ISO Certification for Small Business: Six Places the Standard Lets You Keep It Simple

ISO standards are written for every organisation, from a five-person consultancy to a multinational. That is why so much of the wording says “as necessary”, “where applicable” and “at planned intervals”. Those phrases are not loopholes. They are the standard telling you to size the system to the business.

Most small businesses never use that room. They buy a template written for a manufacturer, or inherit habits from a big employer, and end up running a system that costs more than it returns. Here are six places where the standard lets a small business keep it simple, and the parts it does not let you skip.

1. Monitor what is in your objectives, and not much else

Clause 9.1 asks you to decide what needs to be monitored and measured, how and when, and to analyse and evaluate the results. It does not hand you a list.

For most small businesses the answer is already written down: your clause 6.2 objectives. If you have set a handful of measurable objectives, tied to the policy and the business plan, monitoring those covers the bulk of 9.1. Measuring anything beyond that is extra work, unless it tells you something you will act on.

The two things you cannot leave out under ISO 9001 are customer satisfaction (9.1.2) and the effectiveness of what you did about risks. Neither needs a survey. A customer satisfaction item at every project close-out, and a look at your risk register at management review, will usually do it.

2. Process KPIs are optional

Clause 4.4 asks for the performance indicators needed to operate your processes effectively. A manufacturer running a production line needs process measures. A small service business usually does not need a KPI on every process.

If your CRM or job software already reports something useful, such as the time from enquiry to quote, use it. Otherwise let your objectives do the measuring, and add process KPIs only when a process is causing problems you need to see. Our clause 4.4 guide covers this in more detail.

3. One IMS calendar instead of a separate audit programme

Clause 9.2 asks for an audit programme that takes into account the importance of each process, changes to the organisation and the results of previous audits. A large organisation might need a dedicated audit schedule, an audit procedure and a register of findings.

A small business can fold all of that into one calendar. List everything the system has to do through the year: internal audits, management review, emergency drills, site inspections, leadership walks, supplier reviews and register updates. For each item, record who is responsible and when it is due, then mark it done and link the evidence. Plan the audits on the same calendar, and audit the riskiest processes and the newest people more often. One list replaces several, and anyone can see at a glance what is overdue.

What the internal audit has to check

An internal audit has two jobs, and small businesses often do only one.

• Does the system meet the standard? Every requirement of the standard should be covered somewhere in your system, and over the audit cycle you check it is.
• Does the system meet its own requirements? Whatever you wrote down, you now have to do. If your system sets a rule, the audit checks you follow it, even where the standard never asked for it.

What is auditable, and what is not

The second job is where the trap sits. An audit can test you against two things only: what the standard requires, and what your own system says you do. Anything outside those two is not an auditable requirement, however sensible it sounds.

Meeting minutes are the classic example. Auditors often ask for the minutes of every meeting, as though the standard demands them. It does not. Take clause 7.4, communication. It asks you to decide what you will communicate, when, with whom, how and who does it. It is not a documented information clause, and nothing in it mentions meetings or minutes.

Whether minutes are needed is for the organisation to decide. Clause 7.5.1 asks for the documented information the standard requires, plus whatever the organisation determines is necessary for its management system to be effective. If you have not determined that minutes are needed, there is no requirement for an auditor to audit them against.

Once you write it down, though, the position flips. Say your system states that the team meets every week and minutes are kept. The standard never asked for that. You did. From that moment, weekly meetings with minutes are an auditable requirement. If the auditor samples three months and finds five sets of minutes, that is a nonconformity, raised against a rule you wrote for yourself.

None of this is an argument for dropping records to dodge an audit. It cuts both ways. The question is not “will the auditor want to see this?” It is whether the record is needed for the management system to operate properly. If minutes add value, the case for keeping them is strong, and you should write that requirement into your system. Examples are minutes that hold decisions and actions nobody would otherwise follow up, show safety concerns were raised and acted on, or control a specific risk such as a change agreed verbally that never reaches the people doing the work.

If minutes do nothing for the business, take the requirement out, and the minutes stop being auditable. Either way, the call is yours to make on the merits, not the auditor’s to make for you.

Whichever way you go, write down what you will actually do, at a frequency you will actually keep. Every requirement you add is one more thing you will be audited against, so add it because it earns its place, not because it looks thorough.

The person who audits has to be objective and impartial. In a small team, that often means swapping areas, or using an independent internal auditor.

4. Management review once a year, and early if something goes wrong

Clause 9.3 says top management reviews the system “at planned intervals”. It does not set a frequency. Most certification auditors expect at least once a year, and for a small business once a year is usually enough.

What makes it work is a trigger. Write into the system that a serious incident, injury, major complaint or significant change prompts an extra review. That way you are not meeting quarterly for the sake of it, but you are not waiting eleven months to respond to something that matters.

5. Put the loose reviews into the management review

Several clauses ask you to “monitor and review” something without saying when or how. Clause 4.1 says it about your internal and external issues. Clause 4.2 says it about your interested parties and their requirements. Neither appears on the management review agenda in clause 9.3.

The simplest answer is to add them. Write a short terms of reference for the meeting that covers the standing agenda items from 9.3, plus the reviews the other clauses ask for: context, interested parties, the risk register and your legal requirements. One meeting, one set of minutes, and every “monitor and review” has a home.

6. Document what the standard requires, plus a little more

ISO 9001 calls for documented information in specific places, such as the scope, the policy, the objectives, competence records and audit results. It does not ask for a procedure for every clause.

Too much documentation fails in a small business, because nobody has time to keep it up and people stop using it. Too little fails at the audit, because you cannot show conformity. The balance is the required records, plus a short written record wherever it helps everyone give the auditor the same answer. Your context, your interested parties and your process map are good examples, even where the standard does not insist on a document.

The question to ask of every form and register is whether the business would miss it if it disappeared. If the answer is no, and the standard does not require it, it can go. That is the thinking behind a Streamline management system.

What a small business cannot shortcut

Lean does not mean optional. Every certified system, whatever its size, needs:

• A defined scope, a policy and measurable objectives.
• Risks and opportunities identified and acted on.
• Competence records for the people doing the work.
• Operational controls that are actually followed. For ISO 9001, see our clause 8 guide.
• At least one full internal audit and one management review before the certification audit.
• A working corrective action process, with evidence it has been used.

The certification auditor will look for all of these, whatever the size of the business. What changes with size is how much paper sits around them.

ISO certification for small business: FAQs

Is ISO certification worth it for a small business?

It usually is when customers or tenders require it, or when you need a structure to grow without the owner checking everything. It is rarely worth it as a badge alone. A system sized to the business costs far less to run than one copied from a large company.

How long does ISO certification take for a small business?

Most small businesses take three to six months from starting the system to the certification audit. The main limit is time to run the system long enough to produce evidence, including an internal audit and a management review.

How much does ISO certification cost for a small business?

It depends on the standard, the number of people and sites, and how much you do yourselves. See our ISO 9001 certification cost guide for current Australian figures.

Can a small business do its own internal audit?

Yes, provided the audit is objective and impartial. In a small team that usually means people do not audit their own work, or you bring in an independent internal auditor.

Do we have to keep minutes of every meeting for ISO?

No. ISO standards do not require meeting minutes as such. You decide what documented information your system needs. If your system says minutes are kept, they become auditable, and the auditor can ask for every set. If it does not, there is no requirement to audit them against. Where minutes add value or help control a risk, for example by recording decisions, actions or safety concerns that would otherwise be lost, make them a requirement of your system and keep them.

How often does a small business need a management review?

The standard says at planned intervals. Most certification auditors expect at least once a year, with an extra review triggered by a serious incident or significant change.

Do small businesses need a quality manual?

No. ISO 9001 has not required a quality manual since the 2015 edition. Many small businesses keep a short one anyway, because it gives new staff and auditors a single place to start.

How Streamline can help

Streamline builds ISO management systems sized to the business. For a small business that means one calendar, one register for everything that went wrong, and records that come from the work rather than from the audit. We can build it with you, mentor your team through it, or keep it running as your outsourced ISO manager.

Speak with an experienced ISO auditor

To talk through what your business actually needs, contact us or email hello@streamline.business.