Implement NEN 7510 yourself or with a consultant?
You can implement NEN 7510 yourself, as long as someone in your organisation has the time, the knowledge and the mandate to lead the process. A consultant makes sense if you do not have those three in-house, or if the certification date is fixed and there is no room for delay. What you can never outsource is ownership of the measures: the consultant helps, the organisation decides.
For the overall picture of costs and lead time, see NEN 7510 certification: costs and timeline. This page covers the choice between doing it yourself and hiring help. The tasks per phase are in the step-by-step plan, the role of the lead on the project leader page, and what the standard requires in the requirements of NEN 7510.
What you cannot outsource
- The decision on scope and measures. The board must approve and sign it off.
- Ownership of measures. A consultant can write a policy, but the owner must carry it out and monitor it.
- Day-to-day management. Checking logs, managing access and following up incidents remain the organisation’s responsibility.
- The certification itself. The certification body is independent. Under the accreditation standard ISO/IEC 17021-1, a certification body may not design or advise on a client’s management system itself. A consultant from the same body is therefore a conflict of interest.
What you can outsource
- A gap analysis against the requirements of the standard, see the requirements of NEN 7510.
- A first version of the risk analysis and the Statement of Applicability (VvT, Verklaring van Toepasselijkheid).
- Drafting the mandatory documents, see mandatory documents.
- A trial audit, see the internal audit.
Decision guide in five questions
Answer the questions honestly. As a rule of thumb (practical experience, not a requirement), a consultant for the first phase is usually the sensible choice if the answer is “no” three or more times.
- Do you have someone who can spend at least one day a week on the process?
- Does that person have experience with a management system, for example ISO 9001 or ISO 27001?
- Do you know the care processes and systems in scope well enough to assess risks?
- Is there a fixed deadline, for example from a tender or a client?
- Can you free up time for internal audits and findings?
Example calculation
Fictional example of a physiotherapy practice with four staff:
| Route | Input | Cost structure | Risk |
|---|---|---|---|
| Yourself, with the practice manager | About 6 hours a week, six months (around 150 hours) | Internal time, plus certification costs | Delay if the manager leaves |
| Consultant for gap analysis and documents | A few days of work once, then self-managed | One-off consultancy fee, plus internal time | Dependence on one consultant |
| Fully outsourced | The consultant takes over the process | Higher consultancy fee | No ownership, maintenance after certification is difficult |
Consultancy rates are not included because they differ strongly per consultant and per region. For comparison, costs and timeline mentions, as an indication, 100 to 200 internal hours and €3,000 to €10,000 in external support for a small organisation. Get at least three quotes and compare the scope and deliverables in each.
Where people often go wrong
- Fully outsourcing without ownership. After certification, it turns out nobody can maintain the system.
- Starting yourself without a gap analysis. The process gets stuck because nobody knows how much work is left.
- Choosing a consultant on price alone. Ask about experience with healthcare and with the certification body you choose.
- No plan for the period after certification. The certificate stays valid only if you maintain the system. The certification body checks this with surveillance audits, every year according to the audit cycle.
A practical order
Start with a gap analysis, whichever route you choose. After that, it is sensible to do the first phase of the step-by-step plan yourself, and bring in a consultant for the points you cannot assess yourself. For small practices, there are sometimes collective solutions through an industry body. Read about these on NEN 7510 for small practices.
Additional notes
- This is a decision guide, not advice for a specific organisation. The five questions and the example calculation are practical indications and fictional, not requirements of the standard.
- Whether a consultant may also take on the audit role is decided by the certification body. Ask this in advance.
- The text of the standard must be purchased. Use this page as orientation and check the requirements in the standard itself.