ISO 9001 has a reputation for binders nobody reads. That reputation comes from systems written to impress an auditor rather than to run a business. For a small firm, the lightest system that reflects real practice is also the one most likely to pass.
For a 20-person contractor, installer or consultancy, the usual reason to certify is commercial: a framework, main contractor or public sector client asks for it or scores it. That's a fine reason, but the certificate only stays cheap to keep if the system behind it is the way you already work, written down and checked.
This guide covers what the standard requires (and what it doesn't), each clause in plain English, how the audits work, what the auditor samples, how to choose a certification body, common nonconformities and a realistic timeline.
Which edition you're working to
Certification today is to ISO 9001:2015, as amended in 2024. The amendment was small: in clause 4.1 the organisation must now determine whether climate change is a relevant issue, and a note in 4.2 says interested parties can have climate-related requirements. For most small firms that means one honest line in your context review, for example that a client's net zero commitments flow down to you, or that extreme weather affects your site programme. It does not mean you need an environmental management system.
A revision of ISO 9001 is in progress at ISO. Until a new edition is published and your certification body tells you its transition arrangements, the 2015 edition with its amendment is what you'll be audited against. Past revisions have come with a transition period of several years, so it isn't a reason to delay.
What's required, and what's over-engineering
The 2015 edition removed most of the mandatory paperwork the older versions were known for. There is no requirement for a quality manual, no list of mandatory procedures, and no requirement for a management representative. What the standard does require is a short list of documents and a longer list of records.
Documents you must maintain:
- The scope of your quality management system, including any requirements you've decided don't apply and why (design and development is the usual one, if you only build to other people's designs).
- A quality policy.
- Quality objectives.
- Whatever other documented information you decide is needed for your processes to run consistently.
Records you must keep (the standard calls this "retaining documented information") include evidence of competence, the results of reviewing customer requirements before you commit, supplier evaluations, calibration of measuring equipment where you rely on it, release of work to the customer, nonconforming outputs, monitoring results, the internal audit programme and results, management review results, and nonconformities with the corrective action taken.
Everything beyond that is your choice. The test for any document: would the work go wrong, or be done inconsistently, without it? If not, don't write it.
| Usually worth having | Usually over-engineering for 20 people |
|---|---|
| A one-page process map from enquiry to handover | A 60-page quality manual restating the standard |
| A job checklist or inspection and test plan for your main work types | A written procedure for answering the phone |
| A short risk and opportunity register | A risk register with 80 rows nobody updates |
| A training matrix showing who's competent for what | Separate competence procedures for every role |
| An approved supplier and subcontractor list with a review date | Annual scored questionnaires for every supplier, including the stationery shop |
| A simple log for complaints, defects and corrective actions | Separate forms for every type of issue |
The clauses in plain English
The requirements sit in clauses 4 to 10.
Clause 4: context
Know your business. What internal and external issues affect your ability to deliver good work (labour availability, client concentration, material prices, regulation, and now climate change if relevant)? Who are your interested parties and what do they need from you (clients, principal contractors, regulators, staff, key suppliers)? What does the system cover? A typical scope reads something like "the installation and maintenance of commercial HVAC systems, from the head office in Leeds and on client sites".
Clause 5: leadership
The directors own the system, not the office manager. The auditor will want the managing director to explain the quality policy and objectives in their own words, show how quality comes up in normal management meetings, and confirm who is responsible for what. Customer focus sits here too: customer and legal requirements must be understood and met.
Clause 6: planning
Think about what could go wrong or could be better, and do something about the important ones. This is "risks and opportunities". The standard doesn't require a formal risk management method or a register, but you need to show you considered them and acted. You also need measurable quality objectives with a plan: what will be done, who, by when, and how you'll know. And if you change the system, plan the change.
In practice: a short register, and three or four objectives such as "reduce snagging items at handover to under five per job by June" or "close all customer complaints within 10 working days", with progress tracked.
Clause 7: support
Have the people, equipment, knowledge and information to do the work. That includes:
- Competence: people are competent on the basis of training, qualifications or experience, and you keep evidence.
- Awareness: staff know the policy, the objectives relevant to them, and what happens if they don't follow the system.
- Measuring equipment: if you rely on a torque wrench, a test meter or a laser level to prove work is right, it needs to be calibrated or checked, and you keep the record.
- Organisational knowledge: the know-how that would walk out of the door with your best engineer, captured somewhere.
- Documented information: documents are approved, current versions are available where they're used, and old ones don't get used by mistake.
Clause 8: operation
The biggest clause, and where most audit time goes. It covers how a job runs:
- Reviewing requirements before you commit: did someone check the specification, programme and terms before you accepted the order?
- Design and development, if you do design. If you don't, exclude it in your scope with a reason.
- Control of external providers: how you choose, approve and monitor suppliers and subcontractors, and what you tell them.
- Delivering the work under controlled conditions: the right information, the right people, the right checks at the right points.
- Release: someone checks the work is right before it's handed over.
- Nonconforming outputs: what happens when work is wrong, so it isn't handed over by accident.
Clause 9: performance evaluation
Monitor what matters (objectives, customer satisfaction, defects, supplier performance). Run internal audits at planned intervals, covering the whole system over the audit cycle and focused on the areas that matter most. Hold a management review where the directors look at the evidence and make decisions.
The standard lists what the management review must consider: actions from the last review, changes in internal and external issues, customer satisfaction and feedback, progress against objectives, process performance, nonconformities and corrective actions, monitoring results, audit results, supplier performance, adequacy of resources, how well your risk and opportunity actions worked, and opportunities for improvement. A one-page agenda with those headings, and minutes recording decisions, covers it.
Clause 10: improvement
When something goes wrong, fix it, find out why, and stop it happening again. This is nonconformity and corrective action: react to the problem, find the root cause, take action proportionate to the effect, check the action worked, and keep the record. Continual improvement means the system gets better over time, and the auditor will look for evidence of that across visits.
How the certification audits work
Initial certification is a two-stage audit carried out by your certification body. After that, you're on a three-year cycle.
| Audit | When | What it's for | What a small firm should expect |
|---|---|---|---|
| Stage 1 | After you've run the system for a while | Readiness check: scope, documents, understanding of the standard, whether internal audit and management review have been done, and planning for stage 2 | Often half a day to a day, sometimes remote. You get a report listing areas of concern to fix before stage 2 |
| Stage 2 | Usually a few weeks to a couple of months after stage 1 | Is the system implemented and effective? Interviews, records, site or office visits | The main audit. Ends with a recommendation for certification or a list of nonconformities to close first |
| Surveillance | At least once a year in years two and three | Sampling parts of the system to confirm it's maintained and improving | Shorter visits; the auditor checks previous findings were closed |
| Recertification | Before the certificate's three-year expiry | A fuller review of the whole system | Similar in scope to stage 2 |
The certification body calculates audit length from your headcount and complexity under international accreditation rules. For 20 people, expect a few auditor-days for initial certification, not weeks.
Findings are graded. A major nonconformity is a failure of a requirement that throws doubt on whether the system works, for example no internal audit at all, or a whole clause ignored. It has to be corrected, with evidence, before a certificate is issued. A minor nonconformity is an isolated lapse; you submit a corrective action plan and the auditor checks it at the next visit. Auditors may also note opportunities for improvement, which are optional but worth considering.
What the auditor samples and asks
Auditors don't read everything. They sample and follow a thread, typically tracing one or two recent jobs from enquiry to final invoice and asking for evidence at each step. Expect questions like:
- "Talk me through how this job came in. Who checked the drawings and terms before you accepted it?"
- "This tester was used to sign off the installation. When was it last calibrated?"
- "How did you choose this subcontractor? When did you last review their performance?"
- "What went wrong on this job? What did you do about it?"
- "Show me your last internal audit. What did it find, and what happened next?"
- "What came out of your management review? What did you decide?"
They'll also talk to people doing the work. A supervisor who can explain how they check work before handover is worth more than any procedure.
Evidence a small firm can show
Most of the evidence already exists in your normal records; the system just needs to point to it.
| Requirement | Typical small-firm evidence |
|---|---|
| Policy and objectives | Signed policy; objectives sheet with monthly or quarterly figures |
| Risks and opportunities | Short register reviewed at management review, with actions and owners |
| Competence | Training matrix; copies of cards, tickets and qualifications; induction records |
| Measuring equipment | Equipment list with calibration dates and certificates |
| Document control | Document list with revision numbers; an archive folder for superseded versions |
| Contract review | Signed-off enquiry checklist or email confirming scope, programme and price before acceptance |
| Supplier control | Approved supplier and subcontractor list with review dates and reasons for approval |
| Work control and release | Job checklists, inspection and test plans, test certificates, signed handover sheets, photos |
| Nonconforming work | Snagging and defect log showing how each item was resolved |
| Customer satisfaction | Feedback forms, client scorecards, complaint log, repeat-order data |
| Internal audit | Audit schedule, audit reports, findings and follow-up |
| Management review | Agenda covering the required inputs, minutes with decisions and actions |
| Corrective action | Log showing the problem, root cause, action, owner and whether it worked |
The same evidence scores in prequalification: an answer that points to a real job file and corrective action beats a policy. For building reusable answers, see Answering PQQs without starting from a blank page.
Choosing a certification body
Your certificate is only as credible as the body that issued it. Check that the certification body is accredited for ISO 9001 in your sector:
- In the UK, accreditation is by UKAS. Its website lists accredited certification bodies and their scopes.
- Elsewhere, look for accreditation by a national body that is a member of the International Accreditation Forum (IAF), such as ANAB in the US. The IAF CertSearch database lets clients check whether a certificate is genuine.
Many clients will only accept certificates from accredited bodies. Be wary of anyone offering certification within days, without a stage 2 visit, or bundled with "free" consultancy: an accredited certification body isn't allowed to consult on the system it certifies, so help building it comes from a separate adviser.
When you compare quotes, ask for the auditor-days for each stage and surveillance visit, the day rate and travel costs, and whether they have auditors who know your type of work. Compare the three-year cost, not the first-year cost.
Common nonconformities
These come up again and again in small-firm audits:
- Internal audit not done, or not covering the whole system. A single audit of one process the week before stage 2 isn't an audit programme.
- Management review missing inputs or recording no decisions. Minutes that just say "all fine" don't show the review happened.
- Objectives that aren't measurable or aren't monitored. "Improve customer satisfaction" with no figure and no tracking.
- Competence gaps: someone signing off work without a record that they're qualified to, or expired cards.
- Uncalibrated measuring equipment being used to prove conformity.
- No evidence of supplier evaluation, especially for subcontractors brought in at short notice.
- Uncontrolled documents: an old drawing revision on site, or three versions of the same checklist in use.
- Corrective action that fixes the symptom, not the cause. The defect was put right, but nobody asked why it happened.
- The written system doesn't match reality. A template procedure describing steps you never take. This is the classic one, and the auditor will find it on day one.
A realistic timeline
Three to six months is typical for a 20-person firm that commits a few hours a week. The bottleneck is not writing; it's running the system long enough to generate records. The certification body needs to see that it works, and that means at least one internal audit and one management review completed before stage 2.
| Month | What happens |
|---|---|
| 1 | Map how you work today. Write the scope, context, policy and objectives. Draft the process map and identify the few procedures and checklists you actually need. Get quotes from certification bodies |
| 2 | Start using the system on live jobs. Set up the training matrix, supplier list, equipment list and corrective action log. Book stage 1 |
| 3 | Keep running it. Track objectives. Log and act on defects and complaints |
| 4 | Internal audit of the whole system by someone who doesn't audit their own work (a trained staff member or an external auditor). Close the findings |
| 4 to 5 | Management review using the required inputs. Stage 1 audit; fix any areas of concern |
| 5 to 6 | Stage 2 audit. Close any nonconformities. Certificate issued after the certification body's decision |
If a tender is pressing, be honest: "stage 2 booked for March" is a credible answer; claiming a certificate you don't hold is not.
Start here
Take your most typical recent job and walk it from enquiry to final invoice on one sheet of paper, noting every check, record and hand-off. That sheet is the core of your system: it shows what you already do well, where the gaps are, and which few documents you need to write. Build outward from it, run it for a couple of months, audit it honestly, and the certification audit becomes a chance to show the auditor how the business already works.
Software helps with the routine parts: one current version of each document, card and calibration expiry tracking, and drafting questionnaire answers from approved wording. Deciding what the system should be stays with the people who run the business.
The best quality manual describes the business you are, so the auditor can watch it work.