# ISO 9001 Checklist for Small Businesses Source: https://nerix.ai/blog/iso-9001-checklist-for-small-businesses An ISO 9001 checklist for small businesses, clause by clause, with the records the standard requires, what auditors sample and common delays. The nerix team Published November 1, 2026 7 min read Quality and audits iso In this guide ## Key takeaways - Answer the questions clause by clause, from context and scope to improvement. - Keep the records the standard names, write procedures only where they help, and run one internal audit and one management review before the certification audit. - Keep dated evidence as you go, because auditors sample it. - A spreadsheet is enough for a small system, and only a certification body can certify you. An ISO 9001 checklist for a small business is really a checklist of seven clauses, 4 to 10, and the records that prove you follow them. The standard does not tell you how many procedures to write or how long a document should be. It asks for a quality management system that fits your size, your customers and your risks, and for evidence that it works. This page walks through each clause as questions you can answer yes or no, then lists what auditors usually sample. It follows ISO 9001:2015, which was amended in 2024 to add climate change as an issue to consider in clause 4. Always read the standard itself, bought from ISO or your national standards body, because this is a summary in our own words and not its text. It is general guidance, not advice from a certification body. ## Clause 4: context of the organisation Questions to answer, in writing: - Have we listed the outside and inside issues that affect our ability to deliver what customers expect (4.1)? This includes climate change if it is relevant to you. - Have we listed the interested parties, such as customers, staff, suppliers and regulators, and what each requires of us (4.2)? - Is the scope written down: which products, services and sites the system covers, and any requirement that does not apply, with the reason (4.3)? - Have we identified our main processes, what goes in, what comes out, who owns each one and how they connect (4.4)? For a ten-person company, four processes on one page (win work, deliver, support, improve) is a fair start. Do not map forty processes you do not run. ## Clause 5: leadership - Is there a quality policy, suitable to the business, that includes a commitment to meet requirements and to improve, available as documented information and communicated to staff (5.2)? - Are roles and responsibilities assigned and understood, including who reports on how the system performs (5.3)? - Can the owner or director show involvement, such as asking for the numbers, setting objectives and providing resources (5.1)? Top management cannot hand this entirely to a consultant. Auditors interview the owner. ## Clause 6: planning - Have we listed risks and opportunities that could stop the system achieving its results, and decided what to do about them (6.1)? A short [risk register](https://nerix.ai/blog/how-to-run-a-risk-register) is enough. - Are there measurable quality objectives with a number, an owner, a date and a way to measure (6.2)? "Answer every complaint within two working days" is measurable. "Improve service" is not. - When we change the system, do we plan it and think through the consequences (6.3)? ## Clause 7: support - Do we have the people, premises, equipment and working environment we need (7.1)? - Where we measure with instruments, are they checked or calibrated against a reference and is there a record (7.1.5)? - Do we know what knowledge the organisation needs and how we keep it when someone leaves (7.1.6)? - Is each person competent for their job, with a record of training, experience or qualification (7.2)? A [staff training record](https://nerix.ai/templates/staff-training-record) covers this. - Does everyone know the policy, their effect on quality and what happens if they do not follow the system (7.3)? - Do we know who communicates what, to whom and when (7.4)? - Are documents and records identified, approved, protected, controlled for versions and retained (7.5)? ## Clause 8: operation This is the longest clause and where most of the daily work sits. - Do we plan and control each process, with criteria for acceptance (8.1)? - Do we communicate with customers, understand and review requirements before we promise anything, and record changes (8.2)? - If we design products or services, do we plan the design, review it, verify and validate it, and control changes (8.3)? If you do not design, say so in the scope and the clause does not apply. - Do we evaluate and choose suppliers on set criteria, monitor them and tell them what we need (8.4)? A [supplier evaluation](https://nerix.ai/templates/supplier-evaluation) record is the usual proof. - Do we deliver under controlled conditions, identify and trace outputs where needed, look after customer property and handle changes (8.5)? - Do we check products and services meet requirements before release, and keep who released them (8.6)? - Do we identify, separate and decide what to do with outputs that do not conform (8.7)? ## Clause 9: performance evaluation - Do we decide what to monitor, how, how often and who analyses it, including customer satisfaction (9.1)? - Is there an internal audit programme covering the whole system over time, with independent auditors and reported results (9.2)? See [your first internal audit step by step](https://nerix.ai/blog/quality-first-internal-audit-step-by-step) and the [internal audit plan](https://nerix.ai/templates/internal-audit-plan). - Does top management review the system at planned intervals, with the inputs the standard lists and recorded decisions (9.3)? See [a management review in one afternoon](https://nerix.ai/blog/prepare-a-management-review-in-one-afternoon). ### A worked example A six-person print shop wants a customer to see its order process as a controlled one. It writes one process page with five steps (quote, artwork approval, print, check, deliver), names who owns each, and sets an objective of "reprint rate under 3 percent each quarter". It checks the printer's calibration every month and records it (7.1.5), approves two paper suppliers on delivery quality (8.4), and logs each reprint as a nonconformity with a cause (8.7, 10.2). Nothing here is elaborate. Each line answers a question above and leaves a record. ## Clause 10: improvement - When something goes wrong, do we react, find the cause, decide if it could happen elsewhere, act and check that the fix worked (10.2)? A [corrective action report](https://nerix.ai/templates/corrective-and-preventive-action-report) holds that chain, and [corrective actions that fix the cause](https://nerix.ai/blog/corrective-actions-that-fix-the-cause) shows how. - Do we keep improving, using audit results, customer feedback and the management review (10.1, 10.3)? ## The documents and records the standard names ISO 9001 asks you to keep or maintain documented information in particular places. The ones people miss are the scope (4.3), the quality policy (5.2), the quality objectives (6.2), evidence of calibration (7.1.5), evidence of competence (7.2), supplier evaluation results (8.4), who released products (8.6), nonconformities and actions taken (8.7, 10.2), monitoring results (9.1), the internal audit programme and results (9.2) and management review results (9.3). Anything else, such as work instructions, you write only where staff would otherwise do the job inconsistently. Tip If nobody would miss a document when it disappears, you probably do not need it. Auditors check that the system works, not how thick the binder is. ## What an auditor samples A certification audit usually has two stages. Stage 1 looks at your documented information and readiness. Stage 2 looks at the system working: interviews, observation and samples of records, after which the certification body decides. Certificates normally run for three years with yearly surveillance audits. Have these ready and dated: - Last year of complaints and what you did about each. - One internal audit report, with its findings and closed actions. - The last management review minutes with decisions and owners. - Training and competence records for people in key roles. - Supplier approvals and one supplier review. - Two or three customer jobs followed from enquiry to delivery. Try it on your own work. nerix writes the first draft, answers from your documents with the page each sentence came from, and keeps the team's work in one place. Start on the free plan. Start free ## How nerix helps with the check before the audit [Checks](https://nerix.ai/product/audits/iso-9001) in nerix is in early access. "Get ready for a check" lets you pick ISO 9001 from a library of about 90 frameworks. nerix reads the policies and records in your [library](https://nerix.ai/product/library) and marks each requirement as Evidence found, Partly found, Not found or Can't tell, and a person confirms each result. The price is shown before you start. It shows ISO clause numbers with short topic labels of its own, not ISO's text. Its output is readiness information, not an audit and not a certificate. Only an accredited certification body can certify you. A spreadsheet with one row per clause also works for a small system. ## Mistakes that cost small businesses time - **Copying a template system.** Staff cannot explain procedures they did not write, and auditors ask them. - **A scope that is too wide.** Cover what customers ask about, and extend later. - **No evidence of improvement.** An internal audit with no findings at all looks like a missed audit. - **Objectives nobody tracks.** Put the numbers on a monthly agenda. - **Claiming certification early.** Say "certified" only with a certificate in hand, within its scope. ## The short version Answer the questions clause by clause, from context and scope to improvement. Keep the records the standard names, write procedures only where they help, and run one internal audit and one management review before the certification audit. Keep dated evidence as you go, because auditors sample it. A spreadsheet is enough for a small system, and only a certification body can certify you. ## Sources - ISO 9001:2015 Quality management systems, requirements, and Amendment 1:2024 on climate change, at [iso.org](https://www.iso.org/standard/62085.html). ## Questions people ask Do we need a quality manual for ISO 9001? No. ISO 9001:2015 no longer requires a quality manual or a fixed set of written procedures. It requires the documented information that clauses 4 to 10 name, plus whatever else you need to run your processes reliably. Many small companies use a short manual anyway because it is a convenient map. How many clauses does ISO 9001 have? Ten. Clauses 1 to 3 (scope, references, terms) contain no requirements you audit against. Clauses 4 to 10 do, and they are the ones certification bodies check. Can a company with five people be certified? Yes. The standard scales to the size and risks of the organisation. A small team usually has fewer processes and shorter records, but still needs every clause covered, an internal audit and a management review. n/ About the author The nerix team The nerix team writes these guides in plain words for small teams, with templates you can fill in and use today. Share this guide - - [Email](mailto:?subject=ISO%209001%20checklist%20for%20small%20businesses&body=https%3A%2F%2Fnerix.ai%2Fblog%2Fiso-9001-checklist-for-small-businesses) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fnerix.ai%2Fblog%2Fiso-9001-checklist-for-small-businesses) - [X](https://x.com/intent/post?url=https%3A%2F%2Fnerix.ai%2Fblog%2Fiso-9001-checklist-for-small-businesses&text=ISO%209001%20checklist%20for%20small%20businesses) One tap, no account. We keep a count and nothing else. ## Templates for this Fill one in online and download it as Word or PDF. Free, no account, and what you type stays in your browser. - ### [Internal audit plan](https://nerix.ai/templates/internal-audit-plan) Plan which areas you audit this year, when, by whom, against what, and how results are reported and followed up. Fill it in - ### [Management review minutes](https://nerix.ai/templates/management-review-minutes) Record a management review: what was looked at, what was decided, who does what and by when. Fill it in - ### [Corrective and preventive action report](https://nerix.ai/templates/corrective-and-preventive-action-report) Record a problem, find its root cause, fix it, stop it happening again and check that the fix worked. Fill it in - ### [Supplier evaluation](https://nerix.ai/templates/supplier-evaluation) Score a supplier on quality, delivery, price, service and risk, and decide whether to keep, improve or replace it. Fill it in - ### [Staff training record](https://nerix.ai/templates/staff-training-record) Keep one record of the training an employee has done, when it expires and what is due next. Fill it in ## In nerix - [ISO 9001](https://nerix.ai/product/audits/iso-9001) - [Checks](https://nerix.ai/product/audits) - [Library and search](https://nerix.ai/product/library) ## Try it on your own work. nerix writes the first draft, answers from your documents with the page each sentence came from, and keeps the team's work in one place. Start on the free plan. Start free See the plans ## Keep reading - Quality and audits hkz [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [HKZ certification guide for care organisations](https://nerix.ai/blog/hkz-certification-guide) HKZ certification for Dutch care and welfare providers. What the HKZ norms are, how they relate to ISO 9001, the audit cycle and a readiness checklist. Read the guide - Quality and audits risk [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) October 31, 2026 7 min read ### [How to run a risk register in a small company](https://nerix.ai/blog/how-to-run-a-risk-register) A risk register in plain steps for a small company: what to list, how to score likelihood and impact, who owns each risk and how often to review it. Read the guide - [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) October 25, 2026 7 min read ### [ISO 27001 checklist for small businesses](https://nerix.ai/blog/iso-27001-checklist-for-small-businesses) An ISO 27001 checklist for small businesses, with the documents the standard asks for, the Annex A controls, the evidence auditors sample and tool prices. Read the guide - [iso](https://nerix.ai/blog/tag/iso) - [iso 9001](https://nerix.ai/blog/tag/iso-9001) - [quality](https://nerix.ai/blog/tag/quality) - [small business](https://nerix.ai/blog/tag/small-business)