporting rapid international growth

Klair Group building ISO system on sound foundations

5 tips for effective information security

Thorne revives ISO certification after nearly 25 years

2SB supports Two Sides

Barnes Offshore guards the future

Jellyfish start ISO 14001 with 2SB

ISO Success

2SBs client RAP Interiors – helping the homeless locally

Servo Connectors continues to benefit from ISO 9001:2015 training

2SB improves its ISO 27001 skill set by employing skilled staff

2SB discuss ISO 27001 and Cyber Security on KMTV

2SB certified for iso-9001-14001-certification

At 2SB our implementation costs are calculated by the number of days the implementation will take, and are based on the number of standards which you wish to implement at the same time.
The first part of the process is for us to understand how much you already have in place. Once contacted, we will ask a few key questions to understand your business before creating a proposal outlining costs and timeframes. Costs can range from £3000 to around £10000 depending on the size of your organisation, how many standards you require, the complexity of your processes and the amount of internal resource you can allocate.
In addition to consultancy costs there are the costs of certification. These are calculated on a daily rate by the Certification Body and depend on the size of your organisation, the complexity of your activities and the number of standards you want certified.
In order to remain certified you will have to pay for annual surveillance visits as well as every third year for the costs of recertification. Costs from a certification body can vary from around £800 upwards per day.

How much does ISO certification cost?

For any single management system including ISO 9001, ISO 14001, ISO 27001, ISO 45001, a typical time frame for implementation is 3-6 months.
Implementation time frames (i.e. building your management system prior to the audit) are as follows:
ISO 9001 – 2 to 6 months 
ISO 14001 – 2 to 6 months 
ISO 27001 – 3 to 6 months 
ISO 45001 – 2 to 6 months 
ISO 9001 + ISO 14001 – 3 to 8 months 
ISO 9001 + ISO 27001 – 4 to 8 months 
ISO 9001 + ISO 14001 + ISO 45001 – 5 to 10 months 
ISO 9001 + ISO 14001 + ISO 27001 – 5 to 10 months
This can vary depending on how effective you are at implementing the management system&#8217;s requirements and the number of certifications being acquired.
We have completed implementations in shorter time frames however from our experience this means internally you must prioritise the ISO implementation with a central member of staff.
In addition to the timeframes above, you should allow 1-3 months for the certification process (i.e. stage 1 and stage 2 audits) and around 2 further weeks to receive your certificate.
It&#8217;s beneficial to have the advice of a consultant when doing this but you can do it alone if you have the time and resource needed to learn the standard and its requirements.

How long does it take to get ISO certified?

<div class="content-area up-down small">
<div class="grid-container">
<div class="grid-x grid-padding-x">
<div class="cell">
<div class="cms-block">
A certification body is an independent third-party business that employs competent auditors who can conduct external audits on your business. They will visit and audit your business to check for compliance against the <a href="https://www.iso.org/home.html">ISO</a> standard(s). Some certification bodies specialise in certain industries, some have international reputations, and some are more competitively priced than others.
If you’re looking to be certified in an ISO standard, we strongly recommend selecting a certification body that has been accredited by <a href="https://www.ukas.com/">UKAS</a>. UKAS is the sole national accreditation body for the UK and is recognised by the UK Government. UKAS conduct very thorough annual external audits of all UKAS accredited certification bodies to ensure that they are allocating the correct number of days to each client audit and are using auditors with good knowledge of the market in which you operate. Most larger businesses and government departments require suppliers to have UKAS accredited certification since they know that UKAS accredited audits are conducted properly, and will not recognise ISO certificates from non-UKAS accredited certification bodies.
There are around 100 certification bodies who are accredited by UKAS and we can help you complete the necessary documentation that they need to get you a price. You can browse UKAS accredited organisations in their directory: <a href="https://www.ukas.com/find-an-organisation/">https://www.ukas.com/find-an-organisation/</a> All certification bodies should do a similar job, however like with anything, the level of service given can vary.
Costs for certification also vary from certification body to certification body. While cost shouldn’t be the sole determining factor, it is still important to compare the pricing structures of different certification bodies. Ensure you understand what is included in the cost and any additional charges that may apply. You should always get the costs for a three year cycle of audits so that you can get a full comparison.
twoSB are consciously not affiliated with any certification body so we can help you select the right certification body to use for your business.
Some popular ISO certification bodies include:
<ul>
<li><a href="https://isoqar.alcumus.com/">Alcumus ISOQAR</a></li>
<li><a href="https://auvacertification.com/">Auva</a></li>
<li><a href="https://www.british-assessment.co.uk/">BAB</a></li>
<li><a href="https://www.bmtrada.com/">BM Trada</a></li>
<li><a href="https://www.bsigroup.com/">BSI</a></li>
<li><a href="https://www.bureauveritas.co.uk/">Bureau Veritas</a></li>
<li><a href="https://www.dnv.com/">DNV</a></li>
<li><a href="https://www.lrqa.com/en-gb">LRQA</a></li>
<li><a href="https://www.nqa.com/en-gb">NQA</a></li>
<li><a href="https://www.sgs.com/">SGS</a></li>
<li><a href="https://www.dnv.com/">TUV</a></li>
</ul>
</div>
</div>
</div>
</div>
</div>
<div class="content-area">
<div class="grid-container">
<div class="grid-x grid-padding-x"></div>
</div>
</div>

How do I choose an ISO certification body?

The ISO assessment process can be quite confusing. Understanding the difference between <a href="/faqs/what-is-iso-who-are-ukas-what-are-certification-bodies/">ISO, UKAS (the national accreditation body) and the certification bodies</a> is the first step:
ISO
ISO is the International Organisation that writes standards for many different industry sectors. <a href="/services/iso-9001/">ISO 9001</a>, <a href="/services/iso-14001/">ISO 14001</a>, <a href="/services/iso-27001/">ISO 27001</a> and <a href="/services/iso-45001/">ISO 45001</a> are some of the best known but there are over 22,000 different ISO standards to date. ISO will review standards and issue updates, and write new standards where there is a need. It sits right at the top.
UKAS
ISO write the rules, but it is <a href="https://www.ukas.com/about/working-with-business/" target="_blank" rel="noopener">UKAS</a> who oversees them at the highest level in the UK. UKAS is the sole national accreditation body for the UK and is recognised by government. UKAS visit certification bodies to ensure that they and their assessors are performing to a sufficiently high level. Certification bodies seek to get accreditation from UKAS to demonstrate their competence. If you&#8217;re looking to be certified in an ISO standard, we suggest you choose a certification body that has been accredited by <a href="https://www.ukas.com/about/working-with-business/" target="_blank" rel="noopener">UKAS</a>. Some certification bodies are not UKAS accredited and may not always demonstrate full compliance to the ISO standard.
Certification Bodies
The next step down is the Certification Bodies (DNV, NQA, ISOQAR, BSI, SGS, etc). A certification body is an independent third party that can conduct external audits on your business. They will visit and audit your business to check for compliance against the ISO standards. Some certification bodies specialise in certain industries, some have international reputations, some are more competitively priced than others. There are around 100 certification bodies who are accredited by UKAS and it is up to your business who you ask to assess your ISO system. All certification bodies should do a similar job, however like with anything, the type of service given can vary. 2SB can help you select the right body to use for your business (and are not affiliated with any certification body).
Consultants
Consultants (like 2SB) are used to help guide businesses implement management systems. They understand the standards needed to achieve certification but also look to add value to your business. It is possible for a business to successfully gain certification without the use of consultants however it can require considerable internal resources. Consultancies possess the experience, knowledge and training that can streamline the process and provide cost effective guidance as well as bring added value to your systems.

What is ISO? Who are UKAS? What are certification bodies?

Documentation requirements vary depending on which standards you are implementing. Contrary to popular opinion, ISO systems do not need to be heavily documented.
Each standard has specific requirements for certain items to be documented to ensure that you are able to meet the requirements of the standard. Other clauses in standard may not require documentation, but its easiest to prove that its being done if its documented.
We can advise you on exactly what documentation is required and how to structure and record it.

How much do I need to document for ISO certification?

Understanding Scope 1, 2 and 3 emissions
When talking about carbon emissions, it doesn’t take long to run into the terms ‘Scope 1, Scope 2 and Scope 3’ – it is essential to understand what these are as everything else builds upon them.
The three scopes of greenhouse gas emissions first came into use in the Greenhouse Gas Protocol of 2001 as a way of categorising the different types of emissions produced by a company in its production chain. The Greenhouse Gas Protocol remains one of the central standards for greenhouse gas reporting in the UK and worldwide.
Scope 1 emissions are direct emissions from assets owned or controlled by a company. E.g. your office or your company cars (imagine the emissions being created directly from the company asset). The most common sources are: 
•    gas used in heating your facility (e.g. emissions created by the boiler) 
•    fuel used in your fleet or plant (e.g. emissions created by the engine) 
•    escapes of gases from your air conditioning
Scope 2 emissions are emissions from the generation of purchased energy (e.g. electricity). You are still using the energy to run your company assets, but the assets do not directly create emissions. Instead the emissions are released at the point of power generation, e.g. upstream at the power station and not by your bulb. Electricity is the primarily what we are talking about here.
Scope 3 emissions are all the other emissions which occur in the chain of production of your company, including both upstream and downstream processes. Upstream emissions refer to the emissions that occur upstream of your own processes. Downstream emissions are those such as distribution that happen after your own processes.
Upstream Scope 3 emission examples: 
•    Purchased goods and services (e.g. IT equipment, production materials, data centres, consultancy, contractors) 
•    Transportation and distribution (getting goods and materials to you) 
•    Waste generation 
•    Business travel (excluding travel in your own vehicles which would be counted in scope 1) 
•    Employee commuting (excluding travel in your own vehicles which would be counted in scope 1) 
•    Home working
Downstream Scope 3 emission examples: 
•    Transportation and distribution (sending goods from you) 
•    Use of sold products (e.g. emissions relating to the use of what you make) 
•    End of life treatment of your sold products
Do I really need to consider Scope 3 emissions?
The short answer is yes – these often account for a significant proportion of a company’s emissions and you can influence them in many cases. For example, a website company may design websites that produce less CO2 per page opened (‘use of sold product’); a consultancy may decide that they can reduce business travel emissions by requiring the use of public transport over cars and planes (‘business travel’). There are many more examples.
Although Scope 1 and 2 remain the starting point for monitoring, any thorough approach to calculating and then reducing emissions must consider Scope 3 emissions.
Emission scopes visualised
Here is an example of the emission scopes visualised for the manufacturing industry:

What are Scope 1, Scope 2 and Scope 3 Carbon Emissions?

ISO 27001 is a specification for an ISMS – an Information Security Management System. An ISMS is a set of policies, procedures, processes and systems that manage information security risks, such as cyber attacks, hacks, data leaks or theft. The ISO 27001 standard provides requirements for establishing, implementing, maintaining and continually improving an ISMS.
With ISO 27001:2013 being nearly a decade old, the new version ISO 27001:2022 is much needed. The technology and threat landscape has shifted significantly, with trends such as the move to cloud computing and heavy adoption of third party applications, which is underrepresented in the 2013 version of the standard. The changes in the update are a positive step for keeping the most up to date controls in place to protect your organisation.
The release of the new version of the standard will create considerations for those looking to implement an ISO 27001 system for the first time, as well as those who are already certified to ISO 27001:2013.
New to ISO 27001?
For those companies looking to implement ISO 27001 for the first time, we have entered into a short period where the decision about which standard to implement is up in the air.
Certification bodies will require a number of months after the anticipated October 2022 release to be accredited by UKAS to certify against the new standard. Most certification bodies are not completely sure when they will be able to audit against the new standard, however April 2023 has been stated as the target by several certification bodies.
This means that if you are an organisation looking to certify before February 2023, you would be best certifying to ISO 27001:2013 and then transitioning at your first or second annual audit. If you have started to, or are about to undertake an implementation but don’t expect to certify until around April 2023, it will likely be best to implement the new version of the standard (ISO 27001:2022).
What do you do if you have an existing ISO 27001 system?
If you are already certified to ISO 27001:2013 you will need to transition to the new version of the standard within 3 years of its initial release (roughly October 2025). This gives plenty of time to alter your system to meet the new requirements.
We recommend transitioning (i.e. being assessed against the new standard) at one of your regular annual audits. Depending on a number of factors, the transition is likely to add a day or two to the length of your regular audit.
What are the differences between ISO 27001:2013 and ISO 27001:2022?
Clause 4-10 of ISO 27001 already aligns with the other main ISO standards and so it would be surprising if any game changing requirements are added here.
We instead anticipate that the main differences between the standards will be held in Annex A of the ISO 27001 standard &#8211; the long list of 114 security controls. This is also represented in your “Statement of Applicability” if you are already certified to ISO 27001:2013.
In Annex A of ISO 27001:2013, the 114 controls were spread across 14 categories. These will be modified with the new standard, which will instead have 93 controls across 4 domains.
11 controls are completely new and others have been modified or merged. (A proportion of controls remain unchanged in substance from the old version). To give a flavour of some of the updated requirements, these include: 
•    Threat intelligence 
•    Information security for use of cloud services 
•    ICT readiness for business continuity 
•    Physical security monitoring 
•    Configuration management 
•    Information deletion 
•    Data masking 
•    Data leakage prevention 
•    Monitoring activities 
•    Web filtering 
•    Secure coding
What next?
Deciding when and how to transition or which standard to implement will take some consideration.
Email us at info@2sb.co.uk to discuss your path to becoming certified against the new ISO 27001:2022 standard.

What is ISO 27001:2022 and how does it impact you?

If you are like many other organisations, you will be keen to understand how you can reduce your greenhouse emissions… but where do you start and where do you concentrate your efforts?
To know where to make reductions you must first identify and then establish the significance of each source of greenhouse gas emission in your business and supply chain. Although some sources of emissions are easy to calculate accurately, others are more complex. Don’t let this intimidate you… we have outlined below the starting point for how to calculate your emissions groups.
Scope 1 Emissions
Gas
<ul>
<li>If you use gas to heat your water or for heating, get hold of your gas bills – first you will need to identify how much you have used in kWh (on a monthly or annual basis) and then you will need to determine the emissions per kWh. The bills often tell you the emissions related to each kWh, or will at least point you to an online source which gives this information. If you cannot find the emissions related to your exact gas usage you can do a simple calculation to convert the gas measurement into kgCO2e emissions using the conversion factor in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
</ul>
Fuel in plant and company cars
<ul>
<li>If you purchase fuel for company owned (or leased) vehicles or plant, collect information related to the purchase of fuel. You will need to convert either the volume of fuel used; the mileage driven; or the amount spent (depending on your data) into kgCO2e emissions. Data on the conversion factors can be found in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
<li>If you have electric vehicles charged using company electricity, this will be captured in Scope 2.</li>
<li>Air conditioning – If you have significant use of air conditioning check your servicing records and establish if any of the gas has leaked. If there is a release you will need to determine the type and quantity of the refrigerant and the related CO2e emissions.</li>
</ul>
&nbsp;
Scope 2 Emissions
Electricity
<ul>
<li>These emissions are related to the amount of electricity you use on site. Collect your electricity bills to determine how much electricity you are using in kWh. You will also need to determine the energy mix, i.e. how is your electricity made, coal? nuclear? renewables? a mix if the above?</li>
<li>On some bills the energy company will tell you the exact mix and the related CO2e emissions per kWh. If you are not that lucky you will need to find out the mix from the energy company or in the worst-case scenario base your calculations on grid averages which can be found here in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
</ul>
&nbsp;
Scope 3 Emissions
This is where you will need to do some exploration and apply judgement as to which emissions you want to monitor. Of the 15 categories of scope 3 emissions only some will be significant depending on the type of business you are in. The way in which you calculate the emissions will vary depending on how much data you have. The reality is that you won&#8217;t have a complete set of data so you will need to make assumptions and justifications to determine the emissions.
This can take some experience, and you have a couple of options. You can either read up and study how to calculate these scope 3 emissions (there are some good resources about – we recommend starting with the <a href="https://ghgprotocol.org/scope-3-technical-calculation-guidance">GHG Protocol Scope 3 guidance</a>), or you can engage a third party to undertake these calculations for you.
You do not need to address every scope 3 emission; however, you should try and address all those which are material. Some typical methods to gather data are as follows:
<ul>
<li>Travel for work – This would include collecting data on flights, trains, taxis, tube but only where each of these are not for commuting (e.g. getting to the main place of work). Distance data should be collected on all travel for work, and converted to kgCO2e using the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>. Where spend is known but distance is not, this will need to be converted to distance and then have the conversion applied.</li>
<li>Employee Commute – This is for travel from home to the office. Generally this data can be collected by issuing a survey that asks employees to complete information on their typical commute. I.e record the mileage they travel, the transportation method and frequency. You can calculate emissions by multiplying the distances by the emission factors in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
<li>Remote working – Although there is no official data on the average figures for electricity and gas usage at home a widely used source is the <a href="https://info.eco-act.com/hubfs/0%20-%20Downloads/Homeworking%20emissions%20whitepaper/Homeworking%20Emissions%20Whitepaper%202020.pdf">Ecoact whitepaper</a>. If you want to produce a more accurate figure, you may want to ask employees if they use renewable providers of electricity, otherwise you could apply the average grid electricity emission factors found in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a>.</li>
<li>Purchased services – These are GHG emissions from third party services – consultants, cloud computing, accountants etc. Typically you can export your spend on services from your accountancy software and use the <a href="https://www.ons.gov.uk/economy/environmentalaccounts/datasets/ukenvironmentalaccountsatmosphericemissionsgreenhousegasemissionsintensitybyeconomicsectorunitedkingdom">ONS data set</a> to approximate emissions for each service sector based on spend.</li>
<li>Purchased goods – Depending on your industry this could be a significant source of your emissions. This category can be highly involved but for an office based service business you will want to look at emissions related to purchases such as computer equipment – a lot of electronic equipment has good data attached to it, for example see this <a href="https://www.apple.com/environment/pdf/products/notebooks/14-inch_MacBook_Pro_PER_Oct2021.pdf">Macbook data sheet</a>. Try a search with the device model followed by ‘environmental data sheet’. If you are a manufacturing or construction company you will need to either get data from suppliers, or refer to sources such as the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> which has details of emissions related to certain materials.</li>
<li>Waste – Depending on your industry, waste may represent a large or small part of your emissions. Once you have collected data about the amount of waste you produce (e.g. from waste transfer notes) and the method of end of life treatment (recycled, landfill, energy for waste etc.) you can use the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> to convert this to emissions.</li>
<li>Upstream transportation and distribution – This includes transportation and distribution of products between your supplier and yourself (in vehicles not owned or operated by you); and third-party transportation and distribution services purchased by you including inbound logistics, outbound logistics (e.g., of sold products), and third-party transportation and distribution between your own facilities. It is really important to note that emissions relating to sold product for which you pay the distribution counts in the upstream category. You will need to look at all shipments and the associated distances (including vehicle type/transport method). Then use the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set </a>to arrive at emissions.</li>
<li>Downstream transportation and distribution – Where a customer pays for the transportation or distribution, the emissions should be recoded in this category. You will need to look at all shipments and the associated distances (including vehicle type/transport method). Then use the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> to arrive at emissions.</li>
<li>Transmission and distribution – This category is associated with the losses that come from distributing power to your office/employee houses. Total all your electricity usage in kWh and then apply the conversion factor in the <a href="https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1049333/conversion-factors-2021-full-set-advanced-users.xlsm">government produced data set</a> for distribution losses.</li>
</ul>

How do we calculate our greenhouse gas emissions?

Unlock Your Business Potential

Implementation Guides