What we do
Pick a service, find your industry, or start from what you are trying to get done.
Explore What we doBrowse What we do
View allProfit360™
Our way of turning your finance function into a source of profit.
Explore Profit360™Browse Profit360™
View allGlobal
A coordinated approach to cross-border finance, tax and assurance questions.
Explore GlobalBrowse Global
View allInsights
Tax changes, finance thinking and what they mean for your business.
Explore InsightsBrowse Insights
View allAbout
Who we are, who you will work with, and how we hold ourselves to account.
Explore AboutBrowse About
View allCareers
Build a career in US accounting, tax and advisory.
Explore CareersBrowse Careers
View allServices
Specialist work across compliance, assurance, finance and growth.
Explore ServicesBrowse Services
View allAudit & Attestation
AT&F helps with readiness and preparation for the certification audit, including ISO 27001 and other standards a customer has asked for. An accredited certification body issues the certificate, not AT&F.
The value
Prepare the management system and the records that show it operates, so the certification audit starts from facts rather than assumptions.
Typical scope
The final engagement is tailored to your facts. These are the core workstreams we use to define a useful, responsible scope.
01
Which ISO standard, and which edition, the customer or contract named
02
Scope of the management system: products, sites, teams, and activities
03
Ownership of policies, decisions, and records
04
Gaps in documentation and operating evidence
05
The internal review a certification body will expect to see
06
Where SOC 2 or another ISO standard overlaps, and where it does not replace this one
How the engagement moves
We start with who asked, which ISO standard and edition they named, and what decision a certificate is meant to support. ISO 27001, ISO 9001, and the other standards on this page are not interchangeable.
Scope is a management decision. The products, sites, teams, and activities in view need an owner. A SOC 2 boundary, or the scope of a different ISO standard, is not assumed to be the same.
Readiness looks at the documented system and the records that show it operates. Missing pieces are listed with owners. Management decides what to implement.
AT&F helps with readiness. An accredited certification body issues the certificate, not AT&F.
Common standards
These are management-system standards AT&F can help you prepare for. The list is not a limit. If a customer, contract, or regulator named a different ISO certification, bring the standard number.
ISO/IEC 27001
ISO/IEC 27001:2022 sets requirements for an information security management system: leadership, risk assessment, and a defined set of information security controls. Customers often name it next to SOC 2. The two can overlap. Neither replaces the other. The dedicated page describes readiness for this standard.
Read the ISO 27001 pageISO 9001
ISO 9001 is the quality management system standard. The current edition, ISO 9001:2026, covers how an organization plans, operates, and improves the processes that deliver products and services meeting customer and applicable requirements. Organizations certified to ISO 9001:2015 should confirm the transition date with their certification body.
ISO/IEC 27701
ISO/IEC 27701:2025 sets requirements for a privacy information management system for organizations that act as controllers of personally identifiable information, processors, or both. Unlike the 2019 edition, which extended ISO/IEC 27001, the 2025 edition is a standalone management-system standard. A certificate is not a legal opinion that privacy law has been met.
ISO 22301
ISO 22301:2019, with its 2024 amendment, sets requirements for a business continuity management system: how the organization prepares for, responds to, and recovers from disruptive incidents. A later edition has not replaced these published requirements.
ISO/IEC 42001
ISO/IEC 42001:2023 sets requirements for an artificial intelligence management system. It is for organizations that develop, provide, or use AI systems and need policies, roles, risk and impact assessment, and a lifecycle they can evidence.
ISO 14001
ISO 14001:2026 sets requirements for an environmental management system: environmental aspects, compliance obligations, operational control, and improvement. It replaced ISO 14001:2015. The certification body confirms which edition an audit will use and any transition date that applies to an existing certificate.
ISO 45001
ISO 45001:2018, with its 2024 amendment, sets requirements for an occupational health and safety management system, including worker participation, hazard identification, and OH&S risks. A revision is in development. It is not yet the published requirements standard.
Several of these standards share a common management-system structure, so quality, environmental, and occupational health and safety systems are often prepared together when that is the request. This is not product testing, and it is not a statement that AT&F is a certification body.
What to have ready
What you can expect
Common questions
The quickest way to get a firm answer is to share the facts that make your situation different.
No. An accredited certification body issues the certificate, not AT&F. AT&F is a US CPA firm and helps with readiness and preparation for the certification audit. This page is not a certificate or a statement that AT&F is a certification body.
No. ISO/IEC 27001 has its own page because information security is a frequent request alongside SOC 2. Readiness also covers other ISO management-system standards, including the ones described on this page, and another ISO certification when that is what a customer, contract, or regulator asked for. Bring the standard number. If preparation support does not fit that standard, we will say so.
No. A certificate is the certification body’s statement about the management system against the standard in the agreed scope. It is not a legal opinion, and it does not replace regulatory, privacy, safety, or environmental obligations.
Use the edition the request or the certification body names. ISO 9001:2026 and ISO 14001:2026 are the current published editions of those standards. Organizations already certified to an earlier edition should confirm the transition date with their certification body. ISO/IEC 27701:2025 is a standalone privacy management-system standard. The 2019 edition was an extension of ISO/IEC 27001.
Yes. An early conversation can identify missing scope, ownership, and evidence. Management remains responsible for the management system and for deciding what to implement. Readiness does not itself create a certifiable system.
Related assurance
SOC 1, SOC 2, a startup buyer request, and ISO certification readiness are related. They are not the same engagement.
The information security management system, when that is the standard a customer named.
Read the pageAn AICPA attestation. It can overlap with ISO 27001. It does not replace a certificate.
Read the pageFinancial-statement audit, internal audit, and the wider assurance practice.
Read the pageUseful reading
Practical perspectives that may help frame the next question. They are general information, not advice based on your particular records, facts or current rules.
Audit & assurance
A practical, non-technical way to organise ownership, controls and evidence before a SOC 2 examination begins.
Read articleAudit & assurance
A practical operating framework for SaaS and technology teams responding to customer security, risk and assurance questions without turning every questionnaire into a one-off project.
Read articleAudit & assurance
A practical way to prepare control owners for evidence walkthroughs by connecting each activity to its trigger, record, reviewer and exceptions.
Read articleStart with a conversation
An accredited certification body issues the certificate, not AT&F. AT&F helps with readiness and preparation for the certification audit. An engagement is confirmed separately and does not promise a certificate. The standards on this page are common management-system requests, not a claim that every ISO publication is in scope.
