ISO 9001 checklist for small businesses

An ISO 9001 checklist for a small business is really a checklist of seven clauses, 4 to 10, and the records that prove you follow them. The standard does not tell you how many procedures to write or how long a document should be. It asks for a quality management system that fits your size, your customers and your risks, and for evidence that it works. This page walks through each clause as questions you can answer yes or no, then lists what auditors usually sample.

It follows ISO 9001:2015, which was amended in 2024 to add climate change as an issue to consider in clause 4. Always read the standard itself, bought from ISO or your national standards body, because this is a summary in our own words and not its text. It is general guidance, not advice from a certification body.

Clause 4: context of the organisation

Questions to answer, in writing:

• Have we listed the outside and inside issues that affect our ability to deliver what customers expect (4.1)? This includes climate change if it is relevant to you.
• Have we listed the interested parties, such as customers, staff, suppliers and regulators, and what each requires of us (4.2)?
• Is the scope written down: which products, services and sites the system covers, and any requirement that does not apply, with the reason (4.3)?
• Have we identified our main processes, what goes in, what comes out, who owns each one and how they connect (4.4)?

For a ten-person company, four processes on one page (win work, deliver, support, improve) is a fair start. Do not map forty processes you do not run.

Clause 5: leadership

• Is there a quality policy, suitable to the business, that includes a commitment to meet requirements and to improve, available as documented information and communicated to staff (5.2)?
• Are roles and responsibilities assigned and understood, including who reports on how the system performs (5.3)?
• Can the owner or director show involvement, such as asking for the numbers, setting objectives and providing resources (5.1)?

Top management cannot hand this entirely to a consultant. Auditors interview the owner.

Clause 6: planning

• Have we listed risks and opportunities that could stop the system achieving its results, and decided what to do about them (6.1)? A short risk register is enough.
• Are there measurable quality objectives with a number, an owner, a date and a way to measure (6.2)? "Answer every complaint within two working days" is measurable. "Improve service" is not.
• When we change the system, do we plan it and think through the consequences (6.3)?

Clause 7: support

• Do we have the people, premises, equipment and working environment we need (7.1)?
• Where we measure with instruments, are they checked or calibrated against a reference and is there a record (7.1.5)?
• Do we know what knowledge the organisation needs and how we keep it when someone leaves (7.1.6)?
• Is each person competent for their job, with a record of training, experience or qualification (7.2)? A staff training record covers this.
• Does everyone know the policy, their effect on quality and what happens if they do not follow the system (7.3)?
• Do we know who communicates what, to whom and when (7.4)?
• Are documents and records identified, approved, protected, controlled for versions and retained (7.5)?

Clause 8: operation

This is the longest clause and where most of the daily work sits.

• Do we plan and control each process, with criteria for acceptance (8.1)?
• Do we communicate with customers, understand and review requirements before we promise anything, and record changes (8.2)?
• If we design products or services, do we plan the design, review it, verify and validate it, and control changes (8.3)? If you do not design, say so in the scope and the clause does not apply.
• Do we evaluate and choose suppliers on set criteria, monitor them and tell them what we need (8.4)? A supplier evaluation record is the usual proof.
• Do we deliver under controlled conditions, identify and trace outputs where needed, look after customer property and handle changes (8.5)?
• Do we check products and services meet requirements before release, and keep who released them (8.6)?
• Do we identify, separate and decide what to do with outputs that do not conform (8.7)?

Clause 9: performance evaluation

• Do we decide what to monitor, how, how often and who analyses it, including customer satisfaction (9.1)?
• Is there an internal audit programme covering the whole system over time, with independent auditors and reported results (9.2)? See your first internal audit step by step and the internal audit plan.
• Does top management review the system at planned intervals, with the inputs the standard lists and recorded decisions (9.3)? See a management review in one afternoon.

A worked example

A six-person print shop wants a customer to see its order process as a controlled one. It writes one process page with five steps (quote, artwork approval, print, check, deliver), names who owns each, and sets an objective of "reprint rate under 3 percent each quarter". It checks the printer's calibration every month and records it (7.1.5), approves two paper suppliers on delivery quality (8.4), and logs each reprint as a nonconformity with a cause (8.7, 10.2). Nothing here is elaborate. Each line answers a question above and leaves a record.

Clause 10: improvement

• When something goes wrong, do we react, find the cause, decide if it could happen elsewhere, act and check that the fix worked (10.2)? A corrective action report holds that chain, and corrective actions that fix the cause shows how.
• Do we keep improving, using audit results, customer feedback and the management review (10.1, 10.3)?

The documents and records the standard names

ISO 9001 asks you to keep or maintain documented information in particular places. The ones people miss are the scope (4.3), the quality policy (5.2), the quality objectives (6.2), evidence of calibration (7.1.5), evidence of competence (7.2), supplier evaluation results (8.4), who released products (8.6), nonconformities and actions taken (8.7, 10.2), monitoring results (9.1), the internal audit programme and results (9.2) and management review results (9.3). Anything else, such as work instructions, you write only where staff would otherwise do the job inconsistently.

What an auditor samples

A certification audit usually has two stages. Stage 1 looks at your documented information and readiness. Stage 2 looks at the system working: interviews, observation and samples of records, after which the certification body decides. Certificates normally run for three years with yearly surveillance audits. Have these ready and dated:

• Last year of complaints and what you did about each.
• One internal audit report, with its findings and closed actions.
• The last management review minutes with decisions and owners.
• Training and competence records for people in key roles.
• Supplier approvals and one supplier review.
• Two or three customer jobs followed from enquiry to delivery.

How nerix helps with the check before the audit

Checks in nerix is in early access. "Get ready for a check" lets you pick ISO 9001 from a library of about 90 frameworks. nerix reads the policies and records in your library and marks each requirement as Evidence found, Partly found, Not found or Can't tell, and a person confirms each result. The price is shown before you start. It shows ISO clause numbers with short topic labels of its own, not ISO's text. Its output is readiness information, not an audit and not a certificate. Only an accredited certification body can certify you. A spreadsheet with one row per clause also works for a small system.

Mistakes that cost small businesses time

• Copying a template system. Staff cannot explain procedures they did not write, and auditors ask them.
• A scope that is too wide. Cover what customers ask about, and extend later.
• No evidence of improvement. An internal audit with no findings at all looks like a missed audit.
• Objectives nobody tracks. Put the numbers on a monthly agenda.
• Claiming certification early. Say "certified" only with a certificate in hand, within its scope.

The short version

Answer the questions clause by clause, from context and scope to improvement. Keep the records the standard names, write procedures only where they help, and run one internal audit and one management review before the certification audit. Keep dated evidence as you go, because auditors sample it. A spreadsheet is enough for a small system, and only a certification body can certify you.

Sources

• ISO 9001:2015 Quality management systems, requirements, and Amendment 1:2024 on climate change, at iso.org.