ISO Certification for Small Businesses: What the Standard Requires and How to Prepare
"We need ISO certification for the tender" is a common request, and it often comes with a deadline of a few weeks. A meaningful certification needs a working management system. Here is what is involved.
Who certifies whom
- ISO (the International Organization for Standardization) writes the standards. It does not certify organisations.
- Certification bodies audit organisations and issue certificates.
- Accreditation bodies – in India, NABCB under the Quality Council of India – check that the certification bodies are competent. Internationally they are linked through the IAF.
A certificate from a body not accredited by an IAF member may be rejected by buyers and tender authorities. You can check a certificate's validity on the IAF CertSearch database or on the accreditation body's website.
The common standards
| Standard | Covers | Typical users |
|---|---|---|
| ISO 9001:2015 | Quality management | Any organisation; most tenders |
| ISO 14001:2015 | Environmental management | Manufacturers, exporters |
| ISO 45001:2018 | Occupational health & safety (replaced OHSAS 18001) | Factories, construction, logistics |
| ISO 22000:2018 | Food safety | Food processors, packaging |
| ISO/IEC 27001:2022 | Information security | IT, BPO, fintech, accounting outsourcing |
| ISO 13485:2016 | Medical devices quality | Device manufacturers and suppliers |
ISO 9001 is being revised, and a new edition is expected. Organisations certified to the 2015 edition will get a transition period once the new version is published.
What the standards have in common
Most management system standards follow the same Annex SL structure. You will need to:
- define the context, meaning internal and external issues and interested parties, and the scope of the system
- set a policy and measurable objectives
- identify risks and opportunities and plan actions for them
- control documents and records
- operate the core processes in a controlled way
- monitor and measure performance
- conduct an internal audit and a management review
- correct non-conformities and improve continually
A realistic timeline
| Phase | Typical duration for a small organisation |
|---|---|
| Gap assessment and planning | 1–2 weeks |
| Documentation and roll-out | 3–6 weeks |
| Running the system and keeping records | 4–8 weeks |
| Internal audit and management review | 1–2 weeks |
| Stage 1 and Stage 2 certification audits | 2–4 weeks |
The certificate is valid for three years, with annual surveillance audits. Missing a surveillance audit can lead to suspension.
Be wary of shortcuts
Offers of a "certificate in three days, no audit" usually come from unaccredited bodies. Such certificates can be rejected, and in tenders they can lead to disqualification. A lean, well-designed system that your staff actually follow is worth more than a thick binder of borrowed procedures.
The information in this article reflects the law as on the date of publication and is for general guidance only.