# Forefront Certification Limited (FFC) - **Type:** Certification body - **Website:** https://ffcert.com/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A UK certification body for management system standards. UKAS accredits it to certify organisations to ISO/IEC 27001:2022, the information security standard, in the UK only. ## Forefront Certification scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 No public record found of any UKAS sanction, suspension or withdrawal against FFC's own accreditation (checked UKAS sanctions pages and news, 2026-09-19; absence noted, not proof of a clean history). FFC does publish a clear internal complaints/appeals and certificate-suspension policy (doc FF69) with defined response timelines, but this is a process description, not a published track record of actual incidents handled. ### Qualifications of the people who do the work: 4/5 UKAS schedule 8933 (Issue 033, 24 April 2026) verifiably lists ISO/IEC 27001:2022 ISMS certification under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, directly checkable on ukas.com. Held back from 5 because FFC's own ISO 27001 page currently misstates this same accreditation as not yet held, undermining the credential as presented to a buyer. ### What it publishes about fees: 3/5 FFC states a 'fixed daily rate with no hidden fees' model, with days calculated to UKAS-specified guidelines by scope and headcount (ffcert.com/certification/iso-27001/, checked 2026-09-19), but publishes no rate card, day-rate figure or worked example. ### Knowledge of your sector: 2/5 UKAS case study and schedule show FFC certifies across generic sectors (construction, manufacturing, recycling, transport, education, IT) with standard IAF-code carve-outs, but no named information-security sector specialist or ISO/IEC 27001 client case study was found (checked ffcert.com and ukas.com, 2026-09-19). ### Independence from what it sells: 4/5 Published impartiality policy states FFC cannot and does not offer consultancy itself, keeps a conflict-of-interest register, and runs an open, non-exclusive 'Associate Consultant Network' for referrals with no single favoured consultant found (ffcert.com/impartiality-confidentiality/ and /consultants/, checked 2026-09-19). Not 5 because the referral network's commercial terms (fees, if any) are not disclosed. ### Who carries the risk if the advice is wrong: 3/5 Doc FF69 publishes detailed complaints, appeals and suspension/withdrawal procedures with set timelines (e.g. 10 working days to a proposed action), but no professional indemnity insurance cover or level is disclosed anywhere on the site (checked 2026-09-19). ## Sources for Forefront Certification Every line carries the page it was read on and the date it was checked. - Companies House number for Forefront Certification Limited, active, incorporated 28 April 2014 - Source: https://find-and-update.company-information.service.gov.uk/company/09014372 - Checked: 2026-09-19 - UKAS Schedule of Accreditation (body 8933) lists Forefront Certification Limited as accredited to ISO/IEC 17021-1:2015 and confirms ISMS certification to ISO/IEC 27001:2022 under ISO/IEC 27006-1:2024 - Source: https://www.ukas.com/wp-content/uploads/schedule_uploads/00011/04947/8933Management-Systems.pdf - Checked: 2026-09-19 - UKAS schedule states FFC's accredited ISMS (ISO/IEC 27001) certification capability applies only in the country in which it is established (UK), unlike its other schemes which name additional countries - Source: https://www.ukas.com/wp-content/uploads/schedule_uploads/00011/04947/8933Management-Systems.pdf - Checked: 2026-09-19 - Registered office address on Companies House - Source: https://find-and-update.company-information.service.gov.uk/company/09014372 - Checked: 2026-09-19 - FFC's own ISO/IEC 27001 product page currently states the firm is not UKAS-accredited for that standard and is still seeking accreditation, which contradicts the live UKAS schedule - Source: https://ffcert.com/certification/iso-27001/ - Checked: 2026-09-19 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - UKAS accredits it to certify information security management systems to ISO 27001. - Published impartiality policy states FFC does not itself offer consultancy (barred by its accreditation rules), keeps a conflict-of-interest/impartiality register, and commissions an annual independent impartiality review of its operations. - A detailed, published complaints, appeals and certificate suspension/withdrawal procedure (doc FF69) sets defined timelines, e.g. a proposed action to a complainant within 10 working days. - Consultancy support is routed through an open, non-exclusive 'Associate Consultant Network' rather than an in-house or single-partner consultancy, with no evidence found of a favoured or exclusive consultant. - UKAS accreditation history stretches back to 2017 (originally for ISO 9001/14001/45001), and Companies House filings (accounts, confirmation statements) are up to date with no strike-off or gazette notices. ## Things to check Each one carries the factual basis it rests on. - FFC's own ISO/IEC 27001 page says it is 'not accredited by UKAS' and is 'in the process of getting certified,' which is out of date and contradicts the current UKAS schedule confirming accreditation for that exact standard, a real accuracy problem in the firm's public-facing material. - Basis: Compared ffcert.com/certification/iso-27001/ (checked 2026-09-19) against the live UKAS schedule for body 8933, Issue No. 033, dated 24 April 2026 (ukas.com PDF). - No professional indemnity insurance disclosure was found anywhere on the firm's site or in its published rules document. - Basis: Checked ffcert.com policy/footer pages and the FF69 'Rules and Regulations' document; no PI insurance figure, insurer or cover level is stated (checked 2026-09-19). - No named client case study or reference for an actual ISO/IEC 27001 certification was found; the only public case study is a UKAS profile about FFC's own growth as a certification body, not a client's information-security outcome. - Basis: ukas.com/resources/resources/case-study-forefront-certification/, checked 2026-09-19, describes FFC's own remote-assessment story, not a certified client's ISMS outcome. - FFC's own published complaints/appeals/rules document (FF69, 'Reviewed: Oct 2024') still lists its scope as ISO 9001, ISO 14001 and ISO 45001 only, with no mention of ISO/IEC 27001 or ISO 50001, suggesting the document has not been updated since those accreditations were added. - Basis: ffcert.com rules-and-regulations PDF (doc ref FF69, issue level 4.2), Section 1 'Introduction', checked 2026-09-19. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.