Evaluating an ISO service provider starts with knowing which of three categories you are actually talking to — a certification body, a QMS software vendor, or an implementation firm — because each one is legally or structurally limited in what it can offer, and mixing them up leads to wasted meetings. Once you know the category, the evaluation questions get specific and fast.
Thailand's ISO market has real players in all three lanes, and none of them are interchangeable. Understanding the boundaries between them is most of the evaluation work — the rest is asking the right questions once you know which lane you are standing in.
The three categories, and why they cannot substitute for each other
Certification bodies — SGS, BSI, TÜV, and Bureau Veritas are among the well-known accredited names — audit and issue certificates. By impartiality rules that govern accreditation, a CB legally cannot also consult on how you build the system it later audits. If a CB representative offers to help you "implement" ahead of your audit with them, that is worth asking about directly — the honest answer should be a clear boundary, not a workaround.
QMS software vendors sell platforms you configure yourself: document workflows, CAR/NC tracking, audit modules. They have no certification authority and generally do not do hands-on SOP writing; they give you the tool and, depending on the vendor, some onboarding support.
Traditional implementation firms do the manual work of writing procedures, running gap assessments, and preparing you for certification, typically without software as part of the deliverable.
A commissioned automation build — which is where we sit — is a fourth lane: not a certifying body, not a configure-yourself platform, not manual documentation work. It is software built around your existing SOP and handed over as something you own. Knowing this map before your first call means you are evaluating the right provider against the right criteria, not comparing a CB's audit fee against a software vendor's license cost as if they solve the same problem.
Evaluation checklist by category
| Category | What to verify | What to be cautious about |
|---|---|---|
| Certification body | Accreditation status, audit scope, scheduling lead time | Any offer to also consult on implementation — check impartiality boundaries directly |
| QMS software vendor | Whether the standard workflow matches your actual approval gates, total cost including per-seat fees, data export/ownership terms | Customization costs that turn a fixed license into an open-ended project |
| Traditional implementation firm | Who does the actual writing (them or you), timeline realism, whether output is documents only or includes ongoing support | Generic templates presented as if built specifically for your operation |
| Commissioned automation build | Whether logic is derived from your written SOP, what you own after handover, how human decision gates are preserved | Any vendor implying the system will judge document adequacy — that is not compliant |
Questions worth asking any provider, regardless of category
- What exactly do we own when this is finished? A completed SOP document, a configured software account, or a system with no ongoing license — the answer should be unambiguous.
- Where does human judgment stay in the process? ISO 9001 requires a competent person to judge content adequacy. Any provider who claims their system "handles approvals" needs to explain precisely where the human decision sits.
- Is your process derived from our actual SOP, or from a generic template? Ask to see how they would map your specific gates and registers before you sign anything.
- What happens if our process changes next year? A rigid platform and a flexible one behave very differently when your SOP evolves.
- Can you show us the actual mechanics, not a slide deck? A provider who can walk through a real system — what fields get written, what triggers each step — is showing you evidence. A provider who can only show marketing screenshots is showing you a pitch.
A category-specific warning worth repeating
If a certification body offers implementation help ahead of an audit it will also perform, that is a direct impartiality conflict under the accreditation rules CBs operate under — not a value-add. It is a fair, specific question to ask any CB directly, and a professional one will give you a clear, unembarrassed answer about where their boundary sits.
The same logic applies in the other direction. If a software vendor or an implementation firm implies it can also issue or influence your certificate, that claim does not hold up either — certification authority sits with the accredited CB alone, and no amount of onboarding support or gap-analysis work changes that. Providers who are clear about what they cannot do tend to be more reliable about what they can.
How this connects to the build-vs-buy decision
Evaluating providers and choosing between a document management system and purpose-built QMS software are related but separate decisions. You can pick the right category of provider and still end up choosing the wrong solution shape for your actual document volume and process complexity. See the three provider types compared directly and build, buy, or commission for how the two decisions fit together.
FAQ
Can a certification body also help us implement our QMS?
Not for the audit it will perform on you — accreditation rules require impartiality between consulting and certifying the same client. This is worth confirming directly with any CB you are evaluating.
Is QMS software a substitute for an implementation firm?
Not exactly. Software gives you structure and tooling; it does not write your procedures or run your gap assessment. Some companies need both.
How do we know if a provider is using a generic template versus building for us specifically?
Ask to see how they would map one of your actual documents through their process before signing. A generic-template provider will struggle to get specific quickly.
What is a reasonable first step before committing to any provider?
Send your current SOP and document set and ask for a scoped response. A provider who can respond specifically to your material, rather than a general pitch, is showing you how they will actually work.
Does 1% EVO replace a certification body or an implementation firm?
No. We build the automation layer that removes manual document-control work after a human decision. Certification and, where you need it, procedure writing are separate services you may still need alongside what we build.
If you want a straight read on which category of provider actually fits your situation, book a free consultation with 1% EVO. We will walk through what you are weighing it against and show you a live demo of what a commissioned build looks like running.