Digital trust calls for both scale and adaptability

Technology alone is not enough to build long-term digital trust, according to Kiwa's Erik Landgren, Managing Director Business Assurance, and Dragan Jovanov, Global Business Development, Sales & Key Accounts. “Demonstrating that trust requires more than secure systems. It calls for business assurance in the true sense of the word: robust governance, effective processes, continual improvement, and independent verification that the right controls are in place. Building that foundation, and keeping it up to date and transparent, is a major challenge," says Erik.

The pressure to demonstrate digital trust is growing across every sector. European Union (EU) legislation and other regulatory requirements are moving faster than many businesses can keep up with. Customers, regulators and business partners increasingly expect organizations to demonstrate that they can be trusted. Companies face scrutiny not just of their own operations but of their entire value chain. Suppliers and technology providers are expected to prove they meet the same standards as the organizations they supply to. The demand for demonstrable assurance has spread across the entire value chain.

In the past, many organizations viewed certification as the end goal of business assurance: a compliance exercise, or even a frustrating hurdle to clear. That has changed. Today, organizations increasingly see it as a broader process. Certification remains an important outcome, supported by activities such as gap assessments, audits, training and independent assurance that help organizations build resilience over time. It’s seen as part of a process to strengthen resilience, manage risk and build trust with customers, regulators and other stakeholders. As Erik puts it, "This is why independent assurance can add so much value. Rather than leaving organizations to work it out alone, a third-party expert can give them a structured framework for fostering, and then demonstrating, trust. Businesses coming to us are looking past individual certificates. They are not looking for a transaction; they are looking for a strategic partner that understands their business, adapts to changing needs and supports them over the long term."

Dragan adds that most companies coming to Kiwa and NQA aren't starting from zero. “They usually know they have some kind of obligation to meet, but not exactly what it is or what it will take to meet it. Turning regulatory requirements and customer expectations into a practical assurance programme can be challenging. That’s where an experienced and dedicated team can support them through the complex, interconnected web of digital trust creation.”

What’s right for your company?

Choosing the right assurance pathway through the maze of certification options depends on a company’s context. Every organization starts from a different place and faces different challenges: from managing different levels of digital risk to navigating complex and widely differing supply chains, often while working through different regulatory requirements in different regional markets. Some organizations need certification to access new markets or join customer supply chains. Others are preparing for emerging regulation or strengthening governance they already have in place. For many, the first challenge is simply understanding which standards are most relevant to their business.

Many organizations begin with core management system standards such as ISO 9001 for quality management, ISO 14001 for environmental management, ISO 50001 for energy management, and ISO 27001 for information security, which have become baseline expectations across many industries. Depending on their sector and business priorities, they may then adopt more specialized standards, such as ISO 27701 for privacy management, ISO 27017 and ISO 27018 for cloud security, ISO 20000 for IT service management, or ISO 42001 as organizations begin establishing governance around artificial intelligence.

“If you can get those standardized, globally recognized frameworks in place, you start to create real and lasting trust, rather than simply meeting compliance requirements,” says Dragan.

Your roadmap from digital trust to resilience

For Kiwa and NQA, industry-specific knowledge is a vital element in any digital trust programme. Instead of a blanket application of a single standard, Kiwa and NQA typically combine core and industry-specific services into a bespoke package built around what a particular company actually needs. An aerospace supplier may combine core management system standards such as ISO 9001 and ISO 14001 with AS9120, while also adding emerging services such as ISO 14064 greenhouse gas verification as sustainability expectations grow. A manufacturer may be combining product and system certifications into one efficient programme. Another organization may be operating in a regulated, critical infrastructure sector where rising cyber maturity expectations are driving demand for a broader assurance package rather than a single certificate.

Rather than managing separate audits, risk registers and management reviews for every standard, organizations benefit from integrated management systems that reduce duplication, improve efficiency and create a more consistent assurance programme across the business.

Global scale, local adaptability

When Kiwa and NQA joined forces at the end of 2024, it brought together two organizations with complementary strengths. NQA came with a well-established international reputation, particularly across the UK, US and China. The partnership brings together deep sector expertise in areas like aerospace, automotive, construction,  general manufacturing, information technology, food, medical, and services industries, alongside an extensive global auditor network built over decades. Combined, the two organizations now support more than 150,000 certificates worldwide through a network of over 5,000 auditors.

For Erik, that scale changes what's possible for customer organizations. "We now have the ability to serve global customers efficiently and comprehensively," he says. "It would have taken Kiwa a tremendous amount of effort and risk to build that on our own. Now, global organizations can rely on us to coordinate assurance programmes consistently across countries while still responding to local regulatory and operational requirements."

Of course, scale on its own does not win trust. Beyond the global reach Kiwa and NQA offer together, both Erik and Dragan point to something less obvious as the distinguishing factor: customer experience. "Because of the very fact that we are not the biggest player on the global market, but a strong challenger, we're willing and able to adapt. We will always respond when something isn't working for a customer. We focus on getting it right for that particular customer. We work collaboratively to understand their business, adapt as their needs change, and build long-term relationships rather than simply delivering certificates," says Dragan. “Companies are increasingly looking for business outcomes, not individual services. They want a partner who can help them navigate complexity, simplify what's required of them and build confidence for the long term. Because of the complexity of business assurance and digital trust, customer experience can make or break the collaboration.”

Erik adds, “Whether we are supporting a growing regional business or a multinational operating across dozens of markets, Kiwa and NQA bring together global reach, specialist expertise and the flexibility to tailor assurance to each customer's needs. Our dedicated account teams, collaborative approach to designing solutions, and flexibility to tailor a programme to a specific customer's needs all come from the desire to listen first, then create the right pathway.”