The Assurance DeskWhat Forefront Certification offers, and what it publishes
Forefront Certification is UKAS-accredited for ISO 27001, though its own website says otherwise. UKAS's schedule, issued 24 April 2026, covers ISO/IEC 27001:2022 certification in the UK only. Its ISO 27001 page still says it is 'not accredited by UKAS'. Check the UKAS schedule before you sign.
Forefront Certification does not publish a price. It says it charges a fixed daily rate with no hidden fees, but gives no figure or worked example. It does not publish its indemnity cover. It shows no named client case study for ISO 27001 work.
Forefront Certification says it sells no consultancy, as its accreditation rules require, and refers applicants to an open network of outside consultants. Its complaints rules set deadlines, such as 10 working days, but were last reviewed in October 2024 and still list only ISO 9001, 14001 and 45001. UKAS does not accredit it for ISO/IEC 42001, the AI management standard.
Strengths
- UKAS accredits it to certify information security management systems to ISO 27001.
- Published impartiality policy states FFC does not itself offer consultancy (barred by its accreditation rules), keeps a conflict-of-interest/impartiality register, and commissions an annual independent impartiality review of its operations.
- A detailed, published complaints, appeals and certificate suspension/withdrawal procedure (doc FF69) sets defined timelines, e.g. a proposed action to a complainant within 10 working days.
- Consultancy support is routed through an open, non-exclusive 'Associate Consultant Network' rather than an in-house or single-partner consultancy, with no evidence found of a favoured or exclusive consultant.
- UKAS accreditation history stretches back to 2017 (originally for ISO 9001/14001/45001), and Companies House filings (accounts, confirmation statements) are up to date with no strike-off or gazette notices.
Things to check
- FFC's own ISO/IEC 27001 page says it is 'not accredited by UKAS' and is 'in the process of getting certified,' which is out of date and contradicts the current UKAS schedule confirming accreditation for that exact standard, a real accuracy problem in the firm's public-facing material.
- No professional indemnity insurance disclosure was found anywhere on the firm's site or in its published rules document.
- No named client case study or reference for an actual ISO/IEC 27001 certification was found; the only public case study is a UKAS profile about FFC's own growth as a certification body, not a client's information-security outcome.
- FFC's own published complaints/appeals/rules document (FF69, 'Reviewed: Oct 2024') still lists its scope as ISO 9001, ISO 14001 and ISO 45001 only, with no mention of ISO/IEC 27001 or ISO 50001, suggesting the document has not been updated since those accreditations were added.
Common questions
Is Forefront Certification UKAS-accredited for ISO 27001?
Yes. UKAS's schedule, issued 24 April 2026, accredits it to certify organisations to ISO/IEC 27001:2022. Its own ISO 27001 page says it is not yet accredited, which the UKAS schedule contradicts.
Does it publish its prices?
No. It says it charges a fixed daily rate with no hidden fees, with the number of days set by scope and headcount under UKAS guidelines. It publishes no figure.
Can it certify organisations outside the UK to ISO 27001?
No, not under its UKAS accreditation. The UKAS schedule says its ISO 27001 capability applies only in the UK, unlike some of its other schemes.
Does it certify to ISO 42001 for AI?
No. The current UKAS schedule, issued 24 April 2026, does not list ISO/IEC 42001, and we found no AI governance certification or training on its site.
Evidence for each Forefront Certification score
Show our working
Notes behind each thing to check
- FFC's own ISO/IEC 27001 page says it is 'not accredited by UKAS' and is 'in the process of getting certified,' which is out of date and contradicts the current UKAS schedule confirming accreditation for that exact standard, a real accuracy problem in the firm's public-facing material. (Compared ffcert.com/certification/iso-27001/ (checked 2026-09-19) against the live UKAS schedule for body 8933, Issue No. 033, dated 24 April 2026 (ukas.com PDF).)
- No professional indemnity insurance disclosure was found anywhere on the firm's site or in its published rules document. (Checked ffcert.com policy/footer pages and the FF69 'Rules and Regulations' document; no PI insurance figure, insurer or cover level is stated (checked 2026-09-19).)
- No named client case study or reference for an actual ISO/IEC 27001 certification was found; the only public case study is a UKAS profile about FFC's own growth as a certification body, not a client's information-security outcome. (ukas.com/resources/resources/case-study-forefront-certification/, checked 2026-09-19, describes FFC's own remote-assessment story, not a certified client's ISMS outcome.)
- FFC's own published complaints/appeals/rules document (FF69, 'Reviewed: Oct 2024') still lists its scope as ISO 9001, ISO 14001 and ISO 45001 only, with no mention of ISO/IEC 27001 or ISO 50001, suggesting the document has not been updated since those accreditations were added. (ffcert.com rules-and-regulations PDF (doc ref FF69, issue level 4.2), Section 1 'Introduction', checked 2026-09-19.)
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | No public record found of any UKAS sanction, suspension or withdrawal against FFC's own accreditation (checked UKAS sanctions pages and news, 2026-09-19; absence noted, not proof of a clean history). FFC does publish a clear internal complaints/appeals and certificate-suspension policy (doc FF69) with defined response timelines, but this is a process description, not a published track record of actual incidents handled. | |
| Qualifications of the people who do the work | UKAS schedule 8933 (Issue 033, 24 April 2026) verifiably lists ISO/IEC 27001:2022 ISMS certification under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, directly checkable on ukas.com. Held back from 5 because FFC's own ISO 27001 page currently misstates this same accreditation as not yet held, undermining the credential as presented to a buyer. | |
| What it publishes about fees | FFC states a 'fixed daily rate with no hidden fees' model, with days calculated to UKAS-specified guidelines by scope and headcount (ffcert.com/certification/iso-27001/, checked 2026-09-19), but publishes no rate card, day-rate figure or worked example. | |
| Knowledge of your sector | UKAS case study and schedule show FFC certifies across generic sectors (construction, manufacturing, recycling, transport, education, IT) with standard IAF-code carve-outs, but no named information-security sector specialist or ISO/IEC 27001 client case study was found (checked ffcert.com and ukas.com, 2026-09-19). | |
| Independence from what it sells | Published impartiality policy states FFC cannot and does not offer consultancy itself, keeps a conflict-of-interest register, and runs an open, non-exclusive 'Associate Consultant Network' for referrals with no single favoured consultant found (ffcert.com/impartiality-confidentiality/ and /consultants/, checked 2026-09-19). Not 5 because the referral network's commercial terms (fees, if any) are not disclosed. | |
| Who carries the risk if the advice is wrong | Doc FF69 publishes detailed complaints, appeals and suspension/withdrawal procedures with set timelines (e.g. 10 working days to a proposed action), but no professional indemnity insurance cover or level is disclosed anywhere on the site (checked 2026-09-19). |
Sources for Forefront Certification
- Companies House number for Forefront Certification Limited, active, incorporated 28 April 2014 (09014372, Active, incorporated 28 Apr 2014) (Companies House, checked 19 September 2026)
- UKAS Schedule of Accreditation (body 8933) lists Forefront Certification Limited as accredited to ISO/IEC 17021-1:2015 and confirms ISMS certification to ISO/IEC 27001:2022 under ISO/IEC 27006-1:2024 (UKAS accreditation no. 8933, Schedule Issue No. 033, Issue date 24 April 2026) (ukas.com, checked 19 September 2026)
- UKAS schedule states FFC's accredited ISMS (ISO/IEC 27001) certification capability applies only in the country in which it is established (UK), unlike its other schemes which name additional countries (UK-only accredited ISMS capability (Note 1, ISMS section)) (ukas.com, checked 19 September 2026)
- Registered office address on Companies House (Basepoint Business Centre, Isidore Road, Bromsgrove Enterprise Park, Bromsgrove, B60 3ET) (Companies House, checked 19 September 2026)
- FFC's own ISO/IEC 27001 product page currently states the firm is not UKAS-accredited for that standard and is still seeking accreditation, which contradicts the live UKAS schedule ("Currently, Forefront is not accredited by UKAS for UKAS certification... we are in the process of getting certified by UKAS and therefore offering Non-UKAS certification at present.") (ffcert.com, checked 19 September 2026)
UKAS-accredited (accreditation no. 8933) for ISO/IEC 27001:2022 information security management system (ISMS) certification under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, Schedule Issue No. 033, dated 24 April 2026 (stated on ukas.com); scope limited to the UK. UKAS accreditation history dating to 2017, originally covering ISO 9001, ISO 14001 and ISO 45001 management-system certification (per FFC's published accreditation history).
Seeking ISO 42001 certification
Where this firm appears
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.