A bid question on a Friday
A tender response is due on Monday. One question asks for the names, certifications and expiry dates of every consultant who would work on the contract, with certificates attached. Your bid manager emails the team. Some reply with a screenshot of a certificate, some with a PDF, some with 'I think it renewed last year'. One consultant's certification expired last month and nobody noticed, including them.
Separately, a client's framework requires testers on their work to hold a particular certification. Your scheduling spreadsheet does not record who holds what, so your operations manager asks around each time.
And your practice lead is trying to plan the training budget without knowing whose certifications need renewing this year or how many continuing education credits each person still needs.
The information exists, spread across certificates in inboxes, the certifying bodies' own portals and each consultant's memory. It is just never in one place when you need it.
Why certifications are hard to keep track of
- Each certification has its own expiry, renewal fee, exam or credit requirements.
- Credits are logged by consultants in each certifying body's portal, separately.
- Certificates are held by the individual, not the firm.
- Clients and frameworks require specific certifications, and those requirements change.
- People join and leave, and their certifications go with them.
Certifications commonly held in UK security firms include those from CREST, Offensive Security's OSCP, ISC2's CISSP and others. Each has its own rules, and the firm needs a view across all of them.
Edge cases pile up quickly: a consultant who holds a certification through a previous employer's membership, one who has passed an exam but not yet received the certificate, one whose renewal fee was paid personally and never reclaimed. A register that ignores these ends up as unreliable as the email trail it replaced.
What gaps cost
| Gap | Consequence |
|---|---|
| Lapsed certification not noticed | Consultant cannot be assigned where required |
| Bid evidence gathered by email | Late or incomplete bid response |
| Client requirement not recorded | Wrong person booked, reshuffle |
| Credits short near renewal | Rushed training, or a lapse |
| Training budget planned blind | Spend in the wrong place |
Some of this carries more weight than an internal inconvenience. If a scheme membership or a client framework depends on your firm having a number of people holding particular certifications, a lapse you did not notice can affect work you are already delivering, not just the next bid.
The certification register we build
- Each consultant has a profile with their certifications, issue and expiry dates, certificate files and membership numbers.
- Each certification type has its renewal rules recorded: expiry period, credits needed, and any exam or fee.
- Consultants log training and credits against their certifications in one place, as they happen, with evidence attached.
- Reminders go to the consultant and their manager ahead of expiry, and earlier if credits are short.
- Client and framework requirements are recorded against clients, so scheduling only suggests people who meet them.
- A bid pack can be generated in minutes: selected consultants, their certifications, expiry dates and certificates, in your bid format.
Where a certifying body offers a way to verify certifications, we use it. Otherwise the register holds what the consultant uploads, reviewed by a manager.
What changes for the practice
Bid managers answer certification questions in minutes, with evidence attached. Operations only book people who meet a client's requirements. Consultants see their own renewals and credits in one place. The practice lead can see the year ahead: whose certifications need renewing, what training is needed, and where the firm is thin on a certification clients keep asking for.
When someone leaves, their certifications drop off the firm's list automatically, and you can see straight away whether that leaves a gap for any client requirement.
A normal month looks like this. Two consultants get a reminder that their certifications expire later in the year and that they are short of credits; their manager sees the same and books them onto a course. A bid arrives asking for certified testers; the bid manager picks four names and downloads a pack with certificates attached. A new client framework is added with a certification requirement, and scheduling immediately stops suggesting people who do not hold it.
Is this your situation?
- Certification evidence for bids is gathered by emailing the team.
- A certification has lapsed without anyone noticing.
- Scheduling does not check client certification requirements.
- Training credits are tracked only in individual portals.
- The training budget is planned without a view of renewals.