By law, the certifiction activities done by the EASA (I assume the FAA is the same) cannot be done by third parties. It also worth noting, that the aircraft certification procedures worked pretty well for
decades, up until Boeing started to lie to the FAA. Not sure how Boeing kept its design org approval after that.
EDIT: Some required activities by the organizations to be certified can be outsourced to third parties, the org itself is still accountable.