Our Service Lines
We are your ally in organizational growth. Six specialized lines covering the full spectrum of management, regulatory compliance and security.
Implementation and certification of ISO management systems
We design, implement and take ISO management systems through to certification, integrating quality, environmental, occupational health and safety and energy requirements into a single documented structure. Integration avoids duplicating procedures, audits and records: one system answers several standards at once.
- Implementation
- Administration
- Improvement
- Audit
What we deliver
- Gap analysis against the standard, with a compliance percentage for each clause
- Process map, process characterizations and the minimum documented information required
- Risk and opportunity matrix, and determination of the context and interested parties
- Indicators, objectives and a monitoring dashboard for the system
- Internal audit programme and execution with accredited lead auditors
- Management review and preparation for the certification audit
- Support during the certification body audit and closure of findings
Standards and reference framework
| ISO 9001 | Quality management |
| ISO 14001 | Environmental management |
| ISO 45001 | Occupational health and safety |
| ISO 50001 | Energy management |
| ISO 22000 | Food safety |
| ISO 19011 | Guidelines for auditing management systems |
| Annex SL | Harmonized high-level structure |
Accreditation with ONAC and equivalent bodies across Latin America
We support laboratories, inspection bodies, certification bodies and validation and verification bodies throughout the accreditation cycle: from the initial gap analysis against the applicable scheme to the closure of assessment findings. Our operations director has been an ONAC Lead Evaluator since 2012, so the system is built with the same criteria by which it will later be assessed.
- Implementation
- Certification Service
- Improvement
- Audit
What we deliver
- Gap analysis against the applicable accreditation scheme and against the accreditation body's specific criteria
- Design of the body's management system: impartiality, confidentiality, competence and structure
- Definition and evidence of the technical competence of assessment personnel
- Method validation, measurement uncertainty estimation and assurance of the validity of results
- Programme of participation in proficiency testing and interlaboratory comparisons
- Internal audit and management review applying assessor criteria
- Preparation and support for the assessment visit and closure of nonconformities
Standards and reference framework
| ISO/IEC 17025 | Testing and calibration laboratories |
| ISO/IEC 17020 | Inspection bodies |
| ISO/IEC 17024 | Certification bodies for persons |
| ISO/IEC 17021-1 | Management system certification bodies |
| ISO/IEC 17065 | Product, process and service certification bodies |
| ISO/IEC 17029 | Validation and verification bodies |
| ISO 15189 | Medical laboratories |
| ISO/IEC 17043 | Proficiency testing providers |
| ISO 17034 | Reference material producers |
| ISO 14065 | Greenhouse gas validation and verification |
OHS management system (SG-SST) and ISO 45001 certification
We implement the Occupational Health and Safety Management System with two simultaneous objectives: to meet the Colombian regulations that are mandatory and enforceable, and to leave the system ready for ISO 45001 certification when the organization needs it in order to bid for contracts or to satisfy head-office requirements.
- Program Advisory
- OHS Management Audit
- Competency Development
- Work at Heights · Boilers · Lifting
- Electrical Hazard · Confined Spaces
What we deliver
- Self-assessment of minimum standards and improvement plan with auditable evidence
- Hazard identification, risk assessment and evaluation matrix under GTC 45
- Annual work plan, budget and schedule for the OHS management system
- Matrix of applicable legal requirements and its periodic verification
- Epidemiological surveillance programmes and emergency plan with response brigades
- Investigation of workplace incidents and accidents with root cause analysis
- Structure, process and outcome indicators, and accountability reporting
- Internal audit and preparation for ISO 45001 certification
Standards and reference framework
| ISO 45001 | Occupational health and safety management systems |
| Decree 1072 of 2015 | Single Regulatory Decree of the Labour Sector — Chapter 6 |
| Resolution 0312 of 2019 | Minimum standards for the OHS management system |
| GTC 45 | Hazard identification and risk assessment |
| ISO 31000 | Risk management — guidelines |
Compliance, anti-bribery and self-control of ML/TF/PF and corruption risk
We design compliance programmes that withstand an inspection: risk identification with a traceable methodology, effective due diligence on counterparties, a whistleblowing channel that actually works and documented evidence that the programme operates. A paper programme protects no one; a programme with evidence does.
- Implementation
- Administration
- Improvement
- Audit
What we deliver
- Determination of whether the organization is a regulated entity and under which regime
- ML/TF/PF and corruption risk matrix with a documented, traceable methodology
- System manual, policies and appointment of the compliance officer
- Due diligence and enhanced due diligence procedures for counterparties
- Whistleblowing channel, internal investigation protocol and whistleblower protection
- Training programme by level, with evidence of attendance and understanding
- Reports to the Superintendence and to the UIAF, and reports to the highest corporate body
- Audit of the programme and gap-closure plan
Standards and reference framework
| ISO 37301 | Compliance management systems |
| ISO 37001 | Anti-bribery management systems |
| ISO 31000 | Risk management — guidelines |
| External Circular 100-000020 of 2026 | Superintendence of Companies — Risk Self-Control and Management System |
| Law 2195 of 2022 | Transparency, prevention and the fight against corruption |
| Law 1778 of 2016 | Liability for transnational bribery |
ISO/IEC 27001 ISMS, personal data protection and technical testing
We bring together the two sides of cybersecurity that are almost always contracted separately: the management system the standard requires and the technical verification that proves the controls work. We implement the ISMS and subject it to real intrusion testing, so that the statement of applicability is backed by evidence.
- Management System
- Personal Data Protection
- Ethical Hacking
- Pentesting / Vulnerability Analysis
What we deliver
- Information security risk analysis using the ISO/IEC 27005 methodology
- Statement of applicability justified control by control
- ISMS policies, procedures and controls under the Annex A in force
- Inventory and classification of information assets
- Business continuity and disaster recovery plan
- Personal data protection programme and registration of databases with the SIC
- Ethical hacking, pentesting and vulnerability analysis with executive and technical reports
- Internal audit and preparation for ISO/IEC 27001 certification
Standards and reference framework
| ISO/IEC 27001 | Information security management systems |
| ISO/IEC 27002 | Information security controls |
| ISO/IEC 27005 | Information security risk management |
| ISO/IEC 27701 | Privacy information management |
| ISO 22301 | Business continuity |
| Law 1581 of 2012 | Personal data protection — Colombia |
| Decree 1074 of 2015 | National Database Registry |
Platform for the administration of certification services
VELTA is the platform we are developing for accredited Conformity Assessment Bodies: it manages the full certification service cycle —application, application review, scheduling, execution, decision and surveillance— with the traceability and records the accreditation scheme requires, in a single system.
- Coming soon
What we deliver
- Registration and review of applications with verification of scope and competence
- Audit scheduling, audit team assignment and impartiality control
- Electronic client file holding all the evidence of the cycle
- Certification decision control kept separate from audit execution
- Management of the surveillance, renewal, suspension and withdrawal cycle
- Reports for the accreditation assessment
Standards and reference framework
| ISO/IEC 17021-1 | Traceability of the management system certification cycle |
| ISO/IEC 17024 | Records of the certification process for persons |
| ISO/IEC 17065 | Records of the product certification process |
Interpret regulatory requirements like a senior professional
LEARN is AXONA's technical school: more than 20 years and more than 500 companies supported across Latin America, turned into courses that start from the official standard and deliver tools you can apply the following Monday.
- Management Systems
- Accreditation Models
- Internal Auditor Training
- Standards Updates
What's included
- 100% online, asynchronous e-learning, from any device and at your own pace
- Content developed by experts with 25+ years of experience in management systems and cybersecurity
- Executive workbook with a clause-by-clause analysis: what was added, modified and removed
- GAP analysis with an action verification matrix and editable templates
- Learning assessment and an internationally verifiable digital credential issued through Acreditta, ready for LinkedIn
- One-to-one mentoring in the advanced levels
Training levels
| Level 1 · Know | What does it say and what changed? |
| Level 2 · Interpret | What do I need to do? |
| Level 3 · Sustain | How do I sustain it over time? |
| Level 4 · Lead | How do I lead it? |
What clients ask us before we start
How long does it take to implement an ISO 9001 management system and get it certified?
In a mid-sized organization with defined processes, between six and nine months up to the certification audit. The time depends on three factors: the number of sites and processes in scope, the real availability of the internal team to work on the project, and the documentary maturity at the outset. An initial gap analysis makes it possible to give a realistic date before committing budget.
What is accreditation and how does it differ from certification?
Certification is granted by a certification body to a company that meets a standard, for example ISO 9001. Accreditation is granted by the national accreditation body —ONAC in Colombia— to the bodies that provide conformity assessment services: laboratories, inspection bodies and certification bodies. In other words, accreditation is the formal recognition that whoever certifies, inspects or tests is technically competent to do so.
Is my company required to implement SAGRILAFT or PTEE?
Since External Circular 100-000020 of 2 July 2026, both regimes were merged into the Superintendence of Companies' Risk Self-Control and Management System for ML/TF/PF and corruption. The general threshold is 4,929,017 UVB in revenue or assets, measured at 31 December of the immediately preceding year, and exceeding either of the two criteria is enough. The real estate, precious metals and stones, legal and accounting services, construction and infrastructure, and vehicle trading sectors have a reduced threshold of 3,696,762 UVB, and enter the Minimum Measures Regime from 369,676 UVB in revenue or 616,127 UVB in assets. CONFECAMARAS, SAPAC, payroll-loan operators, cattle funds and factoring companies are covered with no threshold. Implementation is enforceable no later than 31 May 2027.
Is ISO 9001:2026 already published, and what should I do if I am already certified?
Yes. ISO published the sixth edition on 16 September 2026. A three-year transition period is expected: ISO 9001:2015 certificates would remain valid until 30 September 2029, subject to confirmation by Global ACI (the body that replaced the IAF) and to what your certification body indicates. If your organization is already certified to ISO 9001:2015, there is no need to rebuild the system: the sensible route is a gap analysis against the new text and planning the transition so that it coincides with a surveillance or recertification audit already scheduled, rather than with an additional audit.
Can AXONA certify my company?
No, and that separation is deliberate. A consultancy that implements the system cannot certify it: accreditation standards require independence between the adviser and the certifier. AXONA implements, audits internally and prepares the organization; certification is issued by an accredited certification body, and we accompany our clients through that audit.
Do you work with companies outside Colombia?
Yes. We provide services across Latin America remotely: Colombia, Mexico, Peru, Chile, Ecuador, Panama, Costa Rica and Central America. ISO standards are identical in every country, and for accreditation we work with the national schemes equivalent to ONAC. Management systems consulting does not require a permanent physical presence: it runs on working sessions, document review and audits that can be remote or on-site depending on the stage.
What is the difference between ISO 45001 and the Colombian SG-SST?
The SG-SST under Decree 1072 of 2015 and Resolution 0312 of 2019 is mandatory for every company with employees in Colombia and non-compliance is punishable. ISO 45001 is a voluntary, certifiable international standard. They share most of their requirements, so a well-designed system meets the Colombian regulation and is ready for ISO 45001 certification without redoing the work.
How is a management systems consulting project quoted?
From a free scoping diagnostic in which we define three variables: which standards are included, how many processes and sites the scope covers, and which part of the work the internal team takes on. With that we deliver a proposal with deliverables, a schedule and a fixed price, with no hourly billing.
AXONA is an Authorized Distributor of ISOLUCIÓN, the leading platform for Integrated Management System software in Latin American organizations.
Let's Talk About Your Project
Remote consulting across Latin America
ISO standards are identical across the region, and management systems consulting does not require a permanent physical presence: it runs on working sessions, document review and audits that can be remote or on-site depending on the stage. We operate from Bogotá D.C. and support projects across Latin America.