If a mortgage-support proposal relies on an ISO/IEC 27001 certificate, check what the certificate relates to before treating it as evidence for the service you are buying. A verified certificate for a document platform answers a different question from certification covering a provider's staff-operated processing service.
This guide helps Australian brokerage owners connect a supplier's certification claim to the proposed processor or assistant arrangement. Its original scope map and fictional example distinguish certificate status, covered activities, delivery arrangements and remaining checks. They do not certify a provider, approve customer-data access or establish that a particular worker is competent.
Identify what the supplier is claiming
Ask the supplier to put the claim beside the proposed service: which organisation holds which certificate, and what part of the arrangement does it say that certificate covers? Request the current certificate and any referenced scope or site schedule. Keep the supplied version with the proposal it is meant to support.
ISO describes ISO/IEC 27001 as a standard setting requirements for an information security management system. Keep that subject clear. Do not turn a management-system certification claim into a statement that a processor has a mortgage qualification, every loan pack will be correct, or the brokerage has met all its obligations.
ISO's certification guidance explains that external certification bodies issue certificates; ISO itself does not. It also distinguishes accreditation of a certification body from certification of an organisation. Record those parties separately rather than treating every logo on a proposal as the same assurance.
Verify status, then investigate the connection to your service
Start with the certificate holder, identifying number, standard and edition, issuer, dates and the exact scope wording. Compare the supplied document with the appropriate verification source. ISO points to IAF CertSearch or direct confirmation with the relevant certification or accreditation body when verifying accredited certification.
The IAF CertSearch documentation describes records containing certification status, the standard, scope, certified locations, issuing certification body and accreditation body. Those are separate fields to inspect, not a single green tick that answers every procurement question.
Keep a dated verification note. If the current record and supplied document differ, identify the difference and ask the issuer to clarify it before recording the claim as verified. Use contact details found through the relevant organisation's official channel, not only a link embedded in an unsolicited attachment.
A missing search result is not proof of fabrication. IAF CertSearch's verification guidance identifies several possible reasons, including a certificate not yet being added or an organisation's name not being publicly available. Use the appropriate enquiry route and leave the finding unresolved until clarified. ISO also says accreditation is not compulsory and its absence does not automatically mean an issuer is disreputable.
Copy the certificate-to-delivery scope map
Use one map per certification claim. The point is to connect the evidence to the purchased work, not collect unrelated certificates. This is an editorial procurement aid, not an ISO audit form.
Scroll sideways to see all columns →
| Connection | Record from the proposal and evidence | Question to resolve |
|---|---|---|
| Holder to supplier | Certificate holder, contracting supplier and any relevant employing or subcontracting entity. | Which entity's management system is certified, and what relationship does it have to the proposed service? |
| Scope to activities | Exact scope wording alongside the tasks you intend to purchase. | Does the evidence address staff-operated document preparation, platform hosting, or another activity? |
| Locations to delivery | Referenced locations or schedules alongside the proposed office, remote or hybrid arrangement. | What confirmation explains how this delivery arrangement relates to the certified scope? |
| Certificate to verification | Identifier, standard, issuer, accreditation information where applicable, status, source and check date. | What was independently confirmed, and what still relies on an unanswered supplier assertion? |
Do not assume every remote worker's address must appear individually on a certificate. Equally, do not infer that an unmentioned arrangement is included. Where the documents do not settle the relationship, ask for the relevant scope explanation and issuer confirmation. Avoid requesting home addresses or borrower records merely to fill a procurement worksheet.
Work through a fictional two-certificate proposal
Every organisation, document description and response below is invented. The brokerage proposes to buy factual document-pack preparation from Harbour Support, with an office-based processor and occasional home-based cover. The worker would use a hosted document platform. The exercise examines the certification claim only, not whether the arrangement should be hired or granted access.
Harbour supplies two records. The platform operator's certificate has been verified as current and its stated scope concerns hosting the document service. Harbour also supplies its own current certificate, with scope wording referring to client-record administration at its delivery centre. The supplied material does not explain the proposed home-based cover.
Scroll sideways to see all columns →
| Purchased component | Evidence supplied | Finding to record |
|---|---|---|
| Hosted document platform | Verified platform-operator certificate with hosting scope. | Evidence relates to the hosting component. Do not use it alone to describe Harbour's staff-operated service as certified. |
| Office-based preparation | Harbour certificate and an issuer clarification confirming that the described administrative preparation at the delivery centre falls within its scope. | The stated scope connection is confirmed for this office-based activity. Operational and worker checks remain separate. |
| Home-based cover | No explanation connecting the proposed cover arrangement to Harbour's certification scope. | Unresolved. Ask about this arrangement rather than assuming inclusion or declaring the certificate invalid. |
In the next fictional response, the issuer confirms that the proposed home-based cover is outside the scope described in Harbour's current certificate. The certificate itself remains current. The missing connection concerns the proposed service arrangement, not a finding that the certificate is fake or that all home-based work is unsafe.
For this example, the brokerage's own purchasing requirement is that both ordinary preparation and cover fall within the supplier's verified certification scope. The proposal therefore does not yet meet that requirement. Harbour could propose suitable cover within the confirmed scope, or supply evidence of a relevant scope change if one occurs. The owner should not quietly remove the requirement while recording the original offer as having passed.
If Harbour revises the offer to use cover at the confirmed delivery centre, check the revised activity and arrangement against the issuer's explanation. Record the narrower conclusion: the certification-scope requirement has been addressed for that revised proposal. That is not final supplier approval.
Keep the remaining hiring decision visible
Return to the provider due-diligence checklist for the actual service, data handling, responsibilities and exit arrangements. Test the proposed account through the access-permissions process. Assess the person's preparation work separately using an appropriate fictional exercise.
Keep statutory supply permissions in the labour-hire licence review where relevant, and insurance questions in the professional-indemnity review. A management-system certificate does not answer those different questions.
Close the scope map with the precise claim verified, supporting source, date, unresolved condition and owner. Recheck its relevance when the proposed activity, delivery location, supplying entity or certificate status changes. Do not reuse a finding about one service configuration as a blanket endorsement of later offers.
When discussing a processor vacancy or an assistant hire with Mortgage Talent, bring the actual duties, delivery constraints and evidence requirements. Confirm what the proposed arrangement can support. This guide makes no certification claim about Mortgage Talent or any supplier.
Take the next step
Explore Mortgage Talent or speak with our team about your hiring needs.