Get ready for an ISO 9001 or 27001 check

Sooner or later, a customer asks: "Are you ISO certified?" Sometimes it is a requirement for a contract, sometimes a comfort for a cautious buyer. For a small company the prospect can feel enormous, with visions of binders and consultants.

The standards are less frightening than their reputation. At heart they ask you to do what a well run business already tries to do: know what you promise, do it, check that you did and fix what goes wrong. The work is in writing it down and keeping evidence, and the steps below show how to prepare for an ISO 9001 or ISO 27001 check.

This is a roadmap, not a guarantee. Certification is granted only by an independent body after its own audit, and the requirements are in the standards themselves, which you should read or have explained by a qualified adviser.

What the two standards are for

ISO 9001 is about quality management. It asks you to understand your customers' needs, plan how you meet them, control the work, measure results and improve.

ISO 27001 is about information security. It asks you to identify what information you hold and the risks to it, choose controls to deal with those risks, and keep checking that they work.

They share a skeleton: a clear scope, leadership that takes responsibility, planning around risks, support such as skills and documents, operation, evaluation through audits and reviews, and improvement. Many small companies work on them together.

Decide why and how far

Start with the reason. A customer demand, a tender, a wish to be more organised or a need to show you handle data responsibly all lead to different efforts. Then decide the scope: which parts of the business, which locations and which services are included. A narrow, honest scope is better than a broad, shaky one.

Set a realistic timeline. Many small companies need several months to build the habits and gather a few cycles of evidence. Rushing produces paper that does not match reality.

See where you stand

Do a gap check against the requirements. For each, ask: Do we do this? Do we write it down? Can we show evidence? Mark each as met, partly met or not met, and write what the evidence is.

Be honest. The point is to find the gaps now, not to hide them from a certifier who will find them later. If you cannot show evidence, then it is not met, however sensible the practice.

Build what is missing, in proportion

Common things small companies need to create or tidy:

1. Policies, short ones: a quality policy or an information security policy, signed by the owner.
2. Roles and responsibilities, so everyone knows who owns what.
3. A list of risks and how you handle them. For 27001 this includes an inventory of information assets, a risk assessment and the controls you choose.
4. Procedures for the work that matters, as short checklists. Our post on turning a process into a checklist shows how.
5. Supplier checks for those you depend on.
6. Training and awareness, with records.
7. Incident and complaint handling, with a way to learn from each.
8. Internal audits and management reviews, on a rhythm.

Do not copy a big company's manual. Write what you do, in plain words, and only what you need.

Collect evidence as you go

Evidence is what turns a claim into a fact: a record, a log, a signed document, a screenshot, a result. An auditor will ask to see it, usually by sampling. Keep it organised so you can find it in minutes.

Good habits:

• Record at the time, not later from memory.
• Keep one place for the evidence of each requirement.
• Date and name things.
• Keep what you need and delete what you do not, taking account of the law on personal data.

Run internal audits and a review before the real one

An internal audit shows whether your system works in practice. Do at least one full cycle before an outside audit, cover the whole scope and close the findings. Then hold a management review to look at results and decide improvements. Our posts on your first internal audit and preparing a management review explain how.

Certifiers look for a system that has been running and improving, not one that appeared last week.

Choose a certification body, and prepare people

If you decide to certify, look for an accredited body, ask for a quote and the steps. Typically there is a document review and one or two audit stages. Prepare your people: tell them what an audit is, that honesty is expected and that they should answer the question asked, with a simple, true answer and the evidence. Do not rehearse false answers.

Do not overclaim

Be careful with the words you use. "We follow the principles of ISO 27001" is different from "we are ISO 27001 certified". Do not use the certified mark or say you are certified before you hold a certificate, and keep it within the scope it covers. Customers, and in many places consumer law, expect accuracy.

Keep it going

Certificates are checked again, usually every year, with a full renewal after a few years. The system must stay alive: audits, reviews, actions closed, risks updated, new staff trained. If it becomes a chore done once a year, it decays and the next audit hurts.

Where nerix helps

Checks (early access) includes a Get ready for a check page that starts from a library of about 90 frameworks, including ISO 9001, ISO 27001, GDPR and NIS2, and adds the laws a framework requires; it also has eight ready plans for internal checks. Getting ready labels each requirement Evidence found, Partly found, Not found or Can't tell, with the document behind it, never counts a requirement as found without evidence, and a person confirms every result. Issues become tasks in Work with owners and dates, and the yearly business review can be prepared from your workspace's own records.

Keep your policies, procedures and evidence in the library, where they can be searched and where nerix can answer questions with the page the answer came from. A readiness check is not a certificate and not a guarantee: only an accredited certification body can certify you, and nerix does not replace an adviser who knows the standard.

The short version

Know why you want it and decide an honest scope. Check where you stand against the requirements, build what is missing in proportion and keep evidence as you go. Run internal audits and a review first, and never claim certification you do not hold.