Where the money goes first

You cannot reduce a cost you have not located. From our ISO 9001 certification cost breakdown — this site's own estimates rather than published rates, and last reviewed in February 2026 — a first-year bill splits four ways:

The spread on consultancy is the whole story. It is the largest line, the most variable, and the one where a business decides its own number.

1. Do the documentation yourself (saves the most)

Consultants are usually paid for documentation work, not for insight. You know your processes; what you lack is the structure to express them in the standard's terms.

For a single-site business under 50 people, the documentation set is a quality manual or equivalent, a handful of procedures, and the required records. Templates and guides get you most of the way:

• ISO 9001 quality manual template
• How to write an ISO 9001 quality policy — or the free quality policy generator
• ISO 9001 work instruction template
• ISO 9001 document control

Our DIY ISO 9001 certification guide is honest about where the DIY route genuinely struggles — it is not a cheerleading piece, and the clauses it flags are worth reading before you commit.

Realistic saving: £5,000–£15,000.

2. Get three quotes, broken out by audit day

Certification body quotes for the same nominal scope vary substantially, and most of the variance is audit days rather than day rate.

Ask for every quote itemised: Stage 1 days, Stage 2 days, surveillance days in years 2 and 3, recertification days in year 4, travel, certificate fees, and what a nonconformity follow-up visit costs. Compared line by line, the cheap quote sometimes turns out to be fewer Stage 2 days, which is a shorter audit rather than a better price.

Check any body in the UKAS directory of accredited organisations first, and confirm it is accredited for your sector.

Choosing an ISO 9001 certification body sets out the full comparison list.

Realistic saving: £500–£2,500 in year one, and the same again across the cycle.

3. Do not over-document

Every document you create is one you maintain, review, control and get audited against. Over-documentation costs three times: to write, to maintain, and in audit time spent on documents that did not need to exist.

The standard requires specific documented information. It does not require a procedure for every activity. A 15-person business does not need a 500-person manufacturer's document set, and an auditor will not thank you for one.

The test: if a document is not required by the standard and nobody uses it to do their job, it should not exist.

Realistic saving: £1,000–£3,000 in year one, more across the cycle.

4. Prepare before you engage anyone paid

If you do use a consultant, the number of days you need is set by how much is already done. A consultant walking into an organised business with a completed gap analysis, an agreed scope and existing records needs a fraction of the time.

Do these first, and unpaid: agree the scope, run a gap analysis, collect the records you already generate, and identify which processes have no evidence behind them. The free readiness quiz gives a rough position in ten questions.

Realistic saving: halves consultancy days if you use any.

5. Buy support by the day, not by the project

If you need help, the middle ground is usually better value than either extreme. A few days of targeted support — a review of your documentation before Stage 1, or help with the clauses you find genuinely hard — costs a fraction of a full implementation and removes the specific risk.

Ask for day-rate support with a defined deliverable rather than a fixed-price implementation. You keep control of the scope and can stop when the problem is solved.

Realistic saving: £3,000–£10,000 against full implementation support.

6. Combine standards if you need more than one

If you need ISO 27001 as well, certifying them together costs materially less than certifying them separately: one auditor visit, one set of shared management-system processes, overlapping evidence.

The overlap is real — internal audit, management review, document control, and risks and opportunities are shared requirements. ISO 9001 vs ISO 27001 covers which you actually need, and the ISO 27001 certification cost guide covers that side of the bill.

Only do this if you genuinely need both. Adding a standard you do not need to save on audit days is not a saving.

Realistic saving: meaningful on audit days where both are genuinely required.

7. Time your certification around the 2026 edition sensibly

ISO 9001:2026 — the sixth edition — published on 16 September 2026, the date ISO's TC 176/SC 2 committee had announced for it on 7 August 2026. That raises a timing question with a cost attached. The honest answer is that transitioning later is a smaller job than certifying twice — see what the ISO 9001:2026 transition will cost — so delaying a certificate you need in order to avoid a transition is usually the more expensive path.

Where it does save money: if you are early in the process and the certificate is discretionary, aligning your first certification with the new edition avoids paying for a transition assessment a year later.

Realistic saving: the cost of one transition assessment, in the narrow case where you were not ready anyway.

The two false economies

Dropping UKAS accreditation. An unaccredited certificate is cheaper. It is also, for most UK businesses, worthless — public-sector frameworks and large-customer supplier approval processes commonly specify accreditation, and an unaccredited certificate fails the requirement you were certifying for. UKAS is explicit that "only UKAS accredited certificates include the UKAS accreditation symbol". If nobody is asking you for the certificate, question whether you need it at all; if someone is asking, they will almost certainly check.

Buying a template pack and stopping there. Template packs are cheap and they are documentation, not a management system. Certification requires evidence that the system operates, which no pack can supply. Businesses that buy a pack, file it and book an audit fail Stage 2 and pay for a second visit — the expensive mistakes UK SMBs make covers this pattern and four others.

Practical takeaway checklist

1. Write your own documentation before considering a consultant
2. Get at least three certification body quotes, itemised by audit day
3. Check every body's UKAS accreditation and sector scope
4. Document only what the standard requires and people actually use
5. Complete the gap analysis before engaging anyone paid
6. Buy day-rate support with a defined deliverable, not a fixed-price project
7. Combine standards only where you genuinely need both
8. Do not delay a certificate a customer is asking for
9. Do not drop accreditation to save money
10. Do not treat a template pack as a management system

The free ISO 9001 cost estimator gives a baseline for your size and sector so you have a number to compare quotes against.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. Cost ranges are drawn from this site's ISO 9001 certification cost breakdown, where they are stated as that post's own estimates, last reviewed February 2026, and not checked against any published rate card. UK certification bodies and consultancies quote per scope and do not publish standard fees, so treat every figure here as a budgeting range rather than a price. ISO 9001 is a voluntary standard, not a legal requirement. Get written quotes for your own scope.

Before step 1: is this the right year?

One timing question is worth settling first. ISO 9001:2026 published on 16 September 2026 — UKAS confirms that it "was published on 16 September 2026 and replaces ISO 9001:2015 + Amendment 1:2024 over a defined transition period" — which raises the obvious question: certify now to the outgoing 2015 edition, or go straight to 2026?

Certify now if you need the certificate for a contract, tender or customer requirement. Certificates issued to the outgoing edition remain valid through the transition period — which runs to 30 September 2029 — and transitioning later is a much smaller job than a first certification. In the UK you can still apply against the 2015 edition until 16 March 2028, when UKAS requires certification bodies to "stop accepting new applications against the previous version of the standard". Waiting to avoid a transition means going without a certificate you need, which is the more expensive problem.

Going straight to the 2026 edition only makes sense if the certificate is discretionary and you are not in a hurry. Certification bodies need their own accreditation extended before they can audit to the new edition: UKAS transition decisions commence 1 January 2027 and are all to be completed by 30 September 2027. Until your body has been granted transition, UKAS is explicit that "certification issued against ISO 9001:2026 must not be represented as accredited certification".

Step 1: define your scope

Your scope is the statement of what the quality management system covers — which activities, which products or services, which sites. It appears on the certificate, and it is what your customers will read.

Get this right first because everything downstream sizes off it. A scope that includes a site you rarely use adds audit days. A scope that is too narrow fails the customer requirement you are certifying for in the first place.

Done looks like: one or two sentences naming activities, products/services and locations, agreed by whoever signs the contracts.

Step 2: run a gap analysis

Compare what you already do against what the standard asks for. Most established businesses are 50–70% of the way there without knowing it — you already have processes, you just have not documented or evidenced them.

Work through clause by clause and record three things per requirement: what you do now, what evidence exists, and what is missing. Our ISO 9001 gap analysis checklist walks the structure, and the free ISO 9001 readiness quiz gives a ten-question first read if you want a rough position before committing time.

Done looks like: a dated gap register with an owner and target date per gap.

Step 3: build the missing documentation

This is where the time goes, and where most of the money goes if you outsource it.

The standard requires specific documented information, not a procedure for everything. For a business under 50 people that typically means a quality manual or equivalent, a handful of procedures covering your core processes, and the records the standard requires. Over-documenting is the classic first-timer error: every document you write is a document you have to maintain, review and be audited against.

Useful starting points on the pieces most businesses need:

• ISO 9001 quality manual template — what it should contain and what auditors check
• How to write an ISO 9001 quality policy, or generate a first draft with the free quality policy generator
• ISO 9001 document control — the requirements around versions, approval and retention
• ISO 9001 work instruction template — where step-level detail belongs
• ISO 9001 risk assessment — the Clause 6.1 risks-and-opportunities work

Done looks like: documented information that describes what you actually do, not an aspirational system.

Step 4: run the system and generate records

This is the step people try to skip, and it is the one that cannot be skipped.

An auditor certifies a system in operation. That means records: completed checks, raised nonconformities, supplier evaluations, training records, customer feedback. A perfect set of procedures with no evidence behind them fails Stage 2.

How long? Enough to produce a meaningful record set across your core processes. Two to three months of live operation is a common minimum for a small business, longer if your process cycle is long.

Done looks like: records exist for every process in scope, generated by the people who do the work.

Step 5: run one internal audit

Internal audit is a requirement in its own right, and it is also your rehearsal. Audit your own system against the standard before an external auditor does.

The auditor must be independent of the work being audited — in a small business that usually means one person audits another's area, or you use an external auditor for the internal audit. Our ISO 9001 internal audit checklist sets out fifteen questions your certification auditor is likely to ask, and the audit schedule template covers how to plan the programme.

Done looks like: an audit report with findings, and corrective actions raised against them — see the non conformance report template.

Step 6: hold a management review

Top management has to review the system, and the review has required inputs and outputs. Auditors check the minutes.

This is a genuine meeting with a genuine agenda, not a document you write afterwards. The ISO 9001 management review guide covers what has to be on the agenda.

Done looks like: dated minutes showing the required inputs discussed and decisions recorded.

Step 7: choose a UKAS-accredited certification body

You cannot certify yourself. You appoint a certification body, and if the certificate needs to satisfy a customer or a framework, it needs to be UKAS-accredited.

UKAS describes accreditation as demonstrating "to the marketplace that certification bodies are technically competent to audit and certify activity in accordance with the requirements of national and international standards and regulations". Check any body against the UKAS directory of accredited organisations before you talk to them, and confirm they are accredited for your sector, not just for ISO 9001 generally.

Get at least three quotes broken out by audit day — choosing an ISO 9001 certification body sets out what to compare, and the certification cost breakdown covers the ranges.

Done looks like: a signed contract with agreed Stage 1 and Stage 2 dates.

Step 8: Stage 1 audit — document review

The auditor reviews your documented system, confirms the scope, and assesses whether you are ready for Stage 2. It is typically one day for a small business, often partly remote.

Stage 1 findings are normal and are meant to be fixable before Stage 2. Treat it as a diagnostic, not a test.

Done looks like: a Stage 1 report with any readiness issues identified and a Stage 2 date confirmed.

Step 9: Stage 2 audit — implementation

The auditor assesses the system in practice: interviewing staff, sampling records, walking processes. Typically two to three days for a business of 10–50 people.

Major nonconformities must be closed before the certificate is issued, which may require a follow-up visit. Minor ones are usually closed by evidence submitted afterwards. The ISO 9001 audit checklist covers what to have ready by clause area, and the free audit readiness checker flags what is still outstanding.

Done looks like: a recommendation for certification, then the certificate.

How long it actually takes

The two places time is lost are step 4 (you cannot compress the record-generation period) and certification-body scheduling (audits book weeks ahead, and more during a transition year). Our ISO 9001 certification timeline breaks the phases down further.

Practical takeaway checklist

1. Decide whether you need the certificate this year — if a contract requires it, certify now
2. Write the scope statement and get it agreed
3. Run a documented gap analysis and keep the register
4. Build only the documentation the standard requires
5. Run the system live long enough to generate real records
6. Complete one internal audit with an independent auditor
7. Hold a management review with minutes
8. Check certification bodies against the UKAS directory, including sector scope
9. Get three quotes broken out by audit day
10. Fix Stage 1 findings before Stage 2 rather than arguing them

If you want a cost figure before committing, the free ISO 9001 cost estimator gives a baseline for your company size and sector, and ISO 9001 for small business covers what a proportionate system looks like at this scale.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO 9001 is a voluntary standard, not a legal requirement. Certification requirements vary by scope, sector and certification body — verify with your UKAS-accredited certification body before making compliance decisions.

First: accredited or not

This is a binary and it comes before everything else.

UKAS is the UK's national accreditation body. Its own description of what accreditation signifies is worth quoting because it is precisely the thing an unaccredited certificate does not give you: "Accreditation demonstrates to the marketplace that certification bodies are technically competent to audit and certify activity in accordance with the requirements of national and international standards and regulations."

Certification bodies auditing management systems are themselves accredited against ISO/IEC 17021-1. That is the standard your auditor's employer is held to, and it is the reason an accredited audit is a different product from an unaccredited one.

Two ways to check, both free:

• Search the UKAS directory of accredited organisations before you take a call. If a body is not in it, the conversation is over.
• UKAS CertCheck — UKAS runs a tool to verify UKAS accredited management system certificates. Useful in both directions: to check a body, and later to let your own customers verify you.

UKAS is also explicit about the mark: "Only UKAS accredited certificates include the UKAS accreditation symbol." A certificate without it is not accredited, whatever the covering letter says.

Does it matter? It depends entirely on why you are certifying. If a customer contract or a public-sector framework specifies UKAS accreditation — which is common — an unaccredited certificate fails the requirement and the money is wasted. If you are certifying purely for internal discipline, unaccredited certification is cheaper and legitimate. Most UK SMBs are in the first group and should behave accordingly.

Second: accredited for what

Accreditation is not general. A body is accredited for specific standards within specific scopes, usually expressed by economic activity sector.

Ask for the body's accreditation schedule and check that your sector appears on it. A body accredited for ISO 9001 in professional services is not necessarily accredited for ISO 9001 in food manufacturing, and a certificate issued outside a body's accredited scope has the same problem as an unaccredited one.

This is the check most buyers skip, and it is the one that most often causes trouble later.

Third: transition readiness

ISO 9001:2026 published on 16 September 2026 — UKAS confirms that it "was published on 16 September 2026 and replaces ISO 9001:2015 + Amendment 1:2024 over a defined transition period", with all certified customers to be transitioned by 30 September 2029. A certification body cannot issue an accredited certificate against an edition it is not yet accredited for, so where a body sits in the UKAS transition window is now a live commercial question rather than a theoretical one.

UKAS began accepting self-declarations and supporting evidence on the publication date itself, will be "ready to begin transition assessment activity" from 1 December 2026, and commences transition decisions on 1 January 2027, with all decisions to be completed by 30 September 2027. UKAS "encourages CABs to submit transition information as early as possible to support timely completion of transition decisions", so it is worth asking a body when it submitted.

UKAS also set out what happens to a body that issues early: "Until UKAS has made an accreditation decision to transition, certification issued against ISO 9001:2026 must not be represented as accredited certification."

There is one more date worth holding: UKAS requires certification bodies to "stop accepting new applications against the previous version of the standard" on 16 March 2028. If you want a first certificate against the familiar 2015 edition, that is your cut-off. Three questions worth asking any body you are considering:

1. Have you submitted your self-declaration for ISO 9001:2026, and when do you expect your UKAS decision?
2. Will you run my transition assessment alongside a scheduled audit or as a separate visit?
3. What will you do if your accreditation decision comes after my scheduled transition audit?

A body that answers those three crisply is a body that has planned. A body that answers "we'll be ready" has not. The ISO 9001:2026 transition plan covers how this fits into your own timetable.

Fourth: audit days, which is what you are actually buying

Quotes for the same nominal scope vary widely, and most of the variance is audit days rather than day rate.

Audit duration for management system certification is not arbitrary — it is driven by your effective headcount and the complexity of your scope, and accredited bodies work to a common basis for calculating it. What varies is how a body classifies your complexity, and whether the quote covers everything.

Compare quotes on this basis, not on the headline figure:

A quote that is 40% cheaper with two fewer Stage 2 days is not a better deal; it is a shorter audit, and short audits produce findings later. Our ISO 9001 certification cost breakdown sets out the day-rate ranges these quotes are built from.

Fifth: the things that only show up in year two

Certification is a three-year relationship, and the differences that matter most are invisible at quote stage.

• Auditor continuity. Will you get the same auditor across the cycle? A new auditor each year means re-explaining your business annually, and it is a common source of inconsistent findings.
• Sector knowledge. An auditor who understands your industry asks better questions and wastes less of your time. Ask what else the proposed auditor audits.
• Scheduling flexibility. How far ahead do you need to book? Transition periods create bottlenecks, and this is the year that matters.
• Reporting turnaround. How long between audit and report? A slow report delays corrective action and, at recertification, delays the certificate.
• How findings are classified. Ask for an example report. The difference between a body that raises observations and one that raises minor nonconformities for the same issue is real work for you.

When to switch bodies

Switching is a real option and it is less disruptive than most businesses assume — your certificate transfers rather than restarting, provided the new body is accredited for your scope.

Reasonable triggers: your body is not accredited for a scope you have grown into; auditor turnover has made audits unpredictable; the quote at recertification has moved without an explanation you accept; or the body cannot answer the transition questions above.

Poor trigger: price alone. A cheaper quote with fewer audit days is a different product, and switching in the middle of a transition adds work at the worst possible moment.

Practical takeaway checklist

1. Check the body is in the UKAS accredited directory before the first call
2. Ask for the accreditation schedule and confirm your sector is on it
3. Ask the three transition-readiness questions and note who answers crisply
4. Get quotes broken out by audit day, not as a single figure
5. Compare Stage 1, Stage 2, surveillance and recertification days side by side
6. Confirm what travel, certificate fees and follow-up visits cost
7. Ask about auditor continuity across the three-year cycle
8. Ask what sector experience the proposed auditor has
9. Ask for a sample audit report and look at how findings are classified
10. Do not accept a 2026-edition certificate before the body's UKAS decision

Before you talk to anyone, it is worth knowing roughly where you stand — the free ISO 9001 readiness quiz takes ten questions, and the ISO 9001 audit checklist covers what the Stage 1 and Stage 2 audits will actually look at.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. No certification body is named or recommended anywhere in this guide. Transition dates are quoted from UKAS's ISO 9001:2026 technical bulletin and Global ACI-TECH-3-TR 2029-09-30 (M), both published 16 September 2026. Verify any body's accreditation status and scope directly with UKAS before contracting.

The exact wording that was added

The IAF/ISO joint communiqué of 22 February 2024 is the primary source, and it quotes both additions in full.

To Clause 4.1 (Understanding the organization and its context), after the existing requirement to determine external and internal issues:

"Added: The organization shall determine whether climate change is a relevant issue."

To Clause 4.2 (Understanding the needs and expectations of interested parties):

"Added: NOTE: Relevant interested parties can have requirements related to climate change."

Two sentences. That is the entire change. The communiqué explains that the additions "will be incorporated into the new text of the Harmonized Structure (Appendix 2 of the Annex SL in the ISO/IEC Directives Part 1 Consolidated ISO Supplement)" — the common clause framework that ISO management system standards are built on, which is why the same two statements appear across a range of standards rather than in one of them.

Note the difference in force between the two. Clause 4.1's addition is a shall — a requirement. Clause 4.2's addition is a NOTE — guidance, which in ISO drafting convention is not auditable as a requirement in its own right. That distinction is worth holding on to when someone tells you that you need to survey your customers about climate change.

What the change does not do

The communiqué is unusually direct on this point:

"The overall intent of the requirements for clauses 4.1 and 4.2 remain unchanged; these clauses already include the need for the organization to consider all internal and external issues that can impact the effectiveness of their management system; these new inclusions are assuring that Climate Change is considered within the management system and that it is an external factor that is important enough for our community to require organizations to consider it now."

And on proportionality:

"It is not the intention of the changes to (for example) turn a health and safety management system audit or a road traffic safety management system audit into one that disproportionality considers Climate Change, though this does not of course understate the importance of Climate Change."

It also notes that "the effect on a Quality Management System could be very different to that on a Health and Safety Management System" — which matters for ISO 9001 specifically. The question a quality management system has to answer is not "what is our environmental impact". It is "can climate change affect our ability to consistently deliver conforming product or service".

There was no transition period and no re-certification. UKAS's technical bulletin on the amendment states that "certification bodies need to include the new text in their auditing of the organisation and its context" and that "CBs will need to continue to audit these clauses to ensure that all internal and external issues, which includes Climate, Change [sic] have been determined by their clients as relevant or not and if so, considered in the development and effectiveness of the management system(s)." In other words: it folded into normal auditing of Clause 4, immediately.

What an auditor actually looks for

UKAS is specific about the failure case. If an organisation cannot demonstrate that it has considered whether climate change is relevant, "a suitable finding should be raised."

Read the requirement carefully and you will see that "not relevant" is a valid answer — as long as it is a determined answer rather than an absent one. What the auditor wants to see is that the question was asked, by someone who understood the business, and that the conclusion was recorded.

The practical test is whether your Clause 4.1 record — your context analysis, issues register, SWOT, or whatever you call it — has climate change in it with a conclusion attached.

What a proportionate ISO 9001 answer looks like

For a quality management system, climate change is a business-continuity and supply-chain question. Here is the shape of a determination that satisfies Clause 4.1 for a typical UK SMB, with the reasoning visible.

Working through five rows like that, recording the conclusion for each, and dating it is a complete Clause 4.1 climate determination for most small businesses. It takes an hour. Two of those rows connect directly to risks you have almost certainly already identified — see the ISO 9001 risk assessment template for how they feed the risk register under Clause 6.1.

Three common mistakes

Treating it as an environmental requirement. ISO 9001 is a quality management standard. A carbon footprint calculation is not evidence of a Clause 4.1 determination, and a Clause 4.1 determination is not a substitute for ISO 14001 if you actually need environmental certification.

Writing "climate change is not relevant to our business" with no reasoning. This is the version that attracts a finding — not because the conclusion is wrong, but because there is nothing behind it. A software business genuinely may conclude that physical climate risk is low; it should still note that customer tender requirements are the route by which it becomes relevant.

Doing it once and never revisiting it. Clause 4.1 requires the issues to be monitored and reviewed. Climate relevance is a standing item, and management review is where it belongs — see the ISO 9001 management review guide for where it fits in the agenda.

Where this sits in the 2026 edition

The climate additions predate the ISO 9001:2026 revision — they were amendments to the 2015 edition, applied from February 2024. The revision is a separate piece of work. If you are planning for the new edition, see the ISO 9001:2026 vs 2015 clause-by-clause comparison and the what changed guide for how the clause structure moves.

The practical implication is that a climate determination you make now carries forward. It is not work you will repeat at transition.

Practical takeaway checklist

1. Find your Clause 4.1 record — context analysis, issues register, or equivalent
2. Add climate change as an explicit row, not a mention
3. Work through the routes: site, suppliers, customers, regulation, materials
4. Record a conclusion per route, with a one-line basis
5. Date it and name who made the determination
6. Note in Clause 4.2 whether any interested party has raised a climate requirement — a tender question counts
7. Feed any "relevant" conclusion into the risk register under Clause 6.1
8. Put climate relevance on the management review agenda as a standing item
9. Do not build a carbon footprint unless a customer or regulation actually requires one

If you are documenting context for the first time, the ISO 9001 gap analysis checklist covers what Clause 4 needs alongside the rest of the standard.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. The quoted wording is taken verbatim from the IAF/ISO joint communiqué of 22 February 2024 and the UKAS technical bulletin linked above; the full text of ISO 9001 itself is a purchased standard and is not reproduced here. ISO 9001 is a voluntary standard, not a legal requirement. Verify how the amendment applies to your scope with your UKAS-accredited certification body.

What is actually published, and what is not

ISO 9001:2026 published on 16 September 2026, and both the international and the UK transition arrangements published the same day. What has not been published is a price: no UK certification body has published an ISO 9001:2026 transition price at the time of writing, for a straightforward reason — UKAS transition decisions do not commence until 1 January 2027, and certification bodies cannot quote for audits they are not yet accredited to perform.

So the figures below are built, not quoted. They come from two things this site can evidence: the auditor day rates in our ISO 9001 certification cost breakdown, and the transition mechanics UKAS set out in its ISO 9001:2026 technical bulletin. Treat them as a budgeting model to sanity-check a quote against, not as a price list.

One published fact does real work on the cost side. Global ACI confirms the transition "may take place during a scheduled surveillance or recertification audit, or through a separate transition audit." That is the difference between an extra audit and an extension to one you were buying anyway — and it is the single biggest lever on this bill. You have until 30 September 2029, so you can align it with an audit already in your programme rather than commissioning a standalone visit.

Cost line 1: additional audit time

This is the only line you cannot remove, and it is smaller than most people expect.

A transition assessment is not a re-certification. Your auditor is checking that your documented information has been mapped to the new structure and that the changed requirements are implemented — not re-auditing your whole QMS from scratch. In practice that is a fraction of a day to a day of extra audit time for a business under 100 people.

Applying the UK auditor day rates from our certification cost breakdown — which are that post's own estimates, not published rates — gives the following. The arithmetic is shown so you can substitute your own figures:

The decision that moves this number is whether the transition runs alongside an audit you are already having. If your transition assessment is bolted onto a scheduled surveillance or recertification audit, you pay for the extra time only. If it runs as a standalone visit, you may also pay travel, a minimum-day charge, and a separate report. That difference is worth more than any negotiation on rate, and it is a question you can ask your certification body today.

Cost line 2: consultancy (£0 to £4,000, and usually avoidable)

Consultants will sell transition support, and for a complex multi-site QMS that can be money well spent. For a single-site business with a QMS it already understands, it is usually not.

The transition is a mapping exercise: your existing documented information needs to point at the right clause numbers, and the changed requirements need evidence behind them. You already know your own processes. What you need is the map — which is what the free ISO 9001:2026 clause comparison tool and the clause-by-clause comparison guide exist to give you.

At the consultancy rates in our cost breakdown, transition support typically means two to four days. If you are quoted more than that for a single-site QMS under 100 people, ask what specifically is taking the time. The honest answer is often "rewriting your quality manual", which is work you can do yourself with the mapping in hand.

Cost line 3: buying the standard

You need a copy of the new edition. ISO standards are sold, not published free, and in the UK the national adoption is sold through BSI. Budget for one copy for whoever owns the QMS.

This is also the line where businesses quietly overspend by buying multiple copies, or a full toolkit they will not use. One copy, held by the person doing the mapping, is enough for a business of this size.

Cost line 4: internal staff time

The largest number on the list and the one nobody puts in the budget.

For a single-site QMS, the realistic internal effort is:

At an assumed loaded cost of £250–£400 per day for a quality manager — our own assumption, not a surveyed or published rate — that is £1,000–£2,400 of real cost that never appears on an invoice. It is also the line most sensitive to preparation: businesses that inventoried their documents early spend days at the low end, and businesses that start the week before the audit spend considerably more.

Total: what to budget

A single-site UK business under 50 people that combines the transition with a scheduled surveillance audit and does its own mapping should expect to pay its certification body £400–£1,200 extra, plus a copy of the standard, plus four to six internal days. That is the realistic base case. Everything above it is a choice.

For context on what the underlying certification costs look like before any transition, see the full ISO 9001 certification cost breakdown, and if you also hold ISO 27001, the ISO 27001 certification cost guide covers that side.

Four questions that change the number

Ask your certification body these before you budget. The answers are free and they move the total more than anything else you can do.

1. When do you expect your UKAS accreditation decision for ISO 9001:2026? UKAS transition decisions commence 1 January 2027 and are all to be completed by 30 September 2027. Your body's position in that window drives when it can audit you to the 2026 edition under accreditation.
2. Will the transition assessment run with my scheduled surveillance audit, or as a standalone visit? This is the biggest single swing.
3. How much additional audit time are you allowing for a business of my size and scope?
4. What happens if I am not ready at that audit? A transition finding usually means a follow-up, and follow-ups have their own cost.

One thing worth confirming rather than assuming: UKAS states that "Until UKAS has made an accreditation decision to transition, certification issued against ISO 9001:2026 must not be represented as accredited certification." An unaccredited certificate will not satisfy a procurement requirement, so a body offering an early transition is not offering you a bargain.

Practical takeaway checklist

1. Ask whether the transition assessment can run alongside a scheduled audit
2. Get the additional audit days in writing before you agree a date
3. Budget four to six internal days, not zero
4. Buy one copy of the standard, not a toolkit
5. Do the clause mapping yourself before deciding whether you need consultancy
6. Front-load the document inventory — it is the cheapest hour you will spend
7. Confirm your certification body has its accreditation decision before accepting a 2026 certificate

The free ISO 9001 cost estimator gives you a baseline certification figure for your company size and sector, which is the number the transition sits on top of.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. The transition figures above are a budgeting model, not quoted prices. Its inputs are this site's own estimated UK auditor and consultancy day rates (see the certification cost breakdown, which states that they are estimates and are not checked against any published rate card), our own assumed internal loaded staff cost of £250–£400 per day, and the transition mechanics UKAS published for ISO 9001:2026. Only the last of those is externally sourced. No certification body had published an ISO 9001:2026 transition price at the date shown. Transition dates are quoted from UKAS's ISO 9001:2026 technical bulletin and Global ACI-TECH-3-TR 2029-09-30 (M), both published 16 September 2026. Get written quotes for your own scope.

What is confirmed

The transition arrangements were published on the same day as the standard, so the hedging that surrounded this revision for the past year is over.

The transition period is not set by ISO. It is set by the international accreditation body and applied by national accreditation bodies — in the UK, UKAS. That international role sat with the International Accreditation Forum until IAF ceased operations on 1 January 2026, the same date Global Accreditation Cooperation Incorporated (Global ACI) commenced full operations. Global ACI has assumed the former roles of IAF and ILAC.

Global ACI published the ISO 9001:2026 transition requirements on 16 September 2026 as Global ACI-TECH-3-TR 2029-09-30 (M). It states that it "has established a three-year transition period" and that "Organisations already certified to ISO 9001:2015 will have until 30 September 2029 to complete their transition." That is now a date you can put in a board paper. These requirements "are mandatory for Global ACI Multilateral Recognition Arrangement (MRA) accreditation body signatories and their accredited certification bodies operating within the applicable scope" — UKAS among them.

Usefully for budgeting, Global ACI also confirms the transition "may take place during a scheduled surveillance or recertification audit, or through a separate transition audit." You do not automatically need to buy an extra audit.

Why nothing happens on 17 September

A certification body cannot issue an accredited certificate against a standard it is not accredited for. Now that the standard has published, every UKAS-accredited certification body has to demonstrate its own competence against the new edition before it can audit anyone to it.

UKAS published its own ISO 9001:2026 timeline on publication day:

Internationally, Global ACI requires accreditation bodies to be ready "no later than 31 March 2027", certification bodies to submit their transition declaration and supporting information "by 30 June 2027", and adds that "From 31 March 2028, new and initial accredited certifications may only be issued to ISO 9001:2026."

UKAS is explicit about what happens if a body jumps the gun: "Until UKAS has made an accreditation decision to transition, certification issued against ISO 9001:2026 must not be represented as accredited certification."

Read that carefully, because it is the single most useful thing in this guide. If a certification body offers you an ISO 9001:2026 certificate before its accreditation decision comes through, the certificate is unaccredited. For most UK businesses an unaccredited certificate is worthless — it will not satisfy a public-sector procurement requirement or a customer's supplier-approval process, which is usually the reason you hold the certificate at all.

The practical read: publication in September 2026, the first accredited 2026 audits from January 2027, and a deadline three years out. Your certificate is safe in the meantime.

Your first 90 days: what is actually worth doing

Working back from that shape, here is where the effort pays.

Days 1–30: find out what changed, not what you fear changed

The clause structure is where the work is. Requirements that are substantively similar can still sit under different numbers, and every internal reference in your quality manual, procedures and audit checklists points at a clause number.

• Map your existing documented information against the new structure. Our ISO 9001:2026 vs 2015 clause-by-clause comparison sets out what moved where, and the free clause comparison tool does the mapping interactively.
• List every document that cites a clause number. For a typical 5–100 person QMS that is the quality manual, six to ten procedures, the internal audit checklist and the management review agenda.
• Do not rewrite anything yet. You are building an inventory, not editing.

Days 31–60: talk to your certification body before everyone else does

Transition periods create bottlenecks, and the businesses that book early get the slots they want.

• Ask your certification body three specific questions: when it expects its UKAS accreditation decision, whether it will run transition assessments alongside your scheduled surveillance audit or as a standalone visit, and what it will charge for the difference. The answers vary more than you would expect.
• If you are unhappy with your current body, this is the natural moment to move. There is a separate guide on choosing an ISO 9001 certification body covering what to compare — but note that changing body during a transition adds work, so decide on merit rather than on price alone.
• Get the transition cost into next year's budget. A companion guide on what the ISO 9001:2026 transition will cost breaks down where the money actually goes.

Days 61–90: run a gap analysis against the new edition

This is the part that shortens your transition audit, and it is entirely within your control.

• Run a documented gap analysis against the 2026 structure. The method is the same one you would use for first-time certification — see the ISO 9001 gap analysis checklist — but the input is your existing QMS rather than a blank sheet.
• Record the output as a dated gap register with an owner and a target date per gap. Your auditor will ask to see evidence that the transition was planned, not improvised.
• Schedule one internal audit against the new edition before your transition audit. Auditing against a standard for the first time in front of an external auditor is a bad plan.

What not to do in the first 90 days

• Do not rewrite your quality manual from pre-publication commentary. The standard is now published, and publication is the point at which clause numbering is final — UKAS confirms the revision involves "restructuring of clauses". Buy the standard and work from the real text, not from a summary written before it existed.
• Do not accept a 2026 certificate before your body's accreditation decision. See the UKAS wording above.
• Do not delay a first-time certification you actually need. If a customer contract requires ISO 9001 this year, certify to the 2015 edition now. Certificates issued to the outgoing edition remain valid through the transition period, and the transition itself is a smaller job than a first certification. The ISO 9001 certification timeline covers realistic lead times.
• Do not book transition training for the whole team yet. One person needs to understand the new structure in detail during this window. Everyone else needs it when the procedures actually change.

What is still open

The two big unknowns that hung over this transition — the deadline and the UK bulletin — were both closed on 16 September 2026. Two things remain genuinely open:

1. When your specific certification body will be accredited. UKAS transition decisions commence 1 January 2027 and are all to be completed by 30 September 2027. Bodies are assessed individually, so yours may be early or late in that window. Ask them directly — it is the single most useful question you can put to them right now.
2. What the published text actually says, clause by clause. ISO 9001:2026 is a paywalled document. UKAS tells us the clauses have been restructured and that the most significant changes "relate to interested parties, quality culture and ethical behaviour, risks and opportunities, planning of changes and management review", but the detail is in the standard itself. Buy a copy before you commit to a documentation plan.

Practical takeaway checklist

1. Inventory every QMS document that cites a clause number
2. Map your current documented information to the 2026 structure
3. Ask your certification body when it expects its UKAS accreditation decision
4. Confirm whether your transition assessment runs with surveillance or standalone, and what it costs
5. Budget the transition in the next financial year
6. Run a documented gap analysis against the new edition
7. Keep a dated gap register with owners and target dates
8. Schedule one internal audit against the new edition before the transition audit
9. Do not accept an unaccredited 2026 certificate
10. Re-check the Global ACI and UKAS positions before you book your transition audit

If you are mapping documentation to the new clause structure, the free ISO 9001:2026 clause comparison tool gives you a starting shape for what moved — but its clause numbering is drawn from pre-publication commentary and has not been checked against the published standard, which UKAS confirms restructured the clauses. Treat it as a prompt for questions, and verify against your own copy.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO 9001 is a voluntary standard, not a legal requirement — losing certification is a commercial consequence, not a regulatory one. Transition arrangements are set by Global ACI (which assumed the former roles of IAF and ILAC on 1 January 2026) and applied by UKAS; the dates above are quoted from Global ACI-TECH-3-TR 2029-09-30 (M) and UKAS's ISO 9001:2026 technical bulletin, both published 16 September 2026. The text of ISO 9001:2026 itself is a purchased standard and is not reproduced here. Always verify requirements with your UKAS-accredited certification body before making compliance decisions.

This guide breaks down all 93 controls in plain English, with evidence prompts and UK SMB applicability notes for each category.

The 2022 restructure: 93 controls in 4 themes

ISO 27001:2022 reorganised Annex A, aligning it with the control set in ISO/IEC 27002:2022 — 93 controls in 4 themes. UKAS's technical bulletin on the ISO/IEC 27001:2022 transition records what changed: "Annex A has been aligned with the controls defined in ISO/IEC 27002:2022, which contains 93 controls (11 of which are new) organised in 4 themes. In addition to the 11 new controls, 24 have been merged and 58 have been updated."

Read the second half of that sentence carefully: UKAS states the 11 / 24 / 58 breakdown of the ISO/IEC 27002:2022 control set, not of Annex A entries. UKAS does not say what the figures are measured against, so do not read them as a count of how many Annex A entries moved. On UKAS's figures, of the 93 controls in ISO/IEC 27002:2022:

• 11 are new
• 24 have been merged
• 58 have been updated

The 2013 edition of Annex A used a different structure with different control numbers. This guide states no control count for it: ISO/IEC 27001:2013 is withdrawn and paywalled, and the figure is not published by any free primary source.

The 4 categories in the current Annex A:

• A.5 Organisational controls — policies, governance, roles, and management processes
• A.6 People controls — screening, terms of employment, awareness, and remote working
• A.7 Physical controls — secure areas, equipment, clear desk, and media disposal
• A.8 Technological controls — access control, cryptography, logging, and network security

The only control figures this guide claims are the ones quoted above, and they are UKAS's figures for ISO/IEC 27002:2022 rather than counts UKAS states for Annex A itself. It states no per-category control count and does not map the 2022 categories onto the 2013 clause numbers: the per-category split is internal to ISO/IEC 27002:2022, which is paywalled, and the old clause numbering internal to the withdrawn 2013 edition.

If you built your ISMS against ISO 27001:2013, you need a gap analysis against the 2022 version — particularly for the 11 new controls which did not exist in 2013. Our ISO 27001 gap analysis template covers this.

A.5 Organisational controls

Organisational controls cover policies, governance, roles, and management processes.

A.5.1 Policies for information security: Establish, approve, communicate, and review a top-level information security policy and topic-specific policies. Evidence: signed policy document, distribution records, review history. See ISO 27001 Policy Templates.

A.5.2 Information security roles and responsibilities: Define and allocate information security responsibilities. Evidence: role descriptions, ISMS organisation chart, named ISMS Manager.

A.5.3 Segregation of duties: Separate conflicting duties to prevent fraud and error. Evidence: access control configuration showing no single person can initiate and approve transactions; documented role assignments.

A.5.4 Management responsibilities: Management must require staff to apply information security in accordance with established policies. Evidence: employment contracts referencing security obligations; management sign-off on ISMS.

A.5.5 Contact with authorities: Maintain contacts with relevant authorities (police, ICO, NCSC). Evidence: contacts list; procedure for when to contact each authority (e.g. a notifiable personal data breach → ICO, ordinarily within 72 hours).

A.5.6 Contact with special interest groups: Maintain memberships or connections with security forums and industry groups. Evidence: NCSC Early Warning Service subscription, industry ISAC membership, or equivalent.

A.5.7 Threat intelligence: Gather and analyse information about relevant threats. Evidence: process for monitoring threat advisories (NCSC alerts, vendor bulletins); evidence of acting on intelligence.

A.5.8 Information security in project management: Integrate security into project management. Evidence: project initiation checklist including security review; risk assessment for significant new projects.

A.5.9 Inventory of information and other associated assets: Maintain an asset inventory. Evidence: documented asset register covering information, software, hardware, services, people, and premises.

A.5.10 Acceptable use of information and other associated assets: Rules for acceptable use of assets. Evidence: documented acceptable use policy; staff sign-off during induction.

A.5.11 Return of assets: Procedures for returning assets when employment or contract ends. Evidence: leaver checklist; evidence of asset return or sign-off.

A.5.12 Classification of information: Classify information based on confidentiality requirements. Evidence: classification scheme (e.g. Public / Internal / Confidential / Restricted); labelling policy; training records.

A.5.13 Labelling of information: Apply classification labels to information. Evidence: email classification rules; file naming conventions; physical document labelling procedure.

A.5.14 Information transfer: Secure transfer of information between internal and external parties. Evidence: data transfer policy; approved transfer methods; NDAs for third parties receiving confidential information.

A.5.15 Access control: Define and implement access control rules. Evidence: access control policy; user access matrix showing least-privilege; access request and approval process.

A.5.16 Identity management: Manage the full lifecycle of identities. Evidence: joiner/mover/leaver process; identity provisioning records; inactive account review.

A.5.17 Authentication information: Manage authentication credentials. Evidence: password policy (length, complexity, MFA); no shared credentials; password manager policy.

A.5.18 Access rights: Provision, review, modify, and revoke access rights. Evidence: access request records; quarterly access reviews for privileged accounts; leaver access revocation records.

A.5.19 Information security in supplier relationships: Protect organisational information accessed or processed by suppliers. Evidence: supplier assessment procedure; contractual security requirements.

A.5.20 Addressing information security within supplier agreements: Include information security requirements in supplier contracts. Evidence: data processing agreements (required for UK GDPR); security clauses in supplier contracts.

A.5.21 Managing information security in the ICT supply chain: Address security in ICT product and service supply chains. Evidence: software assurance process; evaluation of cloud providers' security certifications (ISO 27001, SOC 2).

A.5.22 Monitoring, review and change management of supplier services: Monitor, review, and manage supplier relationships. Evidence: annual supplier review records; supplier incident response procedure.

A.5.23 Information security for use of cloud services: Define and manage security for cloud service use. Evidence: approved cloud services list; data residency assessment; exit plan for critical cloud services.

A.5.24 Information security incident management planning and preparation: Plan for security incidents. Evidence: incident response plan; defined severity classifications; communication escalation.

A.5.25 Assessment and decision on information security events: Assess security events and classify as incidents. Evidence: incident log; triage process; defined incident classification criteria.

A.5.26 Response to information security incidents: Respond to security incidents. Evidence: incident response records; containment and recovery steps documented; post-incident review.

A.5.27 Learning from information security incidents: Learn from incidents to improve. Evidence: post-incident review reports; evidence that lessons resulted in control improvements.

A.5.28 Collection of evidence: Collect and preserve evidence relating to incidents. Evidence: evidence handling procedure; chain of custody documentation for serious incidents.

A.5.29 Information security during disruption: Protect information security during disruption. Evidence: business continuity plan covering information security; BCP testing records.

A.5.30 ICT readiness for business continuity: Plan, implement, and test ICT continuity measures. Evidence: ICT continuity plan; recovery time and recovery point objectives; test results.

A.5.31 Legal, statutory, regulatory, and contractual requirements: Identify and comply with relevant legal requirements. Evidence: legal compliance register (UK GDPR, Data Protection Act 2018, Computer Misuse Act, sector-specific regulations); compliance review records.

A.5.32 Intellectual property rights: Protect intellectual property. Evidence: software licence register; procedure for checking licence compliance; prohibition on unlicensed software.

A.5.33 Protection of records: Protect records from loss, destruction, and falsification. Evidence: records retention schedule; backup verification; access controls on record repositories.

A.5.34 Privacy and protection of PII: Protect personal information per applicable privacy requirements. Evidence: UK GDPR compliance programme; privacy notices; DPIAs where required; ICO registration.

A.5.35 Independent review of information security: Conduct independent reviews of ISMS implementation. Evidence: internal audit programme; external audit or assessment records. See ISO 27001 Internal Audit Guide.

A.5.36 Compliance with policies, rules and standards for information security: Review compliance with policies and standards. Evidence: compliance review records; management review inputs showing policy adherence assessment.

A.5.37 Documented operating procedures: Document operational procedures for information processing. Evidence: operational SOPs; evidence of version control and communication.

A.6 People controls

People controls cover security obligations related to employment.

A.6.1 Screening: Conduct background checks on candidates and contractors. Evidence: HR policy on pre-employment screening; records of checks conducted (DBS, references, right to work). Note: proportionate to role — senior IT staff with privileged access warrant more extensive screening.

A.6.2 Terms and conditions of employment: Include information security responsibilities in employment terms. Evidence: employment contracts referencing acceptable use policy and confidentiality obligations; contractor agreements.

A.6.3 Information security awareness, education and training: Provide security awareness training. Evidence: annual training programme; attendance records; evidence of tailored training for high-risk roles. Training must be repeated — one induction session does not satisfy this control.

A.6.4 Disciplinary process: Have a formal disciplinary process for policy violations. Evidence: HR disciplinary procedure referencing information security breaches; evidence it has been applied (anonymised records acceptable).

A.6.5 Responsibilities after termination or change of employment: Security obligations on termination or role change. Evidence: leaver checklist; evidence of access revocation; exit interview or security briefing records.

A.6.6 Confidentiality or non-disclosure agreements: Use NDAs where appropriate. Evidence: template NDA; records of NDAs executed with staff, contractors, and third parties receiving confidential information.

A.6.7 Remote working: Protect information when working remotely. Evidence: remote working policy; VPN configuration; device encryption enforcement; clean desk when working from home.

A.6.8 Information security event reporting: Staff should report security events promptly. Evidence: reporting procedure communicated in training; evidence channel exists (email address, helpdesk ticket, form); incident log showing reports received.

A.7 Physical controls

Physical controls cover the physical environment of information processing.

A.7.1 Physical security perimeters: Define and use security perimeters around facilities. Evidence: office entry controls (locked doors, entry cards); server room access restrictions; visitor log.

A.7.2 Physical entry: Control physical access to facilities. Evidence: access control system records; visitor procedure; escort policy for visitors in secure areas.

A.7.3 Securing offices, rooms and facilities: Secure physical spaces. Evidence: lock policy for offices containing sensitive information; secure storage for paper records.

A.7.4 Physical security monitoring: Monitor physical areas. Evidence: CCTV (where appropriate); intruder alarm; monitoring records.

A.7.5 Protecting against physical and environmental threats: Protect against physical threats (fire, flood, power). Evidence: fire suppression or detection in server room; UPS for critical systems; documented environmental assessment.

A.7.6 Working in secure areas: Apply rules for working in secure areas. Evidence: secure area procedures; prohibition on unauthorised devices in secure areas; clean desk enforcement.

A.7.7 Clear desk and clear screen: Maintain clear desk and screen lock policy. Evidence: documented policy; clean desk inspections; automatic screen lock configured.

A.7.8 Equipment siting and protection: Position equipment to reduce risk. Evidence: server room siting assessment; cable management records; monitor positioning (no screens visible from public areas).

A.7.9 Security of assets off-premises: Protect assets taken off-site. Evidence: laptop encryption (verified via configuration reports); mobile device management; approval process for taking assets off-site.

A.7.10 Storage media: Manage storage media across acquisition, use, and disposal. Evidence: removable media policy; USB use restrictions or prohibition; secure disposal records (certificate of destruction for hard drives).

A.7.11 Supporting utilities: Protect against power and utility failures. Evidence: UPS for servers; generator or alternative power for critical operations; environmental monitoring.

A.7.12 Cabling security: Protect communications cabling. Evidence: network cable routing records; prevention of access to cable runs; labelling of network connections.

A.7.13 Equipment maintenance: Maintain equipment to ensure availability and integrity. Evidence: maintenance schedule; vendor support contracts; patch management records.

A.7.14 Secure disposal or re-use of equipment: Dispose of equipment securely. Evidence: equipment disposal procedure; hard drive wiping records or physical destruction certificates; asset register updated on disposal.

A.8 Technological controls

Technological controls cover security measures implemented in systems and software.

A.8.1 User endpoint devices: Protect user endpoint devices. Evidence: endpoint protection configuration (antivirus, EDR); encryption enforcement; device management records.

A.8.2 Privileged access rights: Restrict and manage privileged access. Evidence: privileged account register; quarterly review records; no shared admin accounts; MFA on admin accounts.

A.8.3 Information access restriction: Restrict access to information per access control policy. Evidence: access control lists; role-based access configuration; audit logs of access.

A.8.4 Access to source code: Control access to source code. Evidence: version control system with access restrictions; branch protection rules; code review process. (Applicable if you develop software.)

A.8.5 Secure authentication: Implement secure authentication. Evidence: MFA enforcement on all systems handling sensitive data; password policy configuration; SSO implementation.

A.8.6 Capacity management: Monitor and manage system capacity. Evidence: capacity monitoring dashboards; alerts for storage or CPU thresholds; documented capacity review records.

A.8.7 Protection against malware: Protect against malware. Evidence: endpoint protection software installed and updated; email filtering; web filtering; staff training on phishing.

A.8.8 Management of technical vulnerabilities: Identify and manage technical vulnerabilities. Evidence: vulnerability scanning schedule and results; patch management policy and records; CVE monitoring process.

A.8.9 Configuration management: Manage security configurations. Evidence: documented baseline configurations; change control process for configuration changes; configuration audit records.

A.8.10 Information deletion: Delete information when no longer needed. Evidence: data retention schedule; records of data deletion; secure deletion method for sensitive data.

A.8.11 Data masking: Mask sensitive data where appropriate. Evidence: PII masking in non-production environments; data masking in reports and exports; applicable to SQL databases and analytics.

A.8.12 Data leakage prevention: Prevent unauthorised disclosure of sensitive information. Evidence: DLP tool configuration; USB restriction policy; email monitoring for sensitive content exfiltration.

A.8.13 Information backup: Back up information and test recovery. Evidence: backup schedule; off-site or cloud backup; tested restore procedure with documented results; RPO/RTO defined.

A.8.14 Redundancy of information processing facilities: Implement redundancy to meet availability requirements. Evidence: high availability configuration for critical systems; failover test records; documentation of single points of failure.

A.8.15 Logging: Produce, protect, and analyse event logs. Evidence: logging enabled on servers, network devices, and applications; log retention period defined; regular log review records.

A.8.16 Monitoring activities: Monitor networks and systems for anomalies. Evidence: SIEM or monitoring tool; alert thresholds defined; evidence of alerts reviewed and acted on.

A.8.17 Clock synchronisation: Synchronise clocks across systems. Evidence: NTP configuration on all systems; clock sync verification records; log timestamps consistent across systems.

A.8.18 Use of privileged utility programs: Control privileged utility programs. Evidence: approved tools list; access restriction on diagnostic and administration utilities; change records for privileged tool use.

A.8.19 Installation of software on operational systems: Control software installation. Evidence: software installation policy; change management approval for new software; software inventory.

A.8.20 Networks security: Protect networks. Evidence: network segmentation design; firewall rule review records; segregation of guest and corporate Wi-Fi.

A.8.21 Security of network services: Secure network services. Evidence: ISP/managed network service contracts with security SLAs; network service monitoring.

A.8.22 Segregation of networks: Separate networks based on trust levels. Evidence: VLAN configuration; DMZ for internet-facing systems; guest Wi-Fi isolated from internal network.

A.8.23 Web filtering: Control access to external websites. Evidence: web filtering policy; DNS filtering or proxy configuration; blocked category list.

A.8.24 Use of cryptography: Implement cryptographic controls. Evidence: cryptography policy; encryption of data at rest (disk encryption) and in transit (TLS 1.2+); key management process.

A.8.25 Secure development life cycle: Apply security in development. Evidence: secure coding standards; security testing in SDLC; SAST/DAST tools in pipeline. (Applicable to software development organisations.)

A.8.26 Application security requirements: Define and enforce application security requirements. Evidence: security requirements in functional specifications; pen test results; OWASP Top 10 assessment.

A.8.27 Secure system architecture and engineering principles: Apply secure architecture principles. Evidence: documented architecture review process; defence-in-depth design; zero trust principles where applicable.

A.8.28 Secure coding: Apply secure coding practices. Evidence: secure coding guidelines; code review for security; developer security training records.

A.8.29 Security testing in development and acceptance: Test security in development and acceptance. Evidence: security test plan; test results; vulnerabilities remediated before production deployment.

A.8.30 Outsourced development: Supervise and monitor outsourced development. Evidence: supplier contracts with security requirements; code review of outsourced deliverables; security acceptance criteria.

A.8.31 Separation of development, test and production environments: Separate environments. Evidence: separate development/test/production systems; no production data in test; change management between environments.

A.8.32 Change management: Manage changes to information processing facilities. Evidence: change request process; impact assessment; approval; testing before production deployment; rollback plan.

A.8.33 Test information: Protect test information. Evidence: prohibition on production data in test; data masking for test datasets; access restriction on test systems.

A.8.34 Protection of information systems during audit testing: Protect systems during audit and testing. Evidence: audit tool access restrictions; audit scope defined and approved; test environment used for penetration testing where possible.

Applying this to your Statement of Applicability

Your SoA must address all 93 controls. For each: applicable or not applicable, justification, and implementation status. Controls you exclude must have a justification — "we have no physical offices" or "we do not develop software" are valid if true. "We don't do this" without a risk-based reason is not.

Our ISO 27001 Annex A Controls Checklist provides an interactive applicability assessment for all 93 controls with evidence prompts and links back to your risk register.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. The 93-control, 4-theme figure comes from UKAS's ISO/IEC 27001:2022 transition bulletin, which states that Annex A "has been aligned with the controls defined in ISO/IEC 27002:2022, which contains 93 controls (11 of which are new) organised in 4 themes" — so the count is UKAS's figure for ISO/IEC 27002:2022, with which Annex A is aligned, rather than a count UKAS states for Annex A itself. The 11 new / 24 merged / 58 updated breakdown in that same sentence is stated of the ISO/IEC 27002:2022 control set, not of Annex A entries; UKAS does not say what those figures are measured against. Those are the only control figures this guide claims. No per-category control count is stated, and no control count is stated for the withdrawn 2013 edition: both are internal to paywalled standards and are not published by any free primary source. The individual control numbers and titles in this guide are drawn from ISO/IEC 27002:2022, which is paywalled and cannot be quoted here — check them against a purchased copy of the standard before relying on them for an audit. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide covers which policies are mandatory, what each must contain, and how to structure them so they work as real operational tools.

Which policies does ISO 27001 require?

ISO 27001:2022 mandates documented policies in several places. The core requirement is in Clause 5.2: top management must establish an information security policy. Annex A adds specific policies across its 4 control categories.

Mandatory under the management system clauses:

Mandatory or strongly expected under Annex A (based on typical risk assessments):

The actual policies you need depend on your risk assessment and Statement of Applicability. A control you declare "not applicable" in your SoA does not require a policy. But any control you declare applicable — particularly in A.5 organisational controls — almost always requires at least a brief policy statement.

The information security policy (Clause 5.2)

This is the top-level policy — the document that signals organisational commitment to information security. Clause 5.2 requires it to:

• Be appropriate to the purpose of the organisation
• Include information security objectives or provide a framework for setting them
• Include a commitment to satisfying applicable requirements
• Include a commitment to continual improvement of the ISMS
• Be communicated within the organisation
• Be available to interested parties as appropriate

What it does not need to be: long. A one-page A4 document signed by the managing director satisfies the requirement for most SMBs. The mistake most businesses make is writing a generic policy downloaded from the internet that no employee recognises as relevant to their work.

Effective information security policy structure:

1. Purpose and scope (1 paragraph): Why information security matters for this business. Name the specific risks — client data, business systems, supplier relationships.
2. Objectives (3–5 bullet points): Specific, measurable where possible. "All staff to complete annual security awareness training by December each year." Not: "maintain a culture of security."
3. Commitments (1 paragraph): Commitment to meeting ISO 27001 requirements and continually improving the ISMS.
4. Responsibilities (1 paragraph): Who owns the ISMS. Named individual, not "the IT department."
5. Review (1 line): Annual review date and approval authority.
6. Signature and date: Managing director or equivalent.

One page. Reviewed annually. Communicated to all staff at induction and when materially updated.

Topic-specific policies

Under Annex A.5.1, you are expected to have topic-specific policies for individual control areas. Each policy is a separate document — typically 1–3 pages — covering a specific subject area in more detail than the top-level policy.

Acceptable use policy (A.5.10)

Covers: permitted and prohibited use of information assets. What staff can and cannot do with company systems, devices, email, and data. Must include:

• Permitted personal use (if any) of company systems
• Prohibited activities: installing unauthorised software, sharing credentials, accessing systems for personal gain
• Use of portable media and personal devices (BYOD)
• Consequence of policy breach (reference disciplinary procedure)
• Review: annually, or when significant changes occur

Access control policy (A.5.15)

Covers: who gets access to what, and how access is granted, reviewed, and revoked. Must include:

• Principle of least privilege — access only to what is required for the role
• How access requests are made and approved
• Joiner / mover / leaver process for access changes
• Review frequency for access rights (annually for most systems; quarterly for privileged access)
• Reference to privileged access management (A.8.2)

Clear desk and clear screen policy (A.7.7)

Often combined into one document. Must include:

• Physical clear desk requirements: no sensitive documents visible when unattended
• Screen lock requirements: automatic lock after a defined period of inactivity; manual lock when leaving desk
• Printer and copier procedures: collect sensitive print-outs immediately
• Disposal of paper documents containing sensitive information

Remote working policy (A.6.7)

Covers: information security requirements for staff working away from the office. Must include:

• Permitted and prohibited activities when working remotely
• VPN or secure connection requirements for accessing internal systems
• Physical security requirements for home offices (screen visibility, visitors)
• Device requirements: encryption, updated OS, antivirus
• Incident reporting when working remotely

Bring your own device policy (A.6.7 / A.8.1)

If personal devices access company systems. Must include:

• Eligibility and approval process for BYOD
• Minimum security requirements for personal devices (encryption, passcode, approved app)
• Data storage restrictions: what company data can be stored on personal devices
• Right of the company to remotely wipe the device if lost, stolen, or on leaving the company
• Leaver process: verify data removal from personal device

Supplier security policy (A.5.19–A.5.22)

Covers: how third-party suppliers that access your systems or data are managed. Must include:

• Due diligence requirements before engaging suppliers
• Contractual requirements: data processing agreements, right to audit, security obligations
• Ongoing monitoring: how supplier security is reviewed during the relationship
• Termination: how access is revoked and data is recovered or destroyed at contract end

Policy writing principles

Write for the reader, not the auditor. A policy that staff cannot understand will not be followed. Avoid legal language, passive voice, and abstract commitments.

Be specific to your business. Generic downloaded templates fail because they reference systems, roles, and processes that do not match your organisation. Name your actual systems (Microsoft 365, not "email systems"). Name your actual roles (Office Manager, not "relevant personnel").

Keep them short. One to three pages per policy. An employee should be able to read and understand a policy in under five minutes.

Assign ownership. Each policy should have a named owner — the person responsible for maintaining and implementing it. Typically the IT Manager, Operations Director, or ISMS Manager.

Set a review date. Annual review is the minimum. Trigger-based reviews are also required: when a significant change occurs, after an incident, or when the policy area is identified as a risk.

Control your versions. Policies are documented information under Clause 7.5. They need version numbers, review dates, and approval signatures. A simple header block on each document handles this:

Document: Remote Working Policy | Version: 1.2
Approved by: Jane Smith (MD) | Date: 2026-03-15
Next review: 2027-03-15

How policies connect to your ISMS

Policies do not exist in isolation. Each feeds into:

• Risk assessment (Clause 6.1): policy gaps identified in the risk assessment indicate which new policies are needed
• Mandatory documents (see full list): policies form a significant portion of the ISMS documentation set

• Internal audits (Clause 9.2): auditors check whether policies are being followed in practice — not just whether they exist. See ISO 27001 Internal Audit Guide
• Awareness training (A.6.3): all staff must be aware of the security policies relevant to their role. Policy distribution and training records are evidence of this
• Management review (Clause 9.3): policy adequacy is reviewed annually as part of management review inputs

The most common finding during Stage 2 audits related to policies: the policy says one thing and the practice is something different. "Staff must use VPN when working remotely" written in the remote working policy, but 4 of 8 audited staff had never been set up with VPN access. The policy exists; the control does not. Write policies that reflect what your business actually does — or implement the controls before the audit.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Clause 6.1 of ISO 27001:2022 is the requirement. This guide translates it into a practical template and process for a UK SMB with 10–100 employees.

What Clause 6.1 requires

ISO 27001:2022 Clause 6.1.2 requires you to:

• Define and apply an information security risk assessment process
• Identify information security risks associated with the loss of confidentiality, integrity, and availability of information within the ISMS scope
• Analyse and evaluate the risks against defined criteria
• Prioritise risks for treatment

Clause 6.1.3 requires you to:

• Identify risk treatment options
• Determine which Annex A controls are necessary and applicable
• Produce a Statement of Applicability (SoA) listing all 93 Annex A controls with justifications for inclusion or exclusion
• Produce a risk treatment plan

Clause 7.5.1 requires you to retain documented information as evidence — so the risk assessment must be a living, maintained document, not a one-off exercise.

The standard does not prescribe a methodology. You choose. What matters is: your methodology is documented, consistently applied, and produces results you can defend.

Step 1: Document your methodology first

Before you identify a single risk, write down how you will assess them. Your methodology document (1–2 pages) should cover:

Scope: Which information, systems, processes, sites, and people are in scope? Reference your ISMS scope definition (Clause 4.3).

Risk identification approach: How will you identify assets and the threats and vulnerabilities associated with them? (Asset-based approach — most common for SMBs.)

Risk criteria: What scale will you use for likelihood and impact? 3x3 (1-3 each) is simpler; 5x5 gives more granularity. Define what each level means. For a UK SMB, impact levels might be:

• 1 = Minimal: brief disruption, no data loss, no regulatory exposure
• 2 = Moderate: operational disruption >4 hours, potential data breach (ICO notification unlikely)
• 3 = Significant: major disruption, confirmed data breach requiring ICO notification, reputational damage, contract loss

Risk score: Likelihood x Impact = Risk Score (1–9 on a 3x3). Define your acceptance threshold: risks scoring ≤3 = acceptable; 4–6 = treat; 7–9 = priority treatment.

Risk acceptance criteria: Who can authorise accepting a risk? For most SMBs, this is a director or owner.

Document this once. Apply it consistently to every risk. Your certification auditor will look for methodology consistency across the risk register.

Step 2: Build your asset inventory

An asset-based risk assessment starts with identifying what you need to protect. For an ISO 27001 ISMS, information assets include:

Information assets: Client data (contracts, financial records, PII), employee records, intellectual property, business plans, pricing data, system access credentials.

Software assets: Business applications (CRM, ERP, accounting), email and collaboration platforms, security tools, bespoke software.

Hardware assets: Laptops, servers, mobile devices, printers, network equipment, removable media.

Service assets: Cloud services (AWS, Azure, Microsoft 365, Google Workspace), ISP, managed service providers, CCTV systems.

People: Employees, contractors, third-party service providers with system access.

Premises: Office locations, server rooms, client sites where work is conducted.

For each asset, record: asset name, description, owner (named individual), classification (confidential / internal / public). 30–80 assets is typical for a 10–100 person SMB. Do not over-engineer: focus on assets that, if compromised, would cause real harm.

Step 3: Identify threats and vulnerabilities

For each asset (or logical group of assets), identify relevant threats and the vulnerabilities that make those threats exploitable.

Common threat categories for UK SMBs:

Match threats to assets. Not every threat applies to every asset — a paper document cannot be compromised by ransomware, but it can be stolen or lost.

Step 4: Score and prioritise risks

For each threat-asset combination, apply your likelihood x impact scoring:

Work through your full asset inventory. A typical SMB risk register has 40–80 entries. Focus analysis effort on high-scoring risks — these drive control selection.

Step 5: Risk treatment decisions

For each risk, you have four treatment options:

Modify (mitigate): Implement controls to reduce likelihood or impact. Most risks are treated this way — select applicable Annex A controls and assign to an owner.

Retain (accept): The risk is within your acceptance criteria, or treatment cost exceeds the potential loss. Document the decision and who authorised it. Every accepted risk must be formally documented — "we chose not to treat this" is valid; "we never looked at it" is not.

Avoid: Change the activity that creates the risk. Stop holding certain categories of data, outsource a high-risk process, exit a market.

Share / transfer: Insurance, contractual liability transfer to a supplier, outsourcing to a managed security provider.

For each treated risk, record: treatment decision, control(s) selected (reference Annex A), implementation owner, target implementation date, residual risk after treatment.

Step 6: Map to Annex A and produce your SoA

Every risk treatment that involves implementing a control requires a corresponding Annex A control reference. The 93 controls in ISO 27001:2022 Annex A are grouped into four categories:

• A.5 Organisational controls: policies, roles, supplier management, incident response
• A.6 People controls: screening, terms of employment, awareness, remote working
• A.7 Physical controls: physical security perimeters, clear desk, equipment disposal
• A.8 Technological controls: access control, cryptography, malware protection, backup, patch management

The 93-control, four-category figure is UKAS's, stated of ISO/IEC 27002:2022, with which UKAS says Annex A has been aligned; the category names and the individual control numbers and titles come from ISO/IEC 27002:2022, which is paywalled.

Not all 93 controls apply to every organisation. Your SoA must list all 93 and state, for each: applicable or not applicable, and the justification. Controls identified as applicable must link back to a specific risk or legal/contractual requirement.

Our ISO 27001 Annex A Controls Checklist maps all 93 controls with applicability prompts and links to your risk register entries.

Step 7: Risk treatment plan

Your risk treatment plan is a separate document that lists:

The risk treatment plan is a live document — update it as controls are implemented and residual risks are re-scored.

UK-specific considerations

UK GDPR: Your ISMS risk assessment should identify risks related to personal data processing. Where a risk involves processing that is likely to result in high risk to individuals, a Data Protection Impact Assessment (DPIA) may be required under UK GDPR Article 35. The ICO publishes guidance at ico.org.uk.

Cyber Essentials: If you hold Cyber Essentials, several Annex A technological controls are partially addressed: boundary firewalls (A.8.20), secure configuration (A.8.9), access control (A.8.2–8.5), malware protection (A.8.7), and patch management (A.8.8). Map your CE evidence against Annex A before building from scratch.

Sector-specific threats: Financial services, healthcare, and public sector supply chain businesses face additional threats (FCA requirements, NHS DSP Toolkit, MOD supplier requirements). Ensure your threat identification reflects your sector context.

Maintaining the risk assessment

The risk assessment is not a one-time document. Review triggers under ISO 27001:2022:

• At least annually, as part of management review (Clause 9.3)
• When significant changes occur: new systems, new processes, new offices, acquisitions, key staff changes
• After an information security incident or near-miss
• When new threats emerge (new ransomware variant, supplier breach disclosed)

Document each review. Record what was reviewed, whether any risks changed, and whether new risks were identified. Even a review that concludes "no changes needed" should be documented — the evidence of regular review is what auditors look for.

Your risk assessment results feed directly into your ISO 27001 gap analysis, which maps your current control implementation against the risks you have identified.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

What Clause 9.2 requires

ISO 9001:2015 Clause 9.2.1 requires internal audits at planned intervals to confirm your QMS: (a) conforms to your own QMS requirements and to ISO 9001 requirements; and (b) is effectively implemented and maintained.

Clause 9.2.2 requires you to plan, establish, implement, and maintain an audit programme, taking into account the importance of the processes concerned, changes affecting the organisation, and the results of previous audits.

The standard does not specify frequency. "At planned intervals" means you decide — your documented audit programme is the evidence that intervals are planned and risk-based. Most certification bodies expect a minimum of one full-scope internal audit per year. Businesses with complex operations, high process risk, or recent nonconformities should audit more frequently.

What the audit programme document contains

Your audit programme is the master planning document — separate from individual audit plans (which are per-audit briefs) and audit reports (which are per-audit outputs).

Minimum content of an annual audit programme:

One page is sufficient for most SMBs. Complexity should match the organisation.

Building your audit schedule

Step 1: List all processes in scope

Start with your QMS scope. Identify every process the QMS covers — production, purchasing, customer service, design, sales, HR, IT (if in scope). For each process, note:

• Which ISO 9001 clauses apply
• The last time it was audited
• Any open nonconformities or customer complaints related to it
• Its risk rating (high / medium / low based on consequence of failure)

This is your process inventory — the basis for coverage planning.

Step 2: Plan coverage across the year

All processes must be audited at least once per certification cycle (3 years). For annual programmes, the practical target is covering all processes once per year. For a 12-month schedule:

Month 1–2: Confirm programme, assign auditors, agree dates with process owners Month 3–4: First audit block — focus on core operational processes (Clauses 7–8) Month 6–7: Second audit block — management system processes (Clauses 4–6, 9–10) Month 9–10: Third audit block (optional for smaller businesses) — high-risk processes, outstanding corrective actions Month 11: Management review — audit programme results as a key input (Clause 9.3)

For a 5–20 person business, one focused annual audit covering all clauses in 1–2 days is often sufficient. For 20–100 people with distinct departments, 3–4 targeted audits per year is more manageable.

Step 3: Apply risk-based prioritisation

Clause 9.2.2 explicitly requires the programme to consider risk. Audit higher-risk processes more frequently. Risk indicators:

• Processes with recent nonconformities or customer complaints
• Processes that changed significantly (new equipment, new procedure, new staff)
• Processes regulated by external requirements (COSHH, food safety, building regulations)
• Processes with a history of recurring issues

Low-risk processes that performed well in the previous audit can be sampled rather than fully audited, or rotated across years in longer cycles.

Step 4: Assign auditors — confirm independence

Clause 9.2.2 requires you to select auditors and conduct audits to ensure objectivity and impartiality. The rule: auditors cannot audit their own work.

For SMBs with limited staff, practical options:

• Peer auditing: Swap auditors between departments. Finance manager audits production; production manager audits admin. Train both as competent auditors.
• External internal auditor: Engage a freelance ISO 9001 consultant to run your internal audit. Costs £400–900 per day but eliminates the independence problem and often produces higher-quality findings.
• Certification body's observation service: Some UKAS-accredited bodies offer internal audit support outside the certification engagement — check with your certifier.

Document auditor names against each audit slot in the programme. Your certification auditor will check that independence was maintained.

Audit schedule format

A simple annual audit schedule covers:

Keep it simple. Certification auditors look for: does the programme exist, does it cover all clauses over the cycle, are auditors independent, are dates planned vs reactive?

Update the Status column as audits complete: Planned → In progress → Complete → Report issued. Add the Report reference when the report is filed.

What certification bodies check

At your Stage 2 audit and subsequent surveillance audits, your certification body will:

1. Request your audit programme. They want to see dates, scope, auditor names — evidence it was planned in advance, not improvised.
2. Review audit reports. They will read findings, check classification (NC vs observation), and look for root cause analysis and corrective actions.
3. Verify corrective action closure. Open NCs without evidence of corrective action are a finding — sometimes a major one if they relate to a core clause.
4. Check management review minutes. Internal audit results must be a management review input (Clause 9.3.2 d). If the MD has never seen the audit report, that is a gap.
5. Confirm auditor independence. If the QMS manager audited all processes including their own, expect a finding.

The most common internal audit finding in certification audits: the audit programme exists, but corrective actions from previous audits were never tracked to closure. Build corrective action follow-up into your programme from the start — either as a separate audit block or as agenda items at management reviews.

Connecting the audit schedule to the rest of your QMS

Your audit schedule is not a standalone document. It feeds:

• Quality policy (Clause 5.2): internal audits are one of the primary mechanisms for demonstrating that the policy is implemented and maintained
• Risk register (Clause 6.1): audit findings that reveal process risks should update the risk register — see ISO 9001 Risk Assessment Template

• Corrective actions (Clause 10.2): every NC finding from an audit generates an NCR — see ISO 9001 Non Conformance Report Template
• Management review (Clause 9.3): audit results summary is a mandatory input
• Quality objectives (Clause 6.2): audit findings often identify where objectives are not being met

At management reviews, present: number of audits completed vs planned, total NCs by clause, open vs closed corrective actions, any repeat nonconformities. This is the report format that demonstrates the QMS is a live system, not a paper exercise.

Downloadable audit schedule template

An annual audit programme template covering all ISO 9001:2015 clauses — with risk-level columns, auditor assignment, finding classification, corrective action tracking, and a management review summary block — is available as a free XLSX download. It works in Microsoft Excel and Google Sheets.

For the corresponding ISO 9001 internal audit checklist with 15 questions your auditor will likely ask, see that guide for the fieldwork preparation.

If you are working towards your certification audit, the ISO 9001 Audit Readiness Checker helps you confirm your Stage 1 documents and Stage 2 evidence are complete before the certification body arrives.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide covers what an effective NCR contains, how to structure root cause analysis, and how to close corrective actions in a way that satisfies both your business and your auditor.

What Clause 10.2 requires

ISO 9001:2015 Clause 10.2 requires that when a nonconformity occurs — whether from a complaint, an internal audit finding, a process failure, or a product defect — you must:

1. React: control and correct the nonconformity, deal with the consequences
2. Evaluate the need for corrective action by reviewing and analysing the nonconformity, establishing the cause(s), and determining if similar nonconformities exist or could occur elsewhere
3. Implement any actions needed, then review effectiveness
4. Update risks and opportunities if needed
5. Make changes to the QMS if necessary

Documented information is required as evidence of: the nature of the nonconformities, actions taken, and results of corrective actions (Clause 10.2.2).

Two important distinctions: a correction fixes the immediate problem (rework a defective product, recall a wrong delivery). A corrective action addresses the root cause so the problem does not recur. Both are required; auditors check both.

When to raise an NCR

An NCR should be raised whenever you identify a failure to meet a specified requirement. This includes:

• Customer complaints — a delivered product or service did not meet agreed specification
• Internal audit findings — process or product does not conform to documented procedure or standard requirement
• Process failures — output does not meet defined acceptance criteria
• Supplier failures — incoming goods or services do not meet purchase specification
• Regulatory nonconformities — failure to meet a legal or contractual requirement

Some businesses set a threshold — for example, only raising a formal NCR for issues above a certain cost or frequency. This is acceptable, provided the threshold is documented and consistently applied. Auditors become suspicious when a business has zero NCRs over 12 months — either the QMS is exceptionally well-run, or problems are being masked.

NCR template structure

A well-structured non conformance report has six sections:

Section 1: Identification

Section 2: Description of the nonconformity

State exactly what was found. Be specific: what, where, when, how many.

Weak: "Quality checks not performed." Strong: "Final inspection records missing for batch #A2047 (12 units, despatched 2026-06-15). Clause 8.6 requires signed inspection evidence before release. 3 of 12 units returned by customer on 2026-06-22 with dimensional failures."

Attach evidence: photos, data records, audit checklists, complaint correspondence.

Section 3: Immediate correction

What was done to fix the immediate problem?

• Product recalled / reworked / scrapped / concession granted?
• Customer informed / credit issued / replacement despatched?
• Process stopped pending investigation?

Record the disposition decision and who authorised it. If a concession (accepting nonconforming output "as is") was granted, it must be documented and — for regulated products or contractual requirements — may need customer or client sign-off.

Section 4: Root cause analysis

This is the section most NCRs get wrong. Identifying the symptom as the cause produces corrective actions that do not prevent recurrence.

5-Why method — effective for simple process failures:

• Why did the defect occur? Final inspection was not completed.
• Why? Inspector was off sick and no cover was arranged.
• Why? No cross-training procedure for inspection roles.
• Why? Training plan only covers primary role assignments.
• Why? Training plan template has no section for backup role competencies.

Root cause: training plan does not capture backup role requirements.

Ishikawa (fishbone) analysis — useful for complex failures with multiple contributing factors across people, process, equipment, environment, materials, and measurement.

Document the method used, the cause chain, and the identified root cause(s). Your auditor will check that the corrective action targets the root cause, not just the symptom.

Section 5: Corrective action plan

For each root cause, define:

Actions must be appropriate to the effect of the nonconformity. Clause 10.2.1 states this directly, in a standalone requirement after the lettered list: "Corrective actions shall be appropriate to the effects of the nonconformities encountered." A minor administrative error does not require a complete QMS overhaul. A product failure that injured a customer does.

Section 6: Verification of effectiveness

After the corrective action completion date, a second person (or your next internal audit) must verify:

• Action was completed as planned
• Root cause has been eliminated (or controlled)
• The same nonconformity has not recurred

Record the verification: who checked, what evidence was reviewed, outcome. If the corrective action proved ineffective, raise a new NCR or extend the existing one with revised analysis.

Mark the NCR as closed only when effectiveness has been verified.

Tracking open NCRs

Your corrective action log should be a live document reviewed at management reviews (Clause 9.3.2 requires management review inputs to include nonconformities and corrective actions). Minimum log columns:

| NCR ref | Date raised | Source | Summary | Root cause | Corrective action | Owner | Target date | Status | Closed date |

Export or summarise this at each management review. Your certification auditor will ask to see it.

Common NCR mistakes

Confusing correction with corrective action. Fixing the product and closing the NCR without addressing root cause means the problem will recur — and your auditor will notice the pattern.

Vague root cause. "Human error" is not a root cause. Human error is a symptom. What process, training gap, or system failure made the error easy to commit?

No closure verification. An NCR marked "closed" with no effectiveness check is a finding in itself. Clause 10.2.1 d) requires you to review the effectiveness of any corrective action taken before declaring the action complete.

Missing records. Corrective actions taken verbally and never documented. Evidence must exist: photos, updated procedure, training records, retested product data.

Chronically open NCRs. An NCR still open 6 months after the target date signals that either the action is too ambitious or nobody is accountable. Escalate to management review before your certification audit — auditors spot overdue items immediately.

How NCRs connect to the rest of your QMS

Well-managed NCRs feed other parts of your QMS:

• Risk register (Clause 6.1): recurring NCRs indicate an underrated risk — update your risk assessment
• Objectives (Clause 6.2): NCR trend data informs improvement targets ("reduce complaint rate from 4.1% to 2.5%")
• Management review (Clause 9.3): NCR status and trend is a mandatory input
• Internal audits (Clause 9.2): process areas with high NCR rates should be prioritised in your internal audit schedule
• Document control (Clause 7.5): if a corrective action changes a procedure, document control rules apply — version control, review, approval

The businesses that benefit most from their QMS treat NCRs as early warning signals, not compliance obligations. A spike in supplier NCRs often predicts a customer complaint 4–6 weeks later if left unaddressed.

ISO 27001 parallel

If you run an ISMS alongside your QMS, ISO 27001 Clause 10.2 has an identical structure and requirement. Information security nonconformities — access control failures, policy breaches, incident handling gaps found in internal audits — follow the same NCR process. Many SMBs use a single NCR template covering both standards, with a "standard reference" field to distinguish QMS from ISMS findings.

See also: ISO 9001 Risk Assessment Template for context on how NCR trends feed back into your risk register.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Most UK SMBs treat internal audits as a checkbox before Stage 2. Auditors know this and probe for it. A well-run internal audit programme is one of the clearest signals that your ISMS is genuine, not a paper exercise.

This guide covers what Clause 9.2 actually requires, how to plan a proportionate internal audit programme for a 10–100 person business, and what a solid audit report looks like.

What Clause 9.2 requires

ISO 27001:2022 splits Clause 9.2 into two parts:

Clause 9.2.1 requires that you conduct internal audits at planned intervals to confirm your ISMS: (a) conforms to your own ISMS requirements and to ISO 27001's requirements; and (b) is effectively implemented and maintained.

Clause 9.2.2 requires that you plan, establish, implement, and maintain an audit programme — covering frequency, methods, responsibilities, and reporting — that takes into account the importance of the relevant processes and the results of previous audits.

Two things are notable. First, the standard does not set a fixed frequency. "Planned intervals" means you decide — based on risk, changes in your business, and audit history. Annually is the minimum most certification bodies expect; high-risk areas should be audited more often. Second, the programme must evolve: last year's findings should inform this year's scope and depth.

Who can conduct internal audits

Auditors must be objective and impartial (Clause 9.2.2). This means the person who designed or operates a control cannot audit it. For most SMBs, complete staff separation is unrealistic — common approaches that satisfy the standard:

• Cross-department swap. The finance manager audits IT processes; the IT manager audits HR processes. Works well if both receive auditor training first.
• Rotating external specialist. A freelance ISO 27001 consultant runs your internal audit, documents findings, and produces the formal report. Costs £500–1,500 per audit day but removes the independence problem entirely.
• Peer audit between certified businesses. Two SMBs with ISMS programmes audit each other under a confidentiality agreement. Common in professional services networks.

Whatever route you choose, document auditor qualifications or training records. Your certification auditor will ask.

Planning your audit programme

For a first-year certification cycle, plan a minimum of two internal audits before your Stage 2 assessment:

1. Gap audit (month 3–4 of implementation). Scope: all ISMS clauses and a representative sample of Annex A controls. Purpose: identify gaps while there is time to close them before certification. This often doubles as your first documented internal audit.

2. Pre-certification audit (month 8–10). Scope: same coverage, focusing on controls where the gap audit raised findings. Purpose: verify corrective actions are closed and your ISMS is ready for Stage 2 scrutiny.

After certification, plan at least one internal audit per year. Audit higher-risk areas and any Annex A controls with open findings from your last surveillance audit more frequently.

Your audit programme document should record: dates, scope, auditor name, methodology (document review, interviews, observation), and planned reporting format. This is the document your certification auditor reviews first.

Structuring your audit checklist

An ISO 27001 internal audit covers two areas: the ISMS clauses (4–10) and the applicable Annex A controls from your Statement of Applicability.

ISMS clause checklist structure (Clauses 4–10):

Annex A control sampling approach:

With 93 controls across 4 categories, auditing every applicable control in one session is impractical for most SMBs. Use a risk-based sampling approach:

• Audit all controls rated high-risk in your risk assessment every cycle
• Rotate medium-risk controls across audit cycles so all are covered over 3 years
• Prioritise controls in categories A.5 (organisational) and A.8 (technological) — these carry the highest evidence burden
• After a cyber incident or near-miss, advance the audit of relevant controls regardless of schedule

Our ISO 27001 Annex A Controls Checklist maps all 93 controls to the standard's four categories with evidence prompts for each.

Conducting the audit

A well-run internal audit has four stages:

1. Preparation (1–2 days). Define scope and criteria. Notify auditees at least 1 week in advance. Request document evidence: current policy versions, risk register, SoA, training records, incident log, previous audit reports. Review these before the fieldwork day.

2. Fieldwork (0.5–2 days depending on scope). Combine document review, interviews, and observation. For ISMS audits, interviews are critical — paper policies must be backed by staff who understand and follow them. Ask open questions: "Walk me through what happens when you onboard a new supplier" rather than "Do you follow the supplier vetting procedure?"

3. Reporting (0.5–1 day). Classify findings into three categories:

• Nonconformity (NC): A requirement of the standard or your ISMS is not met. Major NC = missing entirely. Minor NC = partial implementation.
• Observation / opportunity for improvement (OFI): Not a breach, but a weakness worth addressing.
• Positive finding: Evidence of strong practice, worth sharing across the business.

4. Follow-up. For each nonconformity, the responsible process owner must: identify root cause, implement corrective action, set a target closure date. Track corrective actions in a log. Your next internal audit should verify all major NCs are closed.

What a finding looks like

Weak finding: "Access controls need improvement."

Strong finding: "Clause 9.2.2 / Annex A.8.2 (Privileged access rights): Review found 4 former employees still had active VPN credentials at the audit date. Access termination procedure exists (v1.2, dated 2025-04-01) but was not followed for leavers in Q1 2026. Root cause: offboarding checklist does not assign VPN revocation to a named owner. Corrective action: revoke credentials by 2026-07-25; update offboarding checklist to name IT administrator as owner. Target closure: 2026-08-01."

The difference: specificity, evidence, clause reference, root cause, named action, date. Certification auditors will read your internal audit reports during Stage 2 and look for exactly this.

Records to retain

Clause 9.2.2 requires you to retain documented information as evidence of the audit programme and audit results. Keep:

• Audit programme (schedule for the year)
• Individual audit plans (scope, criteria, auditor, dates)
• Audit checklists used
• Audit reports with classified findings
• Corrective action log with closure evidence

Retain for at least the current certification cycle (3 years). Many organisations retain indefinitely — audit history is useful context for management reviews and surveillance audits.

Common reasons internal audits fail certification scrutiny

1. Auditor not independent. A process owner audits their own process. Documenting auditor roles and independence is the fix.
2. Scope too narrow. "We only audited Annex A.8 controls" when the risk assessment showed significant organisational and people controls. Cover all clauses every cycle.
3. No corrective action follow-up. Findings without documented closure actions signal the audit was a paper exercise.
4. Report filed and forgotten. Management review inputs must include internal audit results (Clause 9.3.2). If there is no evidence the MD saw the report, it is a finding.
5. First audit done the week before Stage 2. Certification bodies expect at least two audits before Stage 2. One last-minute audit raises questions about programme credibility.

The ISO 9001 parallel

If you already hold ISO 9001 or are pursuing both standards together, your internal audit programme structure can be integrated. ISO 9001 Clause 9.2 has an identical structure — same planning requirement, same independence rule, same record-keeping obligation. Run combined audits covering both standards' clauses and Annex A controls in one visit: more efficient and aligns the evidence record. The ISO 9001 Internal Audit Checklist covers the QMS clause sequence if you need to run the standards separately first.

Practical starting point

If you have not run an ISO 27001 internal audit before, start here:

1. Appoint your auditor — confirm independence meets Clause 9.2.2
2. Draft an audit programme for the next 12 months with at least 2 scheduled audit dates
3. Build your checklist from the ISMS clause table above plus your SoA controls list
4. Request documents 1 week before fieldwork; review before the audit day
5. Write findings with clause reference, evidence, root cause, and corrective action
6. Present the report at your next management review — keep the minutes as evidence

A first-rate internal audit programme will not guarantee certification, but a poor one will derail it. The Stage 2 auditor will read your reports.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Here are the 5 most expensive mistakes, with specific clause references and practical fixes.

Mistake 1: A Quality Policy Nobody Uses (Clause 5.2)

Clause 5.2 requires a quality policy that is communicated, understood, and applied within the organisation. Most SMBs fail the "understood and applied" part. The policy gets written, signed by the MD, and filed. Staff can't describe what it says. When auditors ask frontline employees — and they will — blank stares generate a nonconformity.

Fix: Keep it short (one page maximum), write in plain English, and display it where people work. A laminated poster in the workshop or a pinned message in your team chat beats a PDF on a shared drive. Test it: ask three random employees what the policy says. If they can't give you the gist, rewrite or improve communication.

Cost of getting it wrong: Minor nonconformity at Stage 2. Resolution requires evidence of communication — typically 1–2 months of corrective action plus a follow-up verification (an additional half-day at £400–£600).

Mistake 2: Tick-Box Risk Assessment (Clause 6.1)

Clause 6.1 requires you to determine risks and opportunities and show that risk thinking actually influences decisions. The mistake: creating a risk register during implementation, populating it with generic risks, assigning arbitrary scores, then never touching it again. Auditors spot stale registers instantly — the giveaway is a "last reviewed" date from six months ago and no evidence of treatment.

Fix: Keep the register small and real. 10–15 genuine risks beat 50 theoretical ones. Review it at every management review (Clause 9.3 requires this). When a risk materialises — supplier misses a delivery, complaint reveals a process gap — update the register and record what you did.

Cost of getting it wrong: Minor or major nonconformity depending on severity. Major nonconformities at Stage 2 require corrective action within 90 days, and the certificate won't issue until it's resolved.

If you need a starting point, our ISO 9001 readiness quiz flags gaps in your risk approach.

Mistake 3: No Evidence of Management Review Outputs (Clause 9.3)

Clause 9.3.3 lists required outputs: decisions on improvements, QMS changes, and resource needs. Many SMBs hold the meeting and discuss the right topics, but minutes say "discussed customer complaints" without recording what was decided or what actions were assigned. That's a nonconformity.

Fix: Use a template with separate sections for inputs (Clause 9.3.2) and outputs (Clause 9.3.3). For every item, record: what was decided, who owns the action, and the target date. You don't need elaborate minutes — a structured table works.

Cost of getting it wrong: Minor nonconformity at Stage 2. If the auditor finds no management review records at all, it's a major — and that happens more often than you'd expect with newly certified businesses.

Mistake 4: No Competence Records for Existing Staff (Clause 7.2)

Clause 7.2 requires you to determine necessary competence, ensure people are competent, and retain evidence. New hires usually get proper onboarding records. The gap is existing staff — people who've done the job for years with undeniable knowledge but no documented evidence.

Under UK employment law and sector-specific regulations, competence records also serve a legal purpose. The Building Safety Act 2022 introduced explicit competence requirements for construction duty holders. Regulation (EC) No 852/2004 (retained in UK law) requires trained food handlers.

Fix: Create a competence matrix. List each role, required competences, and evidence (qualifications, experience, supervisor sign-off). You don't need to send everyone on courses — you need to document that people can do what they do.

Cost of getting it wrong: Minor nonconformity per role without records. No competence records for any of 20 staff? Expect a major for systemic failure — easily 40–60 hours of corrective work.

Mistake 5: Over-Documenting Everything (Clause 7.5)

ISO 9001:2015 deliberately uses the flexible term "documented information." The standard requires specific items (quality policy, objectives, scope, and roughly 20 others). Beyond those, document only what's needed for consistency. But SMBs create 150-page manuals and procedures for making tea.

Over-documentation causes three audit problems:

1. Inconsistency. More documents means more contradictions. If your procedure says one thing and the operator does something different, that's a nonconformity against your own system.
2. Maintenance burden. 150 documents need version control, review dates, and approval. At 20 documents, your quality manager handles it in hours.
3. Staff disengagement. People buried in forms stop filling them in accurately. Incomplete records suggest a system that exists on paper only.

Fix: A 15-person company can run a compliant QMS with 15–25 documents. Start lean. Add only when you identify a real need.

Use our ISO 9001 cost estimator to plan your total investment, including documentation effort.

ISO 9001 Certification Mistakes: Quick Checklist

Before your Stage 2 audit:

• Quality policy is displayed and staff can describe it
• Risk register reviewed within the last 3 months with evidence of actions taken
• Management review minutes include recorded decisions, owners, and deadlines
• Every staff member has at least one documented competence record
• Documentation set is lean enough that someone can find a specific procedure in 2 minutes
• No procedures contradict what staff actually do
• At least one full internal audit cycle completed against all applicable clauses

These 5 mistakes account for a disproportionate share of Stage 2 nonconformities. Fix them before your auditor arrives.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

The good news: a 12-person software company can achieve certification with the same standard as a multinational bank. The scope, controls, and evidence scale to your size. Here is what ISO 27001 actually requires, what it costs, and 5 steps to get started.

What ISO 27001 requires

ISO 27001:2022 (published October 2022) has two parts:

1. Management system clauses (4-10) — the ISMS framework. Policy, risk assessment, objectives, internal audits, management reviews, corrective actions. If you hold ISO 9001, this structure is familiar — both follow Annex SL.
2. Annex A controls (93 across 4 categories) — specific security measures. Not all 93 apply. You decide which are applicable based on your risk assessment and document decisions in a Statement of Applicability (SoA).

The 4 categories: organisational (A.5), people (A.6), physical (A.7), technological (A.8). The 93-control, 4-category figure is UKAS's, stated of ISO/IEC 27002:2022, with which UKAS says Annex A has been aligned; the category names and the individual control numbers and titles come from ISO/IEC 27002:2022, which is paywalled. The standard does not prescribe specific technologies or products. It requires you to identify risks, choose controls, implement them, and prove they work.

What it costs

Indicative costs for a UK SMB with 10-50 employees:

Total first-year cost: £5,000-£18,000. These follow a similar structure to ISO 9001 certification costs. Pursuing both standards together reduces total fees by 20-30% through integrated audits.

5 steps to get started

Step 1: Define your ISMS scope

ISO 27001 Clause 4.3 requires you to document what the ISMS covers: business units, sites, systems, and information assets. For most SMBs, the scope is the entire business.

Caution: scoping too narrowly ("only our London office") creates problems if client data also lives on laptops, cloud platforms, or a co-located server elsewhere. Auditors probe boundaries.

Step 2: Run a gap analysis

Before spending on consultancy, find out where you stand. Score each Annex A control and ISMS clause on a 0-3 scale. Our ISO 27001 gap analysis template walks through this in detail. Allow 2-3 days. The output is your project plan.

Step 3: Conduct your risk assessment

Clause 6.1.2 requires a formal information security risk assessment. You need:

• A methodology — how you identify, analyse, and evaluate risks. Document it before starting.
• An asset inventory — information, software, hardware, people, services.
• Threat identification — data breach, ransomware, insider threat, hardware failure, supplier compromise.
• Risk evaluation — likelihood x impact on a 3x3 or 5x5 matrix.
• Treatment decisions — mitigate, accept, transfer, or avoid each risk.

The NCSC publishes free risk management guidance at ncsc.gov.uk. Their Board Toolkit is worth reading first.

For a step-by-step method — asset-based versus scenario-based, likelihood and impact scoring, and a worked UK example — see the ISO 27001 risk assessment template guide.

Step 4: Implement controls and document

Based on your risk assessment, implement applicable Annex A controls. Minimum documentation:

• Information security policy (Clause 5.2)
• Risk assessment methodology and results (Clause 6.1.2)
• Statement of Applicability (Clause 6.1.3 d)
• Risk treatment plan
• Security objectives (Clause 6.2)
• Internal audit records (Clause 9.2)
• Management review minutes (Clause 9.3)
• Corrective action records (Clause 10.2)

Keep it proportionate. A 15-person business does not need 200 pages.

If you already have ISO 9001 documentation, you can reuse document control, internal audit, management review, and corrective action procedures — they are structurally identical. A documentation tool that supports multiple standards makes this easier.

Most of this stage is policy writing. ISO 27001 policy templates covers which policies you actually need and how to write them, and ISO 27001 list of controls breaks down what each of the 93 Annex A controls asks for.

Step 5: Internal audit, management review, certification

Before booking your certification audit, complete:

• At least one internal audit of your ISMS (Clause 9.2) — the auditor must be independent of the processes audited
• At least one management review (Clause 9.3) with all required inputs
• Corrective actions from audit findings, with evidence

Then book with a UKAS-accredited certification body (ukas.com). Stage 1 (documentation review, typically 1 day) then Stage 2 (implementation audit, 2-4 days for 10-50 staff).

Plan 3-6 months from gap analysis to Stage 1 readiness.

Internal audit is where most first-time ISMS implementations lose time. See our ISO 27001 internal audit guide for programme planning and checklist structure.

UK-specific considerations

UK GDPR. Your ISMS should address Data Protection Act 2018 / UK GDPR requirements: breach notification to the ICO under Article 33, DPIAs (Article 35), data subject rights. Read Article 33 carefully rather than as a flat 72-hour rule: Article 33(1) requires notification "without undue delay and, where feasible, not later than 72 hours after having become aware of it". But the duty does not bite at all "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons" — so not every breach is notifiable — and where notification is later than 72 hours it "shall be accompanied by reasons for the delay". ICO guidance at ico.org.uk.

Cyber Essentials. If you hold CE or CE Plus (NCSC/IASME), many technological controls are partially covered — firewalls, secure configuration, access control, malware protection, and patch management map to Annex A controls A.8.20, A.8.9, A.8.2-A.8.5, A.8.7, and A.8.8.

Public sector supply chain. The Cabinet Office Security Policy Framework and MOD Def Stan 05-138 reference ISO 27001 as a baseline for suppliers handling official information.

Practical takeaway checklist

1. Start with scope and risk assessment, not Annex A controls
2. Run a gap analysis before committing budget
3. If you hold Cyber Essentials, map existing evidence against Annex A first
4. Budget £5,000-£18,000 for year one
5. Plan 3-6 months preparation plus 2-3 months for the certification process
6. Use the cost estimator to model cost structure
7. If pursuing ISO 9001 too, build an integrated system from the start — the DIY guide covers the approach

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

That is when an ISO 9001 documentation tool earns its cost. Here are 8 criteria that matter when evaluating options — based on what auditors check and what SMBs with 10-250 staff actually need.

1. Clause mapping

The tool should map documents and records directly to ISO 9001 clauses. When an auditor asks for Clause 7.2 evidence, you should retrieve training records and competence assessments in under 60 seconds.

Look for: pre-built mapping to ISO 9001:2015 (and readiness for the 2026 revision), many-to-many linking between documents and clauses, and gap identification flagging clauses with no evidence. A tool without clause mapping is just a document store.

2. Document control with version history

Clause 7.5 requires controlled documented information. An auditor will pick a random procedure and ask for its version history and approval record.

Look for: automatic version numbering, approval workflows with timestamps, document locking during review, access to previous versions, and distribution evidence. If your quality manual was updated but the version history shows no formal approval, that is an audit finding.

3. Audit trail

Every action in the system should leave an immutable trail — edits, approvals, access changes, record entries. This satisfies Clause 7.5.3.

Look for: immutable logs (users cannot delete entries), timestamps on every action, named user identification (not "admin"), exportable logs, and retention aligned with your policy (typically 3-7 years).

4. Corrective action management

Clause 10.2 requires a documented nonconformity and corrective action process. Auditors request the corrective action log within the first hour of most surveillance audits.

Look for: structured workflow (identify, investigate, assign, implement, verify, close), root cause analysis fields, due date tracking with overdue alerts, linkage to audit findings and complaints, and reporting on open/closed/overdue CARs.

A spreadsheet can do this — but it will not send reminders, enforce the workflow, or prevent someone deleting an entry.

5. Internal audit support

Clause 9.2 requires a planned audit programme. The tool should support planning, execution, and follow-up: audit scheduling across processes and clauses, checklist creation, finding recording with severity classification, linkage to corrective actions, and report generation.

If you are building your first audit programme, our ISO 9001 gap analysis checklist covers what auditors look for in each clause.

6. Management review support

Clause 9.3 specifies mandatory inputs (audit results, customer feedback, process performance, CAPA status, resource adequacy) and requires documented outputs (decisions and actions).

Look for: templates with required inputs pre-listed, data pull from other system areas, action tracking, attendance recording, and scheduled reminders. Auditors check management review records at every surveillance audit.

7. Multi-standard support

If you hold or plan to hold ISO 27001 or ISO 14001 alongside ISO 9001, the tool should support an integrated management system. The shared Annex SL structure means many clauses (4-10) are identical across standards.

Look for: multiple standards in a single system, shared document control, separate clause mapping per standard, and combined audit planning. If you are considering ISO 27001, our gap analysis guide covers the 93 Annex A controls and their overlap with ISO 9001.

Even if you only need ISO 9001 today, choose a tool that can grow.

8. Total cost of ownership

Compare 3-year total cost, not monthly price. Include licence fees, setup, training, document migration, renewal pricing (some tools increase significantly after year 1), and exit costs.

For a UK SMB with 5-50 employees, certification itself costs £3,000-£15,000+ in the first year. SMB-targeted tools typically run £50-£150/month for cloud platforms or £200-£500 one-off for template packs. Enterprise platforms run £300+/month. Your tooling should be a fraction of the certification cost, not a rival to it.

What about spreadsheets?

For businesses under 10 staff, a well-organised shared drive can work if you maintain consistent naming and versioning, can retrieve documents quickly for auditors, mark or remove obsolete versions, and follow a review schedule. Buy dedicated software when the alternative costs more in time and audit risk — not because you think you need software to pass.

Practical takeaway checklist

Before choosing an ISO 9001 documentation tool:

1. Score each option against the 8 criteria above (0-2: does not meet / partly / fully meets)
2. Request a trial with your actual documents, not demo data
3. Test the audit trail: make changes, check the log, try to delete entries
4. Ask where data is hosted — UK data residency matters under UK GDPR
5. Check support for the ISO 9001:2026 clause structure
6. Calculate 3-year total cost: subscription + setup + training + migration
7. Ask for UK SMB reference customers of similar size
8. Verify data export — actually export trial data and confirm usability

Use the cost estimator to model total certification costs including tooling. If you are still at the planning stage, take the readiness quiz to identify where your QMS needs the most support.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

The transition deadline is 30 September 2029, and it is now a published requirement. Transition periods were set by the International Accreditation Forum until it ceased operations on 1 January 2026; Global Accreditation Cooperation Incorporated (Global ACI) has assumed that role, and on 16 September 2026 it published Global ACI-TECH-3-TR 2029-09-30 (M), stating that "Organisations already certified to ISO 9001:2015 will have until 30 September 2029 to complete their transition." Every organisation certified to ISO 9001:2015 will need to transition by that date or lose certification. The full UK timeline is in our pillar guide.

This ISO 9001:2026 vs 2015 comparison covers the changes clause by clause. For the interactive version, use the clause comparison tool. For broader strategic context, read our pillar guide on the ISO 9001:2026 revision.

Five overarching changes

Where the change descriptions on this page come from. ISO 9001:2026 published on 16 September 2026, but its text is paywalled and we have not seen it. Except where a specific source is cited and quoted, everything below describing what the 2026 edition changes is drawn from publicly available commentary written before publication, not from ISO's own wording, and is not a citable statement of the standard's requirements.

⚠️ The clause numbers on this page are unverified against the published text. UKAS's technical bulletin states that the majority of changes relate to "clarification of existing requirements, restructuring of clauses, harmonisation with Annex SL and current ISO drafting conventions". Because the clauses have been restructured, we cannot confirm that any requirement below still sits at the number shown. UKAS separately identifies where the substance moved: "The most significant changes relate to interested parties, quality culture and ethical behaviour, risks and opportunities, planning of changes and management review."

Use this page to plan and to ask questions — not as the basis for rewriting your QMS, and not as a source to quote to an auditor. Buy the published standard from BSI and verify the numbering before you act on it.

1. Expanded Annex A. ISO 9001:2015 already carries an informative Annex A ("Clarification of new structure, terminology and concepts", A.1 to A.8), so an explanatory annex is not new. Commentary on the revision describes it as substantially expanded, covering risk-based thinking, documented information, externally provided processes and organisational knowledge. Its length and contents have not been verified against the published text.

2. Climate change in Clause 4.1. In support of the ISO London Declaration on Climate Change, ISO added two climate statements to its management system standards, incorporated into the Harmonized Structure (Appendix 2 of Annex SL) and published as amendments to each standard. The IAF/ISO joint communiqué of 22 February 2024 reproduces the Clause 4.1 addition in full — "Added: The organization shall determine whether climate change is a relevant issue." — and states that "The amendments to the standards will be published on February 23rd 2024." The obligation is to determine; concluding that climate change is not a relevant issue is a legitimate outcome. Our guide to Clause 4.1 and climate change works through how to document that determination. What you need is to be able to demonstrate the determination to an auditor: UKAS's technical bulletin says that where a certified organisation cannot demonstrate that all external and internal issues, "including climate change, have been determined as relevant or not, a suitable finding should be raised."

3. Organisational knowledge (7.1.6) — reported as expanded. Commentary consistently points to this as the most enhanced area: how you identify, capture, share and protect the knowledge your processes need. If accurate, it speaks directly to key-person risk — but the scope of any change has not been verified against the published text.

4. Digitalisation — reported as explicitly acknowledged. Commentary describes the standard as remaining technology-neutral while recognising digital tools, data-driven decisions and cloud-based workflows. Unverified against the published text.

5. Updated Annex SL alignment. The Harmonized Structure shared by all ISO management system standards was amended in February 2024, when the two climate statements above were incorporated into it (per the same IAF/ISO communiqué). ISO 9001, 14001, 45001 and 27001 are built on that shared structure, which is what makes an integrated management system practical.

Clause-by-clause comparison

Reminder — none of the per-clause rows below is a citable statement of what ISO 9001:2026 requires. They report publicly available commentary on the revision. Re-check anything you plan to act on against the published standard.

Clause 4 — Context of the organisation

Transition effort: Low to moderate. Add climate change consideration; review process interaction documentation.

Clause 5 — Leadership

Transition effort: Low. If your MD is already engaged, minimal work needed.

Clause 6 — Planning

Transition effort: Moderate. Risk methodology documentation is the biggest item. Our gap analysis checklist covers what Clause 6.1 evidence auditors expect.

Clause 7 — Support

Transition effort: Moderate to high. If you rely on experienced staff teaching newcomers verbally, you will need to formalise knowledge capture. Document critical processes. Create handover procedures. Identify single points of failure.

Clause 8 — Operation

Transition effort: Low to moderate. If your supplier management already includes ongoing monitoring, you are close.

Clause 9 — Performance evaluation

Transition effort: Low for most well-run systems.

Clause 10 — Improvement

Transition effort: Low.

What to do now

Already certified to 2015:

1. Run a gap analysis using the clause comparison tool and our gap analysis checklist
2. Prioritise the areas commentary flags most consistently: knowledge management (7.1.6), climate consideration (4.1 — already required now), risk methodology (6.1)
3. Book your transition audit early — during the ISO 27001:2022 transition, UKAS-accredited body slots filled 6-12 months ahead
4. Update your quality manual against the published text — the standard is out, so this no longer has to wait
5. Work to the confirmed deadline: 30 September 2029 is the date by which all certificates must reference the 2026 edition
6. If you want the sequence rather than the comparison, the ISO 9001:2026 transition plan sets out the first 90 days

Pursuing first-time certification:

The 2026 edition is published, so certifying directly to it avoids a transition later — check first that your chosen certification body has been granted UKAS transition, because UKAS transition decisions only commence on 1 January 2027. If you need a certificate sooner than that, certify to 2015 — UK certification bodies accept new applications against the 2015 edition until 16 March 2028, so get the application in before then. Use the cost estimator to model either scenario. If also considering ISO 27001, the controls checklist helps you assess the information security side in parallel.

Practical takeaway checklist

1. UKAS describes the revision as introducing "targeted updates rather than fundamental change" — on that basis most of your existing QMS should carry over, though we cannot quantify the proportion from outside the paywalled text
2. UKAS names where the substance moved: "interested parties, quality culture and ethical behaviour, risks and opportunities, planning of changes and management review" — and confirms the clauses have been restructured, so verify numbering against the published standard rather than this page
3. Annex A is reported to be expanded; annexes shape auditor interpretation, so read it in your copy of the published standard
4. Plan your transition audit for 2027–2028 to avoid the rush before the 30 September 2029 deadline
5. Budget for the standard (from BSI), transition training, and documentation restructuring
6. Start your gap analysis now using the clause comparison tool

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide breaks down each phase with honest time estimates and explains what speeds things up or slows them down.

The ISO 9001 Certification Timeline: Phase by Phase

A companion guide covers what happens at each phase in procedural detail; this page is about how long each one takes.

Phase 1: Gap Analysis (2–4 Weeks)

Compare your current processes against ISO 9001 Clauses 4–10 and identify what's missing. A 15-person IT company with existing procedures may finish in 2 weeks. A 40-person manufacturer with no written processes may need 4.

Output: a scored gap analysis report with prioritised actions and assigned owners. We've published a detailed gap analysis checklist for this phase.

Phase 2: Documentation (4–12 Weeks)

This phase has the widest range and causes the most delays. You're writing or updating your quality policy, objectives, procedures, work instructions, risk register, competence matrix, and supplier records.

ISO 9001 mandates documented information for roughly 20–25 specific items, including: quality policy (Clause 5.2), QMS scope (Clause 4.3), quality objectives (Clause 6.2), competence evidence (Clause 7.2), internal audit results (Clause 9.2), management review records (Clause 9.3), and nonconformity records (Clause 10.2).

If your business runs on tribal knowledge, 12 weeks is realistic. If you already have procedures and an employee handbook, 4–6 weeks of reformatting may suffice.

The trap: over-documentation. A 20-person company needs 15–25 controlled documents, not 150. Write what people actually do.

If you need a starting point for your quality policy, our ISO 9001 quality policy generator creates a Clause 5.2-compliant draft based on your sector.

Phase 3: Implementation (4–8 Weeks)

You need to operate the system before your certification audit — following documented procedures, generating records, and proving the QMS works in practice. This includes staff training, running your first management review, and evaluating suppliers against your criteria.

Certification bodies typically want at least 3 months of operational records. Check with your chosen body before assuming a shorter period works.

Phase 4: Internal Audit (1–2 Weeks)

Clause 9.2 requires a full internal audit before certification. Cover every applicable clause. Document findings, raise corrective actions for gaps, and close them before the external audit.

The auditor must be independent of the processes they're auditing. In small companies, cross-audit: the operations manager audits finance, the finance manager audits operations. External consultants typically charge £400–£700 per day.

Phase 5: Stage 1 Audit (1 Day)

Your certification body reviews QMS documentation and confirms you're ready for Stage 2. They check your quality policy, scope, procedures, risk register, internal audit records, and management review minutes. The output is a report with any findings that must be resolved before Stage 2.

Allow 2–4 weeks between Stage 1 and Stage 2 for any corrective work. Budget £800–£1,200 (one audit day at UKAS-accredited rates).

Phase 6: Stage 2 Audit (1.5–3 Days)

The main certification assessment. The auditor interviews staff, reviews records, observes processes, and checks that documentation matches practice. For the 10–50 person business this guide is written for, expect 1.5–3 days on site — this site's own estimate of the Stage 2 share, not a tabled figure.

Audit time itself is tabled for the two stages together. The mandatory accreditation document is Global ACI-TECH-3-004 (M), the reissue of IAF MD 5 that took effect on 28 August 2026 after the International Accreditation Forum ceased operations on 1 January 2026, and its Table QMS 1 gives the combined Stage 1 + Stage 2 starting point:

The document calls this "a starting point for estimating" rather than a fixed figure, and notes that "Normal practice is that time spent for Stage 2 exceeds time spent for Stage 1" — so Stage 2 is the larger share of that total, but the split is your certification body's to set.

No major nonconformities: certificate issued within 2–4 weeks. Major nonconformities: up to 90 days for corrective action, plus a follow-up verification visit. Budget £1,200–£3,600 for Stage 2.

Realistic Total Timeline

For a 20-person UK SMB:

Fast track (existing processes, no issues): 4 months. Worst case (from scratch, audit findings): 9–12 months.

Timing also depends on which edition you certify to. The ISO 9001:2026 vs 2015 clause-by-clause comparison sets out what changes between the two, which matters if your Stage 2 audit lands near the changeover.

What Speeds Things Up

• Existing documented processes. Even informal ones shrink the documentation phase.
• Senior management commitment. An MD who attends reviews, approves documents promptly, and allocates resources removes bottlenecks.
• Booking your certification body early. Popular UKAS-accredited bodies have 4–8 week lead times. Working backwards from a fixed audit date keeps the project on track.
• Prior management system experience. If you already hold ISO 14001, ISO 45001, or ISO 27001, shared clauses (context, leadership, support) transfer directly.

What Slows Things Down

• Over-documentation. 100 procedures when 20 would suffice adds 4–8 weeks.
• Lack of dedicated resource. If the quality manager wears five hats, allocate 2–3 days per week specifically for QMS work.
• Certification body availability. Q4 (October–December) is peak season. Book by July for a November audit. Certification body scheduling is worth checking before you commit, because transition demand has tightened the calendar.
• Major nonconformities. Each one adds 4–12 weeks for corrective action.
• A transition rather than a first certification. If you already hold ISO 9001:2015, the sequence is different — see the ISO 9001:2026 transition plan.

Use our ISO 9001 cost estimator to model the full investment for your situation.

ISO 9001 Certification Timeline Checklist

• Gap analysis completed and gaps prioritised
• Quality policy, scope, and objectives drafted
• All mandatory documented information created
• Staff trained on new/updated procedures
• QMS operational for at least 3 months
• Management review conducted and recorded (Clause 9.3)
• Internal audit completed covering all applicable clauses
• Corrective actions from internal audit closed
• Certification body selected and Stage 1 booked
• Stage 1 completed and findings addressed
• Stage 2 completed — certificate issued or corrective actions in progress

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. Phase durations and budget figures are this site's own estimates; the audit-time table is quoted from Table QMS 1 of Global ACI-TECH-3-004 (M), issue 1.0, and covers Stage 1 and Stage 2 combined. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide gives you a practical template, a scoring matrix, and real example risks for common UK SMB operations.

What Clause 6.1 Requires

Clause 6.1.1 says you must consider the issues from Clause 4.1 (context) and requirements from Clause 4.2 (interested parties), then determine the risks and opportunities that need addressing to ensure your QMS achieves its intended results, prevents undesired effects, and achieves improvement. If you haven't mapped your context yet, start with the gap analysis checklist — Clauses 4.1 and 4.2 feed directly into the risk assessment.

Clause 6.1.2 requires you to plan actions to address those risks, integrate them into your QMS processes, and evaluate their effectiveness.

One Clause 4.1 issue now has to be considered explicitly: whether climate change is a relevant issue. Deciding it is not relevant is a legitimate answer; not deciding is not.

The standard does not prescribe a methodology. ISO 31000 (Risk Management — Guidelines) is referenced as useful, but not required. For most UK SMBs, a likelihood-times-impact matrix is the simplest effective approach.

The Risk Assessment Template

Your risk register should capture these fields for each risk:

The Likelihood x Impact Matrix

Likelihood scale:

• 1 (Rare): Less than once in 5 years
• 2 (Unlikely): Once in 2–5 years
• 3 (Possible): Has occurred before or could within 1–2 years
• 4 (Likely): Expected at least once per year
• 5 (Almost certain): Multiple times per year

Impact scale:

• 1 (Negligible): Minimal effect. Resolved within normal operations
• 2 (Minor): Small quality issue. Customer may not notice
• 3 (Moderate): Noticeable issue, moderate cost (£1,000–£5,000), or 1–2 week delay
• 4 (Major): Significant failure, £5,000–£25,000 cost, or customer relationship at risk
• 5 (Severe): Critical failure, £25,000+ cost, regulatory action, or contract loss

Response thresholds:

• 1–4 (Low): Accept and monitor. Review at each management review.
• 5–9 (Medium): Existing controls may suffice, but evaluate whether improvements are needed.
• 10–15 (High): Define specific additional controls, assign owners, set deadlines.
• 16–25 (Critical): Immediate action. Escalate to top management.

Example Risks for UK SMBs

R-001: Key person dependency A critical process relies on one employee's knowledge. If they leave, the process stalls.

• Likelihood: 3 | Impact: 4 | Score: 12 (High)
• Actions: Document the process. Cross-train a second person. Review single-point-of-failure roles annually.
• Source: Clause 7.2 (Competence)

R-002: Supplier delivery failure A key supplier fails to deliver on time, causing delays to customer commitments.

• Likelihood: 3 | Impact: 3 | Score: 9 (Medium)
• Controls: Approved supplier list with annual review. Alternative suppliers identified for top 5 materials.
• Actions: Add delivery performance to supplier scorecard.
• Source: Clause 8.4 (Externally provided processes)

R-003: Customer requirements not fully captured Incomplete order details lead to incorrect delivery, rework, and complaints.

• Likelihood: 4 | Impact: 3 | Score: 12 (High)
• Actions: Implement contract review checklist. Require customer sign-off on orders above £5,000.
• Source: Clause 8.2 (Requirements for products and services)

R-004: Non-compliance with sector regulations Failure to meet UK regulations — Building Regulations 2010, CDM Regulations 2015, Food Safety Act 1990, or Data Protection Act 2018 — resulting in enforcement action.

• Likelihood: 2 | Impact: 5 | Score: 10 (High)
• Actions: Subscribe to legislation.gov.uk alerts. Assign compliance review to a named role. Include regulatory updates at management review.
• Source: Clause 4.2, Clause 8.2.2

R-005: Loss of ISO 9001 certification Missed surveillance audits or unresolved major nonconformities result in certificate suspension. Loss of eligibility for public sector contracts per Procurement Policy Notes on gov.uk.

• Likelihood: 1 | Impact: 5 | Score: 5 (Medium)
• Controls: Internal audit programme. Surveillance audits booked.
• Actions: Set reminders 3 months before each surveillance audit.
• Source: Clause 9.2 (Internal audit)

R-006: Calibration lapse on measuring equipment Equipment goes out of calibration, producing unreliable results. Products shipped based on invalid measurements.

• Likelihood: 2 | Impact: 4 | Score: 8 (Medium)
• Controls: Calibration schedule maintained. Equipment calibrated to UKAS-traceable standards.
• Actions: Set automated reminders 4 weeks before due dates. Define quarantine process for affected product.
• Source: Clause 7.1.5 (Monitoring and measuring resources)

Don't Forget Opportunities

Clause 6.1 covers both risks and opportunities. Your register should include opportunities:

• Reduce complaint response time from 5 days to 2 days via automated acknowledgement
• Expand into public sector contracts by adding CHAS or Constructionline accreditation
• Reduce waste costs by 10% through process mapping

Score opportunities the same way (likelihood of success x potential benefit) and assign actions where the score justifies the effort.

Keeping Your Risk Register Alive

A risk register created during implementation and never revisited is the most common Clause 6.1 finding. Keep it alive:

1. Review at every management review — Clause 9.3.2(e) requires this as an input.
2. Update when things change — new customers, new suppliers, new regulations, incidents.
3. Close treated risks with evidence of what was done.
4. Add new risks as they emerge. The register should grow and evolve.
5. Check action completion — follow up on assigned deadlines.

If you need a quick check on your overall readiness, including Clause 6.1, our ISO 9001 readiness quiz gives you a score across all major clause areas.

ISO 9001 Risk Assessment Checklist

Before your audit, verify:

• Risk register exists as documented information
• Risks link to context (Clause 4.1) and interested party requirements (Clause 4.2)
• Likelihood and impact are scored using a defined, consistent scale
• Every high or critical risk has assigned actions, owners, and deadlines
• Current controls are documented for each risk
• Opportunities are included alongside risks
• The register has been reviewed within the last 3 months
• Evidence exists that risk actions have been completed (not just planned)
• The risk register is an input to management review (check your minutes)
• New risks have been added since the register was first created

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This is a different kind of article. It covers the specific, measurable benefits UK businesses report — with data where it exists — and it also covers when ISO 9001 is not worth pursuing. Both sides matter for an honest decision.

The Benefits of ISO 9001 Certification for UK Businesses

1. Access to Contracts You're Currently Locked Out Of

This is the benefit that pays the bills. Many UK procurement frameworks and supply chains require ISO 9001 as a qualification criterion. If you don't have it, your tender doesn't get read.

Public sector: Crown Commercial Service (CCS) frameworks frequently list ISO 9001 certification (or equivalent) as a mandatory or scored requirement. If you supply goods or services to central government, the NHS, local authorities, or education bodies through CCS frameworks, you'll encounter this requirement repeatedly. It's not universal across every framework, but it's common enough that lacking certification meaningfully limits your bidding opportunities.

Defence: The Ministry of Defence (MOD) routinely requires ISO 9001 for suppliers, particularly through the Defence Equipment & Support (DE&S) procurement organisation. For many defence contracts, ISO 9001 is a non-negotiable prerequisite — your bid won't be evaluated without it.

Construction: The sector has moved steadily toward requiring ISO 9001 for Tier 1 and Tier 2 subcontractors. Major contractors including the largest firms operating in UK infrastructure use pre-qualification questionnaires (PQQs) that score or mandate ISO 9001. The Construction Industry Training Board (CITB) and Build UK's common assessment standard both reference management system certification.

Private sector supply chains: Large manufacturers, automotive companies (particularly those operating under IATF 16949), and food industry businesses increasingly require ISO 9001 from their suppliers as part of Clause 8.4 supplier evaluation.

The commercial impact is straightforward: if even one contract per year requires ISO 9001, and that contract is worth more than your certification cost, the investment pays for itself. More on the maths below.

2. Measurable Reduction in Defects and Rework

No figure is given here, deliberately: we have not been able to source a published study quantifying how far non-conformances fall after certification, and a percentage attributed to an unnamed study is not evidence. Treat any such figure you see — including ones attributed to certification bodies — as unsourced unless the study itself is named. What the mechanism predicts is directional rather than numerical: a documented system that is audited on a cycle surfaces problems earlier than one that is not, and that is the claim this section rests on.

Why does this happen? ISO 9001's Clause 8.5 (Production and service provision) requires controlled conditions. Clause 8.6 requires verification before release. Clause 10.2 requires root cause analysis when things go wrong. These aren't bureaucratic exercises — they force you to answer the question: "Why did this defect happen, and what will prevent it happening again?"

To show the arithmetic rather than to predict a result: a manufacturing SMB with £2 million annual turnover and a 4% defect/rework rate that cut non-conformances by 15% would save roughly £12,000 a year. That 15% is an illustrative input chosen to make the sum concrete — it is not a figure this site is claiming, for the reason given above. For a service business, the equivalent is reducing customer complaints, missed deadlines, and the staff time spent firefighting.

The key word is "measurable." Before ISO 9001, most SMBs don't systematically track non-conformances. After implementation, they do. The act of measuring itself drives improvement — you can't fix what you don't know about.

3. Systematic Complaint Handling and Customer Retention

Clause 10.2 requires a defined process for handling nonconformities, including customer complaints. Clause 9.1.2 requires you to monitor customer satisfaction. Together, these clauses force something many SMBs lack: a system that ensures every complaint gets logged, investigated, resolved, and tracked for patterns.

Without a system, complaints depend on individual memory and motivation. Some get handled well. Others get forgotten, or the underlying cause recurs because nobody identified it. With ISO 9001's framework, complaints become data — and data reveals patterns.

A construction services company processing 150 customer interactions per month might find that 30% of complaints trace back to the same handover process. Fix that process once, and you've reduced complaint volume by nearly a third.

Customer retention is difficult to attribute to any single factor, but there's a clear mechanism: customers who see their complaints handled systematically, with evidence of corrective action and follow-up, are less likely to leave. They don't need perfection — they need confidence that problems get fixed.

4. Operational Clarity Through Process Mapping

Clause 4.4 requires you to determine the processes needed for the QMS and their interactions. In practical terms, this means mapping how work flows through your business: who does what, in what sequence, with what inputs and outputs.

For many SMBs, this is the first time anyone has documented how the business actually operates (as opposed to how the founder thinks it operates). The process of mapping reveals:

• Gaps: Steps that happen but nobody owns
• Redundancy: Two people doing the same check because neither knows the other does it
• Bottlenecks: Approval steps that add days without adding value
• Single points of failure: Critical knowledge that exists only in one person's head

These discoveries are genuinely valuable — and they happen during implementation, before you even reach certification. This site's own view is that the implementation work usually delivers more value than the certificate itself.

If you're curious about what implementation involves, our small business guide to ISO 9001 walks through the full process for companies with 5–100 employees.

5. Insurance Premium Reductions

Some UK insurers offer reduced professional indemnity and public liability premiums for ISO 9001 certified businesses. The logic: a certified quality management system reduces the likelihood of claims arising from defective products, service failures, or contractual non-performance.

The reductions aren't dramatic — typically 5–15% on relevant policies — and not all insurers offer them. But for a business paying £10,000–£20,000 annually in professional indemnity cover, a 10% reduction saves £1,000–£2,000 per year. Over a three-year certification cycle, that's £3,000–£6,000 — a meaningful contribution toward certification costs.

Ask your broker specifically whether your insurer recognises ISO 9001 certification. It's worth a conversation even if it's not advertised.

6. A Framework That Survives Staff Turnover

This benefit rarely appears in listicles, but it matters enormously for SMBs. When a key employee leaves an uncertified business, their knowledge walks out with them. Processes that lived in their head stop working. New hires take months to reach competence because there's nothing written down.

ISO 9001's documentation requirements — particularly around competence (Clause 7.2), documented procedures (Clause 7.5), and operational planning (Clause 8.1) — create a baseline that survives personnel changes. The new operations manager doesn't start from scratch because the processes, records, and training requirements are documented.

This isn't about creating a 200-page manual nobody reads. It's about having enough documented information that your business can absorb change without losing capability. We cover the balance between documentation and over-documentation in our DIY certification guide.

The ROI Calculation: Does ISO 9001 Pay for Itself?

Here's a worked example for a UK SMB with 20 employees:

Costs (Year 1):

For a detailed estimate tailored to your size and sector, use our ISO 9001 cost estimator. The full cost breakdown explains each category.

Benefits (Annual):

Even if you strip out the contract revenue and count only the operational savings, you're looking at £12,500 per year against an £11,000 first-year cost. That's payback in under 12 months.

If even one contract worth £50,000 requires ISO 9001, the payback period is roughly 3 months. That single contract covers the certification cost four times over.

Ongoing costs reduce the margin slightly: surveillance audits (£1,200–£2,500/year), management time maintaining the system (2–4 hours/month), and recertification every three years. Budget £2,000–£4,000 annually after Year 1. The net benefit still holds comfortably for most businesses.

When ISO 9001 Is Not Worth It

Here's the part most articles skip. ISO 9001 certification is not universally beneficial. There are situations where pursuing it costs more than it returns.

No Customer or Contract Requires It

If none of your customers ask for ISO 9001, no tenders you bid on score or mandate it, and your industry doesn't treat it as a baseline expectation, the commercial case weakens significantly. The operational benefits (process clarity, defect reduction, complaint handling) are real — but they're achievable without paying for certification. You can implement ISO 9001 principles without the certificate.

Before deciding, check with your top 10 customers and review the last 20 tenders you bid on (or wanted to bid on). If ISO 9001 never appears, the urgency drops.

Your Business Has Fewer Than 5 Employees

ISO 9001 scales with business size, but below roughly 5 employees, the overhead of maintaining a formal QMS starts to outweigh the benefits. Internal auditing requires people who aren't auditing their own work — in a 3-person team, that's difficult to arrange meaningfully. Management review, document control, and corrective action tracking all take time that represents a larger percentage of total available hours in a very small team.

This doesn't mean micro-businesses can't benefit from quality management thinking. It means the formal certification route — with its audit fees, surveillance visits, and documentation requirements — may not be the right vehicle.

You Want the Certificate, Not the System

If the goal is a certificate on the wall and the minimum documentation to pass an audit, ISO 9001 will deliver poor value. A paper-based QMS — documents that exist but aren't followed — generates maximum cost (implementation, audits, maintenance) with minimum benefit (no real process improvement, no defect reduction, no cultural change).

The businesses that extract genuine value from ISO 9001 are the ones that use the framework to actually improve how they operate. If leadership sees certification as an administrative burden to be delegated and forgotten, the ROI will be negative.

You're in Crisis Mode

Implementing a management system while the business is firefighting daily emergencies is counterproductive. ISO 9001 implementation requires focused attention over 3–6 months. If the business is losing key staff, dealing with financial distress, or undergoing major restructuring, the implementation will stall, and the half-finished QMS will become another source of frustration.

Get stable first. Implement when you have the bandwidth to do it properly.

How ISO 9001 Compares to Other Standards

If you're evaluating ISO 9001 alongside other certifications, it helps to understand the scope differences. ISO 9001 focuses on quality management — delivering products and services that consistently meet customer requirements. ISO 27001, by contrast, focuses on information security management.

Some businesses need both, particularly those in technology and professional services where customer data and service quality are equally critical. Our ISO 9001 vs ISO 27001 comparison explains the differences and when you need each.

For businesses exploring both standards, implementation can be combined — an integrated management system shares common elements (context, leadership, planning, support, performance evaluation, improvement) and reduces duplication. Certification body fees for integrated audits are typically 20–30% lower than separate audits.

Should You Pursue ISO 9001? A Decision Checklist

Work through these questions honestly. If you answer "yes" to three or more in the first group, the case for certification is strong.

Signals that ISO 9001 will pay for itself:

• At least one current or target customer requires or scores ISO 9001
• You bid on public sector tenders (central government, NHS, local authority, defence)
• You operate in construction, manufacturing, or another sector where certification is becoming standard
• You experience recurring quality issues (defects, complaints, rework) that cost real money
• Key processes depend on specific individuals with no documented backup
• You're growing and need systems that scale beyond the founder's direct oversight
• Your insurer has indicated potential premium reductions for certified businesses

Signals that now isn't the right time:

• No customers or contracts currently require it
• The business has fewer than 5 employees
• Leadership views it as a paperwork exercise rather than an operational improvement
• The business is in the middle of a major crisis or restructure
• There's no one available to own the implementation (even part-time) for 3–6 months

If the first group outweighs the second, take the next step: run the ISO 9001 readiness quiz to understand your starting position, then review the full cost breakdown to budget realistically.

Key Takeaways

1. The strongest benefit of ISO 9001 certification for UK businesses is contract access — public sector frameworks, MOD procurement, and construction supply chains increasingly require it.
2. Operational benefits are real but take time — problems surface earlier, complaint handling becomes structured, and process ownership gets clearer. This guide deliberately puts no percentage on the reduction in non-conformances: we have not been able to source a published study measuring it.
3. For a typical 20-person SMB, first-year costs of roughly £10,000 can pay back in under 3 months if certification unlocks even one significant contract.
4. ISO 9001 is not worth pursuing if no customers require it, the business is very small (under 5 employees), or leadership isn't genuinely committed to using the system.
5. Start with a readiness assessment and an honest look at whether your customers and market actually value certification — that answer drives everything else.
6. If the answer is yes, how to actually get certified is the next step — the process, the timings, and where the effort goes.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide covers what Clause 5.2 requires, gives you a structure template, and includes 3 worked examples for UK sectors. If you haven't mapped your QMS yet, start with the gap analysis checklist — your quality policy should reflect the scope and context you identify there.

What Clause 5.2 Actually Requires

Clause 5.2.1 — Establishing the quality policy. Top management must establish a policy that is appropriate to the organisation's purpose and context, provides a framework for quality objectives, commits to satisfying applicable requirements, and commits to continual improvement.

Clause 5.2.2 — Communicating the quality policy. The policy must be available as documented information, communicated and understood within the organisation, and available to relevant interested parties.

The standard doesn't specify format, length, or style. It does require the policy to be real — not a generic statement copied from the internet.

The Structure Template

1. Opening statement (1–2 sentences). What your organisation does and for whom. Anchors the policy to your context.

2. Commitments (3–5 bullet points). Specific and measurable. Must include: meeting customer requirements, meeting statutory/regulatory requirements, and continual improvement. Add 1–2 commitments specific to your business.

3. Framework for objectives (1–2 sentences). How the policy connects to quality objectives.

4. Signature and date. Signed by the most senior person. Demonstrates top management commitment (Clause 5.1). The quality policy sits at the top of your documentation — it's the first section in your quality manual.

Total length: one page. Half a page is better.

Example 1: Manufacturing (Precision Engineering)

Quality Policy — Apex Precision Engineering Ltd

Apex Precision Engineering manufactures CNC-machined components for the UK aerospace and automotive sectors from our facility in Wolverhampton.

We are committed to:

• Meeting customer specifications and delivery schedules, targeting on-time delivery above 97%
• Complying with AS9100 flow-down requirements, UK REACH (retained from EU Regulation (EC) No 1907/2006), and the Supply of Machinery (Safety) Regulations 2008
• Maintaining measurement traceability to UKAS-calibrated standards for all critical dimensions
• Reducing internal scrap rates year on year, with a current target below 1.5%
• Continually improving through regular objective review, nonconformity analysis, and staff development

This policy provides the framework for our quality objectives, set annually and reviewed quarterly.

Why it works: Names the sector, references specific regulations, includes measurable targets (97% delivery, 1.5% scrap), and mentions UKAS calibration.

Example 2: IT Services (Managed Services Provider)

Quality Policy — Clearpath IT Solutions Ltd

Clearpath IT Solutions provides managed IT services, cloud infrastructure, and support to SMBs across the South East of England.

We are committed to:

• Resolving Priority 1 tickets within 4 hours and Priority 2 within 8 hours per our SLAs
• Meeting the Data Protection Act 2018 (UK GDPR), the Computer Misuse Act 1990, and contractual obligations
• Maintaining Microsoft Partner and AWS Partner certifications
• Targeting customer NPS above 50, measured quarterly
• Continually improving by analysing incident data and implementing permanent fixes through problem management

This policy forms the basis for objectives reviewed monthly and assessed at quarterly management reviews.

Why it works: References specific SLA targets, names legislation, includes a measurable metric (NPS above 50), and ties improvement to a concrete process.

Example 3: Construction (Fit-Out Contractor)

Quality Policy — Sterling Interiors Ltd

Sterling Interiors delivers commercial fit-out and refurbishment for office, retail, and hospitality clients across London and the Home Counties.

We are committed to:

• Completing projects to agreed specification, programme, and budget, targeting zero defects at handover
• Complying with Building Regulations 2010, CDM Regulations 2015, the Building Safety Act 2022, and BS 8000 workmanship standards
• Ensuring all operatives hold valid CSCS cards and subcontractors meet our approved supplier criteria
• Reducing defect rates by analysing post-completion data and feeding findings into pre-start planning
• Continually improving through project reviews, client feedback, and internal audit findings

This policy provides the framework for objectives set at the start of each financial year and tracked monthly.

Why it works: References construction legislation, industry standards (BS 8000, CSCS), and uses sector-specific language (snagging, handover, pre-start planning).

Common Quality Policy Mistakes

Copying someone else's. If your policy could belong to any company in any sector, it doesn't meet "appropriate to the purpose and context." Include at least one sector-specific regulation and one measurable target unique to your business.

Making it too long. Two pages means you're confusing the policy with a quality manual. Keep it to one page.

Commitments you can't evidence. If the policy says "zero defects" and your defect rate is 3%, you've created a nonconformity against your own system. Set targets that are ambitious but supported by data.

Forgetting communication. Writing it is half the job. Clause 5.2.2 requires communication and understanding. Display it, discuss at team meetings, reference at inductions. When the auditor asks a warehouse operative, you need a credible answer.

Not reviewing it. Review at least annually, ideally at management review (Clause 9.3). If your business changes direction, the policy should reflect it. A policy dated three years ago with no review record is a red flag.

ISO 9001 Quality Policy Checklist

• Appropriate to your organisation — names sector, products/services, and market
• Commits to satisfying applicable requirements (specific regulations listed)
• Commits to continual improvement
• Provides a framework for quality objectives
• Contains at least one measurable, business-specific commitment
• Signed and dated by top management
• Reviewed within the last 12 months
• Displayed or accessible where staff can see it
• Discussed at new starter inductions
• At least 3 employees can describe its content

If you're not sure where your QMS stands overall, the ISO 9001 readiness quiz covers Clause 5.2 alongside every other major requirement in under 5 minutes. For a broader look at what certification involves, see our small business guide to ISO 9001.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

ISO 27001:2022 contains 93 controls in Annex A plus management system requirements in Clauses 4-10. Your ISO 27001 gap analysis template needs to cover both. Here is how to do it without turning it into a three-month project.

What you are assessing

Two distinct things:

1. Management system clauses (4-10) — the ISMS framework. Policy, risk assessment, management review, internal audit.
2. Annex A controls (93 controls) — specific security measures. Access control, encryption, incident management, supplier oversight.

Common mistake: spending all your time on Annex A and treating the management system as an afterthought. Both are audited equally. On this site's own reading, Clause 6 (risk assessment methodology) is as common a source of SMB findings as the technical controls; we have not found published certification-body data on the split, so treat that as our judgement rather than a measured statistic.

The 93 Annex A controls

ISO 27001:2022 reorganised the Annex A controls into 4 categories. The 2013 version used a different structure with different control numbers:

UKAS records 11 new controls in ISO/IEC 27002:2022, with which Annex A is aligned, but does not name them. The commonly-cited examples — threat intelligence (5.7), cloud services security (5.23), ICT readiness for business continuity (5.30), data masking (8.11), data leakage prevention (8.12) — come from ISO/IEC 27002:2022 itself, which is paywalled, so treat that list as indicative and check it against a purchased copy.

The 93-control, 4-theme and 11-new figures are UKAS's, and UKAS states them of ISO/IEC 27002:2022: its ISO/IEC 27001:2022 transition bulletin says Annex A "has been aligned with the controls defined in ISO/IEC 27002:2022, which contains 93 controls (11 of which are new) organised in 4 themes". The theme names and the individual control numbers and titles are not UKAS's — those come from ISO/IEC 27002:2022, which is paywalled. Per-category control counts are not stated here.

For a plain-English breakdown of what each of the 93 controls actually asks for, see ISO 27001 list of controls.

Step-by-step gap analysis process

Step 1: Define your ISMS scope (Clause 4.3)

Define which business units, sites, systems, and information assets are covered. For most SMBs under 50 staff, the scope is the entire business. Write one paragraph. Your auditor reviews this first.

Step 2: Assess ISMS management clauses (4-10)

Rate your position on each clause:

• Clause 4: Have you identified external issues (UK GDPR, cyber threat landscape) and internal issues (IT infrastructure, remote working)?
• Clause 5: Information security policy signed by the MD? Roles assigned?
• Clause 6: Defined risk assessment methodology? "We deal with risks as they come up" is not a methodology.
• Clause 7: Resources allocated? Staff awareness programme? Competence records?
• Clause 8: Risk treatment plans implemented? Evidence?
• Clause 9: Internal audits conducted? Management reviews covering information security?
• Clause 10: Nonconformity and corrective action process in place?

Step 3: Assess each Annex A control

For each of the 93 controls, record:

1. Applicability — does it apply? If not, justify the exclusion in your Statement of Applicability (Clause 6.1.3 d)
2. Current state — what exists today? Be factual, not aspirational
3. Compliance level — 0 (not implemented) / 1 (partial) / 2 (largely implemented) / 3 (fully effective)
4. Gap description — what work is needed?
5. Priority — High / Medium / Low based on risk and effort

Step 4: Prioritise gaps

Rank by risk impact and implementation effort. A missing access control policy (A.5.15) for a business handling sensitive client data is higher priority than a clear desk policy (A.7.7) in a paperless office.

Address dependencies first. You cannot classify assets (A.5.12) without an asset inventory (A.5.9). You cannot define access rights (A.5.15) without knowing your systems.

Step 5: Build your risk treatment plan

ISO 27001 Clause 6.1.3 requires this. For each gap, define: specific action, responsible person (name, not role), target date, resources needed, and evidence of completion. Update monthly.

The risk treatment plan is only as good as the risk assessment behind it. A step-by-step method with a worked UK example is in the ISO 27001 risk assessment template guide.

Common mistakes

Ignoring cloud and supplier controls. Controls A.5.19-A.5.23 cover suppliers and cloud services. If you run on Microsoft 365, Xero, and AWS, these apply directly. Your provider handles infrastructure security; you own access management, configuration, and data classification.

Treating the SoA as a formality. The Statement of Applicability is one of the most scrutinised audit documents. Draft it during the gap analysis, not the week before your audit.

Assessing controls in isolation. Access control (A.8.3-A.8.5) depends on identity management, which depends on HR onboarding/offboarding (A.6.1-A.6.5). Gaps cascade.

UK-specific considerations

UK GDPR alignment. The Data Protection Act 2018 and UK GDPR overlap with several Annex A controls — breach notification to the ICO under Article 33 ("without undue delay and, where feasible, not later than 72 hours", and only where the breach is not "unlikely to result in a risk to the rights and freedoms of natural persons"), DPIAs (Article 35), data subject rights. The ICO provides guidance at ico.org.uk.

Cyber Essentials. If you hold CE or CE Plus (NCSC/IASME scheme), you have a head start. Its five control areas (firewalls, secure configuration, access control, malware protection, patch management) map to several Annex A technological controls.

NCSC guidance. Free practical guidance at ncsc.gov.uk — 10 Steps to Cyber Security, cloud security principles, supply chain guidance.

Public sector supply chain. UK government departments increasingly require ISO 27001 from suppliers handling official information. The Cabinet Office Security Policy Framework references it as a baseline.

Practical takeaway checklist

1. Allow 2-3 days for a thorough gap analysis
2. Start with ISMS Clauses 4-10 before Annex A — management system gaps often take longer to close
3. Use the 0-3 scale — enough granularity without overcomplication
4. Build in a spreadsheet: control ref | applicability | current state | level | gap | priority | action | owner | deadline
5. Draft your Statement of Applicability during the gap analysis
6. Focus first 90 days on high-risk gaps and dependencies
7. Review findings with management before committing budget

If you have completed your ISO 9001 gap analysis, the management system clauses overlap significantly. Our ISO 9001 gap analysis checklist uses a similar framework. For certification cost estimates, try the cost estimator.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Here's what Clause 9.3 demands, a ready-to-use agenda template, and guidance on frequency.

What Clause 9.3 Requires

Three sub-clauses:

• 9.3.1 — General: Top management must review the QMS at planned intervals for continuing suitability, adequacy, effectiveness, and alignment with strategic direction.
• 9.3.2 — Inputs: Specific items that must be considered.
• 9.3.3 — Outputs: Specific decisions and actions that must result.

"Top management" means the most senior person — MD, CEO, owner. Delegating entirely to a quality manager doesn't satisfy the requirement.

Required Inputs (Clause 9.3.2)

Your review must address each of these:

a) Status of actions from previous reviews. What was decided last time? What's done? What's outstanding?

b) Changes in external/internal context. Link to Clause 4.1. New regulations (e.g., the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, made under the Product Security and Telecommunications Infrastructure Act 2022 and in force since 29 April 2024), market shifts, staffing changes. If you haven't mapped your context yet, the gap analysis checklist walks through Clauses 4.1 and 4.2 systematically. Carry climate change relevance as a standing item here — auditors now expect the determination to be revisited, not made once.

c) QMS performance data: customer satisfaction (complaints, survey results, NPS), quality objectives progress, process KPIs (reject rates, on-time delivery), nonconformities and corrective actions, monitoring results, audit findings (internal and external), and supplier performance.

d) Resource adequacy. People, equipment, infrastructure — enough to deliver?

e) Risk and opportunity actions. Review your risk register. Did planned actions reduce risks? New risks emerged?

f) Improvement opportunities. Not just fixing problems — what could be done better?

Nonconformities and corrective actions are a required input, and they are easiest to present when every one has a numbered record behind it — see the ISO 9001 non conformance report template.

Required Outputs (Clause 9.3.3)

This is where most SMBs fall short. Outputs must include decisions and actions on: opportunities for improvement, any changes to the QMS, and resource needs.

Every output must be a decision or action. "Discussed customer complaints" is not an output. "Operations director to implement new complaint triage process by 30 June, £2,000 budget for CRM module" is.

You must retain documented information as evidence. Meeting minutes, an action log, or a completed template — format doesn't matter, content does.

ISO 9001 Management Review Agenda Template

For each item, record: what was discussed, what was decided, who owns the action, and the target date.

How Often Should You Hold Management Reviews?

The standard says "planned intervals" without specifying frequency.

Minimum: annually. Acceptable for small businesses. Most certification bodies accept it.

Recommended: every 6 months. Enough time to accumulate meaningful data while keeping the QMS responsive. For 10–50 employees, this is the sweet spot.

For fast-moving businesses: quarterly. Keep reviews shorter (60–90 minutes) since you're covering a smaller window.

What doesn't work: Reviewing only when the auditor is coming. Certification bodies check dates. If you only hold reviews in the month before surveillance audits, the pattern is obvious.

The frequency you commit to must be documented in your QMS. Stick to it — missing a committed review is a potential nonconformity.

Review cadence works best when it is tied to the audit programme, so each review has a fresh block of audit results to discuss. The ISO 9001 audit schedule template shows how to phase audits across the year around your review dates.

Common Mistakes

No actions recorded. Good meeting, everyone leaves, minutes say "all items reviewed, no issues." Always record 3–5 specific actions per review.

Quality manager runs it alone. If the MD doesn't attend and isn't named in the minutes, the "top management" requirement isn't met.

Missing inputs. Auditors check every 9.3.2 sub-clause against your records. Missing supplier data or a forgotten risk register review creates gaps.

No link to previous review. Each review should start with a status update on previous actions. Without this, reviews are isolated events, not a continuous cycle.

No data. "Quality is good" isn't evidence. "Customer complaints dropped from 12 in Q1 to 7 in Q2 — a 42% reduction" is evidence. Bring numbers.

If you're not sure your processes are ready for a management review, our ISO 9001 readiness quiz covers Clause 9.3 requirements in under 5 minutes.

Management Review Checklist

Before each review, confirm:

• Top management (MD/CEO) is attending and will be named in minutes
• Data packs prepared for all Clause 9.3.2 inputs
• Previous actions tracked with known status
• Customer satisfaction data covers the period since last review
• Quality objectives progress is quantified
• Internal audit results summarised, including open findings
• Risk register updated and ready for review
• Action log template ready to capture outputs
• Minutes will record specific decisions, owners, and deadlines

Your management review is where the QMS comes together as a system, not a collection of documents. The data should flow from your quality manual processes, your internal audit results, and your risk register — each feeding decisions that drive improvement.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This ISO 9001 internal audit checklist covers 15 questions that UKAS-accredited auditors routinely ask, mapped to specific clauses, with the evidence you need and common reasons businesses fail.

Context and leadership (Clauses 4-5)

1. How have you determined external and internal issues relevant to your QMS? (Clause 4.1) Evidence: A documented SWOT, PESTLE, or simple issues table, reviewed annually. Common fail: no documented analysis at all.

2. Who are your interested parties and what are their requirements? (Clause 4.2) Evidence: A list of interested parties with specific requirements. Common fail: listing parties without their requirements — "clients" is not enough; "clients requiring SSIP accreditation and 48-hour quote turnaround" is.

3. Show me your quality policy and explain how it connects to your work. (Clause 5.2) Evidence: A signed quality policy. Employees who can describe what it means for their daily work. Common fail: a policy so generic it could belong to any business. Auditors may interview a site worker, not just the quality manager. See our guide on how to write an ISO 9001 quality policy if yours needs strengthening.

4. How does top management demonstrate active involvement in the QMS? (Clause 5.1) Evidence: Management review attendance records, resource allocation decisions linked to quality objectives. Common fail: a signed management review the MD clearly did not attend. Auditors probe this directly.

Planning and support (Clauses 6-7)

5. What risks and opportunities have you identified, and what have you done about them? (Clause 6.1) Evidence: A risk register with likelihood x impact evaluation and treatment actions. Common fail: a risk register created for the audit and never updated — auditors check dates.

6. What are your quality objectives and how do you track them? (Clause 6.2) Evidence: Measurable objectives with targets, measurement methods, owners, and deadlines. Plus tracking data. Common fail: vague objectives like "improve quality." "Reduce complaint rate from 4.1% to 2.5% by Q4 2026" passes; "improve customer satisfaction" does not.

7. How do you ensure people doing QMS work are competent? (Clause 7.2) Evidence: Training records, qualifications, skills assessments showing competence — not just attendance. Common fail: course certificates without evidence that training achieved its objective. For regulated sectors, this overlaps with legal requirements (CSCS cards, Gas Safe registration).

8. How do you control documented information? (Clause 7.5) Evidence: A document control procedure and the ability to retrieve any document at the current version. Common fail: obsolete documents in circulation. The auditor will pick a random procedure and check. Your quality manual should describe this approach.

Operations (Clause 8)

9. Walk me through how you plan and control your operational processes. (Clause 8.1) Evidence: Process documentation with inputs, outputs, controls, and criteria. Common fail: documented processes that do not match reality. Auditors observe work — if your procedure says orders are confirmed in writing but the workshop starts jobs on verbal instructions, that is a nonconformity.

10. How do you deal with nonconforming outputs? (Clause 8.7) Evidence: A log of nonconforming outputs with disposition (rework, scrap, concession). Common fail: an empty log. Every business produces nonconforming work. An empty log tells the auditor you are not recording it.

11. How do you evaluate and monitor suppliers? (Clause 8.4) Evidence: An approved supplier list with evaluation criteria and ongoing monitoring records. Common fail: a list created at certification and never reviewed. Clause 8.4 requires ongoing evaluation.

Performance evaluation (Clause 9)

12. How do you monitor customer satisfaction? (Clause 9.1.2) Evidence: A defined method — surveys, complaint tracking, repeat business rates, NPS — with analysis of results. Common fail: "We would know if customers were unhappy." That is not a monitoring method.

13. Show me your internal audit programme and results. (Clause 9.2) Evidence: An audit schedule covering all processes, reports with classified findings, corrective actions with closure evidence. Common fail: audits without independence. Clause 9.2.2 requires impartiality — swap auditors between departments. If you have not built your programme yet, our gap analysis checklist covers each clause requirement.

14. Show me management review inputs and outputs. (Clause 9.3) Evidence: Minutes covering all required inputs per Clause 9.3.2 (audit results, customer feedback, process performance, corrective action status, resource adequacy, improvement opportunities) and outputs per Clause 9.3.3 (decisions, resource needs, QMS changes). Common fail: missing mandatory inputs. Auditors cross-reference the standard's list against your minutes.

Audit frequency and coverage come from your audit programme, not from ad-hoc scheduling — see our ISO 9001 audit schedule template for how to plan a year of internal audits that satisfies Clause 9.2.

Improvement (Clause 10)

15. Pick a recent nonconformity and walk me through what you did. (Clause 10.2) Evidence: A corrective action record showing the nonconformity, containment action, root cause analysis, corrective action, and effectiveness verification. Common fail: fixing the symptom without analysing the root cause. "We re-did the work" is containment, not corrective action. The auditor wants to see a systemic change and evidence it worked.

Where an audit finds a nonconformity, raise a formal non conformance report rather than a note in the audit report — the certification body will look for the record and its closure evidence.

Practical takeaway checklist

Before your next audit:

1. Answer all 15 questions above and confirm you have evidence for each
2. Verify your quality manual matches current practice
3. Confirm documented procedures are at the current version
4. Check quality objectives have measurement data from the last quarter
5. Confirm management review was held within the last 12 months with all required inputs
6. Review corrective action records for root cause analysis and effectiveness verification
7. Walk through one recent customer complaint from receipt to closure
8. Brief staff that auditors may interview anyone

Getting ready for your certification audit? The ISO 9001 Audit Readiness Checker verifies your Stage 1 documents and Stage 2 evidence are complete, and the free ISO 9001 Audit Schedule Template (XLSX) gives you a programme document to plan the full year.

For a quick assessment, try the ISO 9001 readiness quiz. If you are preparing for the ISO 9001:2026 transition, audit against the new clause structure early to identify gaps before your next certification audit.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide covers what Clause 7.5 requires, what "documented information" means, and the 4 pitfalls that generate the most nonconformities.

What "Documented Information" Means

ISO 9001:2015 replaced "documents" and "records" with one term: documented information. The distinction still matters:

• Maintained = documents (procedures, policies, work instructions). Living documents that get updated.
• Retained = records (completed forms, inspection results, training records). Evidence that something happened. Once created, they don't change.

The standard mandates documented information for specific items: QMS scope (Clause 4.3), quality policy (Clause 5.2), quality objectives (Clause 6.2), competence evidence (Clause 7.2), monitoring results (Clause 9.1.1), internal audit records (Clause 9.2), management review results (Clause 9.3), and nonconformity records (Clause 10.2). Beyond these, you document whatever your business needs to operate consistently. Your quality manual ties this all together — it's the top-level document that references every procedure and work instruction below it.

What Clause 7.5 Requires

7.5.2 — Creating and updating. Ensure appropriate identification (title, date, reference number), format, and review/approval for suitability.

7.5.3 — Control. Documented information must be available where needed, protected against loss or improper use, and controlled for distribution, access, version changes, retention, and disposition.

In practice, every QMS document needs: a unique identifier, version number and date, author and approver, defined distribution, and (for records) a retention period.

Document Control in Practice

You don't need specialist software. A shared drive (SharePoint, Google Drive, or a local server) plus a master document list works for most SMBs with 10–50 employees.

The master document list is your single source of truth — a register listing every controlled document with its ID, title, version, date, author, approver, location, and next review date. When an auditor asks "how do you know this is current?", you point here.

Version control: Use whole numbers for approved versions (1.0, 2.0, 3.0) and decimals for drafts. When a document changes: update content, increment the version, record what changed, get approval, update the master list, and replace the old version. Old versions go into a "superseded" folder or get deleted — the point is nobody accidentally uses them.

Distribution: For most SMBs, this means read-only access on a shared drive. If you use printed copies — common in workshops and on construction sites — maintain a controlled copy list recording which copies exist, where, and who swaps them when updates are issued.

The 4 Biggest ISO 9001 Document Control Pitfalls

Pitfall 1: Obsolete Documents Still in Circulation

This is the number-one finding at Stage 2 audits. A work instruction was updated, but the old version is still pinned to the workshop wall or saved in a forgotten subfolder.

Example: A fabrication company updated its welding procedure to require pre-heat treatment after a customer complaint about weld cracking. Version 4 was saved on the server — but version 3 (without the pre-heat requirement) was still in the workshop folder welders actually used. The auditor found the discrepancy and raised a major nonconformity. Corrective action took 3 weeks, including re-inspection of all welds completed since the change.

Fix: When you issue a new version, physically remove every instance of the old one. Check printed copies, desktop shortcuts, email attachments, and shared drive subfolders.

Pitfall 2: No Review Schedule

Clause 7.5 doesn't specify review frequency, but "never" isn't acceptable. A quality policy dated 2019 with no review record is a red flag.

Fix: Set an annual review cycle. Mark review dates on the master list. At each review, the document owner confirms accuracy and either updates or records "reviewed, no changes required" with a new date.

Pitfall 3: Records Without Retention Periods

How long do you keep training records? Inspection reports? Calibration certificates? Some periods are legally defined: HMRC requires financial records for at least 6 years. The Limitation Act 1980 suggests 6 years for contractual records (12 for deeds). UK GDPR requires that personal data isn't kept longer than necessary.

Fix: Add a retention period to your master list or create a separate schedule. For each record type, state how long it's kept and what happens at expiry (archived, deleted, destroyed).

Pitfall 4: Over-Controlling Everything

Not everything needs to be a controlled document. Meeting notes, informal emails, and project sketches don't need version numbers and approval signatures.

The test: If someone using the wrong version could affect product or service quality, control it. If it's a reference or a note, don't.

Example: A consultancy created controlled documents for everything — including social event planning notes and the Wi-Fi password sheet. Their master list had 280 entries. The quality manager spent 2 hours per week on the review cycle alone. Staff stopped updating documents. The auditor found 35 documents past their review date.

Fix: A 20-person company should have 15–30 controlled documents, not 200. Apply document control only to documents that affect QMS performance.

If you're preparing for certification, our ISO 9001 readiness quiz covers Clause 7.5 requirements and highlights specific gaps.

Most of the control described above is easier to sustain in a purpose-built tool than in a shared drive. The criteria for choosing an ISO 9001 documentation tool covers version control, approval trails, and obsolete-document handling.

ISO 9001 Document Control Checklist

Before your audit, verify:

• Master document list exists and is current
• Every controlled document has a unique ID, version, date, author, and approver
• No obsolete versions exist in any location (digital or physical)
• Printed copies are listed and tracked
• Every document has a review date, and none are overdue
• Records have defined retention periods
• Access is restricted to prevent unauthorised changes
• Staff know where to find current versions of their procedures
• Change history is recorded for each document
• Only documents affecting QMS performance are under formal control

If you're not sure whether your documentation is proportionate, the gap analysis checklist covers Clause 7.5 alongside every other clause — it helps you identify what's missing without over-documenting.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide lists every mandatory document for ISO 27001:2022, explains what your auditor actually checks for each one, and describes what "good enough" looks like when you have 5–100 employees and no dedicated compliance team.

How ISO 27001 Documentation Requirements Work

ISO 27001:2022 requires documented information in two ways:

1. "The organisation shall maintain documented information" — you need a document (policy, procedure, methodology).
2. "The organisation shall retain documented information" — you need records (evidence that something happened).

The distinction matters. A policy is something you write once and review periodically. A record is evidence generated through operations — audit results, risk assessment outputs, management review minutes. Your auditor checks both. Missing a policy is a nonconformity. Missing a record suggests the process never happened, which is worse.

The mandatory documents split across two areas: the ISMS management system (Clauses 4–10) and the Annex A controls. Let's cover both.

ISO 27001 Mandatory Documents: Clauses 4–10

These are the management system documents every certified organisation needs. No exceptions, regardless of size.

1. ISMS Scope (Clause 4.3)

What it is. A statement defining what the ISMS covers — business units, locations, information systems, and the boundaries of the management system.

What auditors check. That the scope is specific enough to be meaningful and doesn't exclude areas where information risks clearly exist. "Our London office" fails if staff work remotely and data sits in cloud services outside that office. The auditor probes boundaries.

Good enough for a small business. One to two paragraphs. State which legal entity, which sites (including remote working), which systems and services, and which information types. If the scope is the whole business, say so. Most UK SMBs under 50 staff scope the entire organisation and avoid boundary headaches.

2. Information Security Policy (Clause 5.2)

What it is. The top-level policy statement signed by senior management, setting the direction for information security.

What auditors check. That it includes a commitment to satisfying applicable requirements and to continual improvement. That it has been communicated to staff. That staff can describe what it means in practical terms — not recite it word for word, but demonstrate awareness.

Good enough for a small business. One page. State the business context, the commitment to protecting information, the obligation to comply with legal requirements (UK GDPR, DPA 2018), and who is responsible. Get the MD to sign it. Pin it where staff see it. Review annually.

3. Risk Assessment Methodology (Clause 6.1.2)

What it is. A documented approach describing how you identify, analyse, and evaluate information security risks.

What auditors check. That the methodology existed before the risk assessment — not written after the fact. That it defines criteria for risk acceptance. That it produces consistent, comparable results. The auditor will ask: "If two people assessed the same risk, would they reach the same conclusion?"

Good enough for a small business. A 2–3 page document covering: how you identify assets and threats, your likelihood and impact scales (a 3x3 matrix works), how you calculate risk level, and what threshold triggers treatment. Keep scales simple. A 5x5 matrix with elaborate descriptors is harder to apply consistently than a 3x3 with clear definitions.

4. Risk Assessment Results (Clause 8.2)

What it is. The output of your risk assessment — typically a risk register listing identified risks, their scores, and treatment decisions.

What auditors check. That the assessment follows the methodology you documented. That it covers information assets proportionate to your scope. That risk owners are named individuals, not just departments. That the assessment is recent — conducted or reviewed within the last 12 months.

Good enough for a small business. A spreadsheet or register with 20–50 risks is typical for a 10–50 person business. Cover the obvious categories: data breach, ransomware, supplier compromise, insider threat, physical security, business continuity. Each risk needs an owner, a likelihood and impact score, and a treatment decision (mitigate, accept, transfer, avoid).

5. Risk Treatment Plan (Clause 6.1.3)

What it is. The plan for addressing risks that exceed your acceptance threshold — which controls you are implementing, who is responsible, and by when.

What auditors check. That every risk above the acceptance threshold has a treatment action. That actions have named owners and target dates. That there is evidence of progress. The auditor compares the risk treatment plan against the Statement of Applicability to verify consistency.

Good enough for a small business. Can be a tab in your risk register spreadsheet. For each risk being treated: the selected control(s), the action, the owner, the deadline, and the status. Update it monthly during implementation, quarterly once the ISMS is running.

6. Statement of Applicability (Clause 6.1.3d)

What it is. A document listing all 93 Annex A controls, stating whether each applies, and justifying the decision. It is the single most scrutinised document in an ISO 27001 audit.

What auditors check. That all 93 controls appear — not just the ones you selected. That every exclusion has a justified reason traceable to the risk assessment. That implementation status is recorded honestly. The SoA is the auditor's roadmap for your entire Stage 2.

Good enough for a small business. A spreadsheet with columns for: control reference, control name, applicable (yes/no), justification, implementation status, and notes. Excluding 5–10 controls is typical. More than 20 exclusions raises questions. Our guide to the Statement of Applicability covers this in detail, and the ISO 27001 controls checklist helps you work through all 93 systematically.

7. Information Security Objectives (Clause 6.2)

What it is. Measurable objectives for information security, consistent with the policy.

What auditors check. That objectives are specific and measurable — "improve security" fails; "reduce phishing click rate from 12% to under 5% by Q3" works. That progress is monitored. That objectives are reviewed at management review.

Good enough for a small business. Three to five objectives. Examples: complete security awareness training for 100% of staff by a target date, achieve zero critical vulnerabilities unpatched beyond 30 days, complete business continuity testing annually. Track them in a simple table with target, measure, deadline, and status.

8. Competence Evidence (Clause 7.2)

What it is. Records proving that people performing work affecting information security have the necessary competence.

What auditors check. That you have defined what competence is needed for security-relevant roles. That you hold evidence — training certificates, qualifications, experience records. The auditor will ask to see competence evidence for the ISMS manager, IT staff, and anyone with privileged access.

Good enough for a small business. A simple matrix: role, required competence, evidence held. Training completion records, certificates (Cyber Essentials, vendor certifications), and induction records. You do not need everyone to hold CISSP. You need evidence that people in security-relevant roles know what they are doing.

9. Operational Planning and Control (Clause 8.1)

What it is. Evidence that you plan, implement, and control the processes needed to meet information security requirements.

What auditors check. That planned changes are controlled and unintended changes are reviewed. That outsourced processes are identified and controlled. This connects directly to your risk treatment plan — the auditor checks that the controls you said you would implement are actually operational.

Good enough for a small business. This is not a standalone document for most SMBs. It is the combination of your implemented controls, procedures, and the evidence that they run. If you have an access control procedure and evidence of access reviews, that covers the operational planning for access control.

10. Monitoring and Measurement Results (Clause 9.1)

What it is. Records showing that you monitor and measure information security performance and the effectiveness of the ISMS.

What auditors check. That you defined what to monitor (linked to your objectives and risk treatment). That you have actual results. That someone reviews them. Common examples: security incident counts, vulnerability scan results, training completion rates, access review completion.

Good enough for a small business. A quarterly dashboard or summary covering your key metrics. Three to five measures linked to your objectives. The auditor wants evidence of a functioning feedback loop, not enterprise-grade analytics.

11. Internal Audit Programme and Results (Clause 9.2)

What it is. A planned programme of internal audits covering the ISMS, plus the audit reports.

What auditors check. That audits are planned and cover the full ISMS scope over time. That auditors are independent of the area being audited (your IT manager cannot audit their own controls). That findings are documented and acted upon.

Good enough for a small business. Audit the full ISMS annually, splitting across two or three audits if needed. The auditor must be independent — this can be a colleague from a different function, an external auditor, or a consultant. Produce a brief report: scope, findings, nonconformities, observations. Our ISO 9001 audit checklist covers the audit process in detail — the structure is identical for 27001.

The programme and the records are audited together — see our ISO 27001 internal audit guide for how to structure both.

12. Management Review Results (Clause 9.3)

What it is. Minutes or records from management review meetings covering information security.

What auditors check. That reviews happen at planned intervals (at least annually). That the standard's required inputs are covered: audit results, feedback, risk assessment changes, opportunities for improvement. That the review produces decisions and actions — not just a discussion.

Good enough for a small business. One meeting per year minimum, with minutes covering each required input. A structured agenda template ensures nothing is missed. Record decisions, action items, and owners. The meeting can be 60–90 minutes if prepared well.

13. Nonconformities and Corrective Actions (Clause 10.1)

What it is. Records of nonconformities identified (from audits, incidents, or reviews) and the corrective actions taken.

What auditors check. That you react to nonconformities. That you investigate root cause, not just symptoms. That corrective actions are implemented and their effectiveness is reviewed. The auditor checks the loop: problem identified, cause analysed, action taken, action verified.

Good enough for a small business. A simple log or register: date, description, root cause, corrective action, owner, deadline, status, effectiveness review. Even five entries showing the process works is better than an empty log. The auditor expects to find nonconformities — what matters is how you handle them.

Annex A Policies and Procedures

Beyond the Clauses 4–10 mandatory documents, several Annex A controls require their own documented policies or procedures. These are not optional if the control is applicable in your Statement of Applicability.

The key ones:

Not every control requires a standalone document. Auditors accept combined policies — an access control policy can cover A.5.15, A.8.2, A.8.3, A.8.4, and A.8.5 in one document. An incident management procedure can address A.5.24 through A.5.28. Combining related controls into single documents is not just acceptable — it is sensible for a small business.

Which of these you genuinely need, and what each one has to say, is covered in ISO 27001 policy templates.

How Many Documents Does a Small Business Actually Need?

The total depends on scope, but a typical UK SMB with 10–50 employees ends up with 25–40 documents for a complete ISMS. That includes the 13 Clauses 4–10 documents above, 8–15 Annex A policies and procedures, plus supporting records and registers.

Common mistake: building 60–80 documents because a consultant's template pack includes one document per Annex A control. More documents means more version control, more review cycles, and more things to go wrong at audit. The standard requires documented information — it does not require one document per clause or control.

Keep it proportionate. Clause 7.5 explicitly states that the extent of documented information depends on the size of the organisation and its activities. A 15-person business with a single office and standard IT infrastructure does not need the same documentation volume as a 500-person organisation with multiple sites and bespoke systems.

Three principles for keeping documentation lean:

1. Combine related controls into single documents. One access control policy, not five. One incident management procedure covering detection through lessons learned.
2. Use records, not procedures, where the process is obvious. You do not need a 10-page procedure for management review — you need an agenda template and minutes.
3. Write for the reader, not the auditor. If staff cannot follow a procedure, it produces no value and generates audit findings when practice diverges from documentation.

For context on overall certification costs — including documentation effort — see our ISO 27001 certification cost breakdown.

What Auditors Actually Check at Stage 1 vs Stage 2

Understanding when documents are checked helps you prioritise.

Stage 1 (documentation review, typically 1 day): The auditor reviews your documented ISMS before visiting your site. They check: ISMS scope, information security policy, risk assessment methodology, SoA, risk treatment plan, internal audit programme, management review records. If any mandatory document is missing, Stage 1 fails and Stage 2 is postponed. Fix the gaps first.

Stage 2 (implementation audit, 2–4 days for SMBs): The auditor verifies that documentation reflects reality. They interview staff, check records, sample evidence. The risk assessment results, competence records, monitoring data, corrective action logs, and operational evidence all get examined here. A policy that exists on paper but is not followed produces a major nonconformity.

The gap between Stage 1 and Stage 2 is typically 1–3 months. Use that time to close any documentation findings from Stage 1 and ensure records are current.

UK-Specific Documentation Considerations

Data Protection Act 2018 / UK GDPR. Several mandatory documents directly support UK GDPR compliance. Your information security policy should reference the DPA 2018. Your risk assessment should include personal data risks. Your incident management procedure must include the UK GDPR breach-notification duty. Read it as it is written: Article 33 requires notification to the ICO "without undue delay and, where feasible, not later than 72 hours after having become aware of it", and only where the breach is not "unlikely to result in a risk to the rights and freedoms of natural persons" — so not every breach is notifiable, and a notification later than 72 hours must carry reasons for the delay. On this site's own reading, documenting that alignment explicitly is worth doing; we have not found published certification-body data on how often auditors ask for it.

Cyber Essentials mapping. If you hold Cyber Essentials or CE Plus, reference this in your documentation. The five CE control areas (firewalls, secure configuration, access control, malware protection, patch management) overlap with Annex A technological controls. Documenting the mapping avoids duplicating effort and demonstrates a coherent security posture.

NCSC guidance. The NCSC's 10 Steps to Cyber Security and cloud security principles provide practical frameworks that align with ISO 27001 documentation requirements. Referencing them strengthens your documentation and demonstrates awareness of UK-specific threat guidance.

Public sector supply chain. If you supply to UK government, your documentation may need to address the Cabinet Office Security Policy Framework or specific contract security requirements. Build these into your legal and regulatory requirements register (A.5.31) from the start rather than retrofitting.

ISO 27001 Mandatory Documents Checklist

Before your Stage 1 audit, verify you have every item below:

Clauses 4–10 (management system):

• ISMS scope statement (Clause 4.3)
• Information security policy, signed by top management (Clause 5.2)
• Risk assessment methodology (Clause 6.1.2)
• Statement of Applicability covering all 93 controls (Clause 6.1.3d)
• Risk treatment plan with owners and deadlines (Clause 6.1.3)
• Information security objectives with measures (Clause 6.2)
• Competence records for security-relevant roles (Clause 7.2)
• Risk assessment results / risk register (Clause 8.2)
• Risk treatment results and implementation evidence (Clause 8.3)
• Monitoring and measurement results (Clause 9.1)
• Internal audit programme, schedule, and reports (Clause 9.2)
• Management review minutes with required inputs and outputs (Clause 9.3)
• Nonconformity and corrective action log (Clause 10.1)

Annex A policies and procedures (where applicable):

• Acceptable use policy (A.5.10)
• Access control policy (A.5.15, A.8.2–8.5)
• Information classification and handling procedures (A.5.12–5.13)
• Supplier security policy (A.5.19–5.22)
• Incident management procedure (A.5.24–5.28)
• Business continuity / ICT readiness plans (A.5.29–5.30)
• Legal and regulatory requirements register (A.5.31)
• HR security procedures — screening, awareness, termination (A.6.1–6.5)
• Physical security procedures (A.7.1–7.4)
• Logging and monitoring procedures (A.8.15–8.16)
• Cryptography / encryption policy (A.8.24)

Records to have ready:

• Asset inventory
• Training and awareness completion records
• Access review records
• Security incident log (even if no incidents — document that)
• Change management records
• Vulnerability scan or penetration test results

Use the ISO 27001 controls checklist to track implementation status for all 93 Annex A controls alongside this document list. Start with the Clauses 4–10 documents — they take the longest to get right and form the backbone of your Stage 1 review.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide explains what the SoA is, how it connects to the 93 Annex A controls in ISO 27001:2022, how to justify inclusions and exclusions, and the mistakes that trip up UK SMBs. For context on overall ISO 27001 certification costs — and how the SoA drives audit scope and fees — see our ISO 27001 certification cost breakdown.

What Is the Statement of Applicability?

Clause 6.1.3(d) of ISO 27001:2022 requires a Statement of Applicability containing:

• The necessary controls (from your risk assessment and treatment process)
• Justification for their inclusion
• Whether they are implemented or not
• Justification for excluding any Annex A controls

The SoA proves you've systematically considered every Annex A control. It also tells your auditor which controls to assess and provides the reason for any you've excluded.

The 93 Annex A Controls

ISO 27001:2022 reorganised Annex A into 93 controls across 4 themes — the 2013 edition used a different structure with different control numbers. The four themes are Organisational (A.5), People (A.6), Physical (A.7) and Technological (A.8). The 93-control, 4-theme figure is UKAS's, stated of ISO/IEC 27002:2022 — its ISO/IEC 27001:2022 transition bulletin says Annex A "has been aligned with the controls defined in ISO/IEC 27002:2022, which contains 93 controls (11 of which are new) organised in 4 themes". Per-theme counts, the theme names and the individual control numbers and titles come from ISO/IEC 27002:2022, which is paywalled, so no per-theme count is stated here. For the SoA what matters is that all 93 are addressed.

UKAS records eleven of the ISO/IEC 27002:2022 controls as new, but does not name them. The commonly-cited examples are Annex A's A.5.23 (cloud services security), A.8.9 (configuration management), A.8.12 (data leakage prevention) and A.8.28 (secure coding) — ISO/IEC 27002:2022 defines the same controls and numbers them without the A. prefix. That standard is paywalled; check them against a purchased copy. Each of these 93 controls must appear in your SoA.

For a plain-English walk-through of what each of the 93 controls actually requires, see ISO 27001 list of controls.

How to Write Your SoA

Step 1: Complete Your Risk Assessment First

The SoA flows from your risk assessment and risk treatment plan (Clauses 6.1.2 and 6.1.3). You identify risks, decide treatment, and select controls. The SoA documents which Annex A controls you selected and which you didn't need. Writing the SoA before the risk assessment works backwards — and produces justifications that won't survive audit.

If the risk assessment is not done yet, the ISO 27001 risk assessment template guide sets out a method you can complete in a day for a small ISMS.

Step 2: Create the SoA Table

A spreadsheet works. Create columns for: control reference, control name, applicable (yes/no), justification, implementation status (implemented/partial/not yet), and notes.

Step 3: Work Through All 93 Controls

For each, ask: does the risk exist in our environment? Did our risk assessment identify it? Is there a legal reason to include it? The Data Protection Act 2018 (UK GDPR) may require certain controls regardless — A.8.11 (Data masking) and A.8.10 (Information deletion) directly support UK GDPR data minimisation principles.

Step 4: Justify Every Exclusion

Valid exclusion reasons:

• The risk doesn't exist. "We exclude A.8.28 (Secure coding) because we do not develop software." Defensible.
• Another control addresses it. "We exclude A.7.4 (Physical security monitoring) because our managed office provides 24/7 CCTV and access control under their own ISO 27001 certification." Also defensible.

Invalid reasons:

• "We don't have budget." Cost doesn't justify exclusion under ISO 27001.
• "We plan to implement later." Mark it as applicable with status "not yet implemented" — don't exclude it.
• "We didn't think it was relevant." Without a risk assessment link, this won't survive audit.

Several Annex A controls are satisfied by a written policy rather than a technical measure. ISO 27001 policy templates covers which policies carry that weight and what each needs to say.

How Many Controls Can You Exclude?

No fixed limit, but patterns matter. Excluding 5–10 controls is typical for a UK SMB. More than 15–20 will draw scrutiny. More than 30 suggests the risk assessment missed things.

Cross-reference your SoA against the NCSC's Cyber Essentials and 10 Steps to Cyber Security to confirm you haven't overlooked applicable controls.

Common SoA Mistakes

Writing the SoA without the risk assessment. Every control's inclusion must trace back to a specific risk. No risk assessment, no traceability — that's a major nonconformity against Clause 6.1.3.

"N/A" without explanation. Every exclusion needs a documented reason, not just "N/A" in the justification column.

Missing non-Annex A controls. Clause 6.1.3(b) allows controls from any source. If your risk treatment uses PCI DSS controls or NHS Digital's Data Security and Protection Toolkit requirements, include them alongside Annex A.

Treating the SoA as static. Review it annually at management review, minimum. When your risk profile changes (new services, new threats, new regulations like the NIS Regulations 2018), update the SoA.

Confusing "not yet implemented" with "excluded." If a control applies but isn't done yet, mark it applicable with a target date. Hiding the gap by excluding it backfires — the auditor will identify the risk themselves.

Use our ISO 27001 controls checklist to work through all 93 controls and track implementation alongside your SoA. For a full list of the documentation your ISMS must include — beyond the SoA — see our ISO 27001 mandatory documents guide.

Your internal audit is what verifies the SoA is accurate rather than aspirational — auditors sample controls marked applicable and look for the evidence. See our ISO 27001 internal audit guide for how to plan that sampling.

Statement of Applicability Checklist

Before audit, verify:

• All 93 Annex A controls are listed — none omitted
• Each control has a clear applicable/not applicable determination
• Every exclusion has a justified reason linked to the risk assessment
• Every applicable control has an implementation status
• Non-Annex A controls from your risk treatment are included
• Version number, date, and approver are recorded
• Legal requirements (DPA 2018, UK GDPR, NIS Regulations 2018) have been considered
• The SoA aligns with the risk treatment plan
• The document has been reviewed within the last 12 months
• If pursuing both standards, you've reviewed the shared management system clauses — Clauses 4–10 overlap heavily between ISO 9001 and ISO 27001

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide covers the template structure, a worked example, the difference between procedures and work instructions, how many you actually need, and the mistakes that generate audit findings.

What is a work instruction (and how is it different from a procedure)?

Before writing anything, get the terminology straight. ISO 9001 does not use the term "work instruction" explicitly — it refers to "documented information" needed to support process operation (Clause 8.1). In practice, most UK certification bodies and UKAS auditors recognise a three-tier documentation hierarchy:

Procedures describe what happens and who is responsible. They cover a whole process — for example, your purchasing procedure might explain how suppliers are selected, orders placed, and goods received. Procedures answer the question: what are the steps in this process and who owns each one?

Work instructions describe how to perform a specific task within a procedure. They are the step-by-step detail an operator needs to do one job correctly. Using the same example, a work instruction might cover how to inspect incoming goods against a purchase order. Work instructions answer: how exactly do I do this task?

Forms and records capture evidence that a task was done. The completed goods receiving inspection form is the record; the blank form is the template. Records answer: did this happen, and what was the result?

Here is a practical way to think about it:

Your quality manual sits above all three, describing the overall QMS. Procedures reference work instructions; work instructions reference forms. Each layer adds detail without repeating the layer above.

ISO 9001 work instruction template: the 8-field structure

Every work instruction needs the same core fields. This structure satisfies auditor expectations, keeps the document navigable, and ensures revision control works properly.

1. Title

Clear, specific, and matching how staff refer to the task. "Goods Receiving Inspection" works. "WI-PUR-003" does not — that is a document ID, not a title. Use both: the title tells staff what the document covers; the ID tells the document control system where it lives.

2. Document ID

Follow whatever numbering convention your QMS uses. A common pattern for small businesses: WI-[process code]-[sequence number]. Example: WI-PUR-003 (third work instruction in the purchasing process). Keep the system simple — if you need a manual to understand the numbering, it is too complex.

3. Revision number and date

Essential for document control. Use sequential revision numbers (Rev 1, Rev 2, Rev 3) and include the date of last revision. Some businesses add a brief revision history table at the bottom. At minimum, the current revision number and date must be visible on the first page.

4. Purpose

One or two sentences explaining why this work instruction exists. "To ensure incoming goods are inspected against purchase order specifications before being accepted into stock." This prevents scope creep and helps new staff understand what the instruction is for.

5. Scope

What tasks does this instruction cover, and what does it not cover? Define the boundaries. "Applies to all physical goods received at the Swindon warehouse. Does not cover digital deliveries or services." Scope prevents confusion when multiple work instructions sit in the same process area.

6. Step-by-step instructions

The core of the document. Write each step as a numbered action, starting with a verb. Be specific enough that a competent person can follow the steps without asking questions, but do not write a training manual. Assume the reader has the baseline competence for their role.

Good step: "Compare the delivery note quantities against the purchase order. Record any discrepancies on the Goods Receiving Form (F-PUR-003)."

Weak step: "Check the delivery."

Over-engineered step: "Pick up the delivery note from the driver's hand. Walk to the computer terminal located in the warehouse office (Room 1.04). Open the ERP system by double-clicking the icon on the desktop. Navigate to Purchasing > Purchase Orders > Open Orders..."

The middle ground is what you are aiming for. Write for a trained operator, not a complete beginner and not an auditor.

7. Records generated

List every form, log, or record that this instruction produces. Example: "Goods Receiving Form (F-PUR-003), Nonconformance Report (F-QMS-008) if applicable." This links the work instruction to your records and gives auditors a clear trail.

8. Approval

Who approved this version, and when. For small businesses, this is typically the process owner or quality manager. Some companies use a two-signature system (prepared by / approved by). Keep it proportionate — a 25-person company does not need a three-tier approval chain.

Worked example: goods receiving inspection

Here is what this template looks like filled in for a small manufacturer receiving raw materials at a single UK site.

Title: Goods Receiving Inspection

Document ID: WI-PUR-003 | Revision: Rev 2 | Date: 14 March 2026

Purpose: To ensure all incoming goods are inspected against purchase order specifications and supplier conformance requirements before acceptance into stock.

Scope: Applies to all physical goods and raw materials received at the Swindon warehouse. Does not apply to consumables under £50 per order or to digital deliveries.

Steps:

1. Collect the delivery note from the driver and check the supplier name, PO number, and delivery address match our records.
2. Conduct a visual inspection of packaging for damage. Photograph any damage before signing the driver's delivery note — note damage on the driver's copy as well.
3. Open the purchase order in the ERP system using the PO number from the delivery note.
4. Compare delivered items against the PO: verify part numbers, quantities, and any specified material certifications or test reports.
5. For items requiring dimensional inspection, measure a sample per the inspection plan (minimum 10% of batch or 5 units, whichever is greater). Record measurements on the Goods Receiving Form (F-PUR-003).
6. If all items conform: sign the Goods Receiving Form, update stock in the ERP system, and move goods to the designated storage location.
7. If any items do not conform: quarantine the nonconforming items in the red-tagged area, complete a Nonconformance Report (F-QMS-008), and notify the Purchasing Manager within 2 hours.
8. File the completed Goods Receiving Form in the monthly inspection folder (physical) and scan to the QMS shared drive within 24 hours.

Records generated: Goods Receiving Form (F-PUR-003), Nonconformance Report (F-QMS-008) if applicable, damage photographs if applicable.

Approved by: Warehouse Manager | Date: 14 March 2026

Notice what is in this instruction and what is not. It tells a trained warehouse operative exactly what to do at each step. It does not explain how to use the ERP system (that is a training matter), how to operate a micrometer (that is a competence requirement), or why the company inspects incoming goods (that is in the purchasing procedure). Each layer of documentation does its own job.

How many work instructions does a small business need?

This is where most UK SMBs go wrong — usually in the direction of too many. A 20-person manufacturer does not need 150 work instructions. The standard does not prescribe a number. Clause 8.1 says you need documented information "to the extent necessary" to have confidence that processes are carried out as planned.

In practice, most small businesses with 5 to 100 employees need between 10 and 30 work instructions. The number depends on:

• Process complexity. A CNC machining shop with tight tolerances needs more work instructions than an IT consultancy delivering standard service packages.
• Staff turnover. High-turnover roles benefit from more documented instructions because you are training new people more frequently.
• Risk. Tasks where errors cause safety issues, significant financial loss, or customer complaints deserve a work instruction. Routine admin tasks usually do not.
• Regulatory requirements. Some sectors (medical devices, aerospace supply chain, food manufacturing) have regulatory obligations that drive additional documentation.

A useful test: if a trained person can do the task correctly without referring to a document, and the consequences of doing it slightly differently are low, you probably do not need a work instruction for it. Write instructions for the tasks that matter — the ones where consistency, traceability, or risk justify the documentation effort.

If you have already done a gap analysis, your findings will tell you which processes lack documented controls. Start there rather than trying to document everything.

Common mistakes that generate audit findings

Copying manufacturer instructions verbatim

Pasting the machine manufacturer's operating manual into your QMS and calling it a work instruction is a common shortcut. Auditors see through it immediately. The manufacturer's manual describes how their equipment works in general. Your work instruction should describe how your operators use that equipment in your process, with your acceptance criteria, generating your records.

Reference the manufacturer's manual by all means — "Refer to ABC Machine Operating Manual, Section 4.2 for setup parameters" — but do not replace your own instruction with it.

Writing for auditors instead of operators

If your work instructions read like they were written to impress an auditor, your staff will not use them. And if staff do not use them, the auditor will find out during interviews. "Can you show me the work instruction for this task?" followed by "Do you actually follow these steps?" is a standard audit trail. Blank looks and improvised answers generate nonconformities.

Write for the person doing the job. Use the language your team uses. If the shop floor calls it a "goods-in check," do not title the document "Incoming Material Conformity Verification Procedure." The auditor cares that the instruction exists, covers the right controls, and gets followed — not that it uses formal vocabulary.

No revision control

A work instruction without a revision number and date is a document control failure (Clause 7.5). Worse, having multiple versions in circulation — one pinned to the warehouse wall from 2022, a different one on the shared drive from 2024 — is a near-guaranteed nonconformity.

Every work instruction must be part of your document control system. Current versions accessible to people who need them. Obsolete versions removed or clearly marked. Revision history maintained. This is basic QMS hygiene, but auditors find revision control failures in roughly one-third of UK SMB surveillance audits.

Documenting everything

Writing work instructions for every conceivable task is a trap. It creates a documentation burden that nobody can maintain, and outdated instructions are worse than no instructions — they actively mislead. If your QMS contains 200 work instructions and half of them have not been reviewed in three years, you have a systemic document control problem.

Be selective. Document the tasks that need documenting. Leave the rest to training and competence.

Skipping the "records generated" field

If your work instruction does not specify what records it produces, auditors cannot trace the evidence chain. They will ask: "How do I know this task was done?" If the answer is "there is no record," they will ask: "Then how do you verify the process is being followed?" This quickly becomes a Clause 8.1 finding.

Every work instruction that involves a quality-critical task should produce at least one record.

ISO 9001 work instruction template: fitting it into your QMS

Work instructions do not exist in isolation. They are part of a documentation hierarchy that includes your quality manual, procedures, and records. Getting the connections right matters:

• Your quality manual references the procedures that govern each process area.
• Each procedure references the work instructions that provide step-by-step detail for specific tasks within that process.
• Each work instruction references the forms and records it generates.
• Your document control system tracks revision status across all three levels.

When an auditor examines your Clause 8 operational controls, they follow this chain. They read your procedure to understand the process, check whether work instructions exist for critical tasks, pick a recent record to verify the instruction was followed, and interview the operator to confirm they know the instruction exists and use it. If any link in that chain breaks, you have a finding.

For businesses going through certification for the first time, start by writing procedures first, then identify which tasks within each procedure need a work instruction. Do not write work instructions before you have mapped your processes — you will end up with instructions that do not connect to anything.

Keeping work instructions current

A work instruction is only useful if it reflects what actually happens today. The most common trigger for updating a work instruction is a process change — new equipment, revised acceptance criteria, a corrective action that changes how a task is done. Build work instruction review into your existing change management and corrective action processes.

As a minimum, review each work instruction annually as part of your management review cycle. If you have not changed a process in two years, the instruction may still be current — but confirm it, date the review, and record that no changes were needed. "Reviewed, no changes" is a valid outcome. No review at all is a gap.

For businesses preparing for the ISO 9001:2026 revision, now is a sensible time to audit your work instruction library. Check which instructions are still current, which need updating, and which can be retired. The clause comparison tool shows what has changed in the operational planning clauses.

Practical takeaway checklist

Use this when writing or reviewing your work instructions:

1. Use the 8-field template structure: title, document ID, revision, purpose, scope, steps, records, approval
2. Write steps as numbered actions starting with a verb — specific enough for a trained operator, not a training manual
3. Target 10 to 30 work instructions for a typical SMB — document what matters, not everything
4. Write for operators, not auditors — use the language your team actually uses
5. Include the "records generated" field in every work instruction so auditors can trace the evidence chain
6. Never copy manufacturer manuals verbatim — reference them, then write your own process-specific instruction
7. Apply revision control to every work instruction and remove obsolete versions from circulation
8. Review work instructions at least annually and after every process change or corrective action
9. Connect each work instruction to its parent procedure and to the forms it generates
10. Test the instruction: give it to someone who does the task and ask if it matches what they actually do — if it does not, rewrite it

Get this right and you end up with a lean set of work instructions that staff actually use and auditors accept without extended questioning. That is the standard your QMS documentation should meet — useful on the shop floor and defensible in an audit.

If you are not sure how your overall documentation stacks up, the ISO 9001 readiness quiz gives you a clause-by-clause assessment in under five minutes. For a full picture of what certification will cost, including the documentation effort, try the ISO 9001 cost estimator.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

What Each Standard Covers

ISO 9001: Quality Management

ISO 9001 is a quality management system (QMS) standard. It defines requirements for consistently delivering products and services that meet customer expectations and applicable regulations. The standard covers how you plan work, control processes, manage suppliers, handle complaints, measure performance, and improve over time.

ISO 9001 applies to any organisation, in any sector, of any size. It is widely held in the UK, though we have not been able to verify a certificate count against a primary source: ISO publishes an annual ISO Survey but the underlying dataset is not retrievable, and the figures quoted by secondary sources disagree with each other. It is routinely required in public sector procurement, construction supply chains, manufacturing, and professional services tenders.

The current edition is ISO 9001:2026, published on 16 September 2026. Organisations certified to ISO 9001:2015 have until 30 September 2029 to transition. Certification is awarded by UKAS-accredited certification bodies following a two-stage audit process.

ISO 27001: Information Security Management

ISO 27001 is an information security management system (ISMS) standard. It defines requirements for protecting the confidentiality, integrity, and availability of information — whether that information is digital, paper-based, or held in people's heads.

The standard has two components: management system clauses (4–10), which structure the ISMS, and Annex A, which lists security controls across four categories (organisational, people, physical, technological). You don't implement all of them — your risk assessment determines which apply, and you document your decisions in a Statement of Applicability.

The current edition is ISO 27001:2022. In the UK, it is increasingly demanded by customers in IT services, financial services, healthcare, and any sector handling personal or commercially sensitive data. UK GDPR compliance is not the same as ISO 27001 certification, but the two reinforce each other heavily.

ISO 9001 vs ISO 27001: Side-by-Side Comparison

This table summarises the practical differences that matter when you are deciding which to pursue.

For detailed cost breakdowns, see the dedicated guides: ISO 9001 certification cost UK and ISO 27001 certification cost UK.

ISO 27001 typically costs more and takes longer because Annex A adds a layer of control-by-control assessment that ISO 9001 does not have. The risk assessment methodology is more prescriptive, the documentation volume is higher, and auditors spend more time verifying technical controls.

Where ISO 9001 and ISO 27001 Overlap

Both standards follow the Annex SL high-level structure — the common framework that ISO uses across all management system standards. This means significant structural overlap between the two.

Shared requirements

These clauses are structurally identical or near-identical in both standards:

• Context of the organisation (Clause 4): Both require you to identify internal and external issues, interested parties, and define the scope of your management system.
• Leadership (Clause 5): Both require a policy, defined roles and responsibilities, and top management commitment.
• Planning (Clause 6): Both require risk-based thinking, objectives, and planning for changes.
• Support (Clause 7): Both cover resources, competence, awareness, communication, and documented information (document control).
• Performance evaluation (Clause 9): Both require monitoring and measurement, internal audits, and management reviews.
• Improvement (Clause 10): Both require corrective action and continual improvement.

What the overlap means in practice

If you implement one standard properly, roughly 40% of the work for the second standard is already done. The shared elements — document control procedures, internal audit programmes, management review processes, corrective action workflows, competence records — carry across without modification or with only minor adaptation.

That 40% — here and wherever this guide repeats it — is this site's own estimate, not a measured finding — we have not found a published study that quantifies the saving, so treat it as a planning assumption to test against your own quotes rather than a statistic. The reason there is a saving at all is structural: the management system backbone is already in place, and what changes is the subject matter — quality processes for ISO 9001, security controls for ISO 27001.

If you hold ISO 9001 and want to add ISO 27001, you can reuse your existing document control, internal audit, management review, and corrective action procedures. You then build the ISMS-specific elements on top: risk assessment methodology, Statement of Applicability, and the applicable Annex A controls.

Who Needs Which Standard?

This is where sector and customer requirements matter more than abstract comparisons. Here is a practical guide based on typical UK market expectations.

ISO 9001 is the priority if you are in:

Manufacturing. Quality management is the baseline expectation. Supply chain requirements, product conformity, process control, and supplier management all sit squarely within ISO 9001. Most manufacturing supply chains — automotive (IATF 16949 builds on ISO 9001), aerospace (AS9100 builds on ISO 9001), general engineering — require it explicitly.

Construction. Principal contractors and tier-one subcontractors routinely require ISO 9001 from their supply chain. PAS 91 (the standard pre-qualification questionnaire for construction) asks about ISO 9001 certification. Information security certification is rarely requested unless you handle sensitive government project data.

Professional services (non-data-intensive). Management consultancies, training companies, recruitment firms, and similar businesses where the primary deliverable is a service rather than data. ISO 9001 demonstrates consistent service delivery. ISO 27001 may not be asked for unless you handle significant personal data or client IP.

Any business supplying the UK public sector. Procurement policy notes (PPNs) and framework agreements frequently reference quality management system certification. The ISO 9001 small business guide covers the public sector angle in detail.

ISO 27001 is the priority if you are in:

IT services and software development. If you build, host, or manage software, infrastructure, or data for clients, ISO 27001 is the standard they will ask about. It demonstrates that you protect their data systematically, not just with good intentions.

Professional services handling sensitive data. Accountancy firms, law firms, HR consultancies, payroll providers — anyone processing personal data, financial records, or commercially sensitive client information at scale. UK GDPR creates the legal obligation; ISO 27001 provides the structured framework to meet it.

Financial services supply chain. FCA-regulated firms increasingly require ISO 27001 from their technology and data suppliers. The PRA's operational resilience requirements push the same direction.

Healthcare and NHS supply chain. The NHS Data Security and Protection Toolkit (DSPT) aligns with ISO 27001 principles. Suppliers handling patient data or connecting to NHS systems benefit from certification.

You probably need both if you are:

A managed service provider (MSP) or IT outsourcer. Your clients expect quality service delivery (ISO 9001) and secure handling of their data and systems (ISO 27001). Holding both is increasingly table stakes for MSPs competing for mid-market and enterprise contracts.

A SaaS company. Your product is software (quality matters) and you host customer data (security matters). Larger customers — particularly in financial services, healthcare, and government — will ask for both. SOC 2 is an alternative for the security side if your market is US-focused, but UK and European customers default to ISO 27001.

A data-processing professional services firm. If you combine service delivery with significant data handling — payroll outsourcing, claims processing, document management — both standards address different dimensions of what your clients care about.

Any business running integrated operations where quality failures and security failures both represent material risks. If a data breach would be just as damaging as a quality failure, you need both systems.

Running Both Standards: The Integrated Approach

If you need both, do not build two separate management systems. An integrated management system (IMS) uses a single set of core processes — document control, internal audit, management review, corrective action, competence management — with standard-specific extensions for quality and information security.

Cost savings from integration

Integrated audits save 20–30% on audit days compared to separate audits. A certification body auditing both standards together avoids duplicating assessment of shared clauses. For a 25-person company, that might mean 6–8 combined audit days instead of 4–5 for ISO 9001 plus 5–7 for ISO 27001 separately.

The documentation effort is also lower. Instead of maintaining two sets of document control procedures, two internal audit programmes, two management review processes, and two corrective action workflows, you maintain one of each. The time saved compounds year after year through surveillance audits and recertification cycles.

Implementation sequence

Most businesses implement one standard first, then extend to the second. The typical sequence:

1. Implement your primary standard first. Choose based on the sector guidance above — whichever your customers are asking for most urgently.
2. Build the management system backbone properly. Document control, internal audit, management review, and corrective action procedures should be designed to accommodate multiple standards from the start, even if you are only certifying to one initially.
3. Add the second standard. With the backbone in place, you focus only on the standard-specific requirements: quality processes for ISO 9001, or risk assessment and Annex A controls for ISO 27001.
4. Certify to both. Either through a combined initial audit or by adding the second standard at your next surveillance or recertification audit.

If you already hold ISO 9001, the audit checklist covers what auditors assess during certification — and much of that framework transfers directly to ISO 27001 preparation.

How Certification Works for Each Standard

The certification process follows the same pattern for both standards, because UKAS applies the same accreditation framework (ISO 17021-1) to all management system certification bodies.

Stage 1 Audit (Document Review)

The auditor reviews your documented management system: policies, scope, risk assessment, procedures, records. They confirm you are ready for the Stage 2 audit and identify any significant gaps. Typically 1 day for ISO 9001, 1–2 days for ISO 27001 (the Statement of Applicability and risk assessment add review time).

Stage 2 Audit (Implementation Audit)

The auditor assesses your system in practice: interviewing staff, reviewing records, observing processes, testing controls. For ISO 9001, this focuses on process effectiveness and customer-related outcomes. For ISO 27001, it includes testing security controls — access management, incident response, backup and recovery, supplier security. Typically 2–3 days for ISO 9001, 3–5 days for ISO 27001 (Annex A controls add scope).

Surveillance and Recertification

Both standards follow a three-year certification cycle: initial certification, then annual surveillance audits, then recertification in year four. Surveillance audits sample different areas each year. Recertification covers the full scope again.

Decision Framework: Which Standard Do You Need?

Work through these questions in order. They should give you a clear answer within five minutes.

1. Have customers or tenders explicitly asked for a specific standard? If yes, that is your answer. Customer requirements override general guidance. If they asked for ISO 9001, start there. If ISO 27001, start there. If both, plan an integrated approach.

2. Does your business handle sensitive client data, personal data at scale, or connect to client IT systems? If yes, ISO 27001 should be on your roadmap. The volume and sensitivity of data you handle determines urgency.

3. Is your primary deliverable a physical product, a constructed asset, or a non-data-intensive service? If yes, ISO 9001 is likely your first priority. Quality of output is what your customers are evaluating.

4. Are you in IT services, software, managed services, or data processing? If yes, plan for both. Your market increasingly expects both quality and security certification. Start with whichever your most important customer is asking for.

5. Are you bidding on UK public sector contracts? Check the specific framework requirements. Many require ISO 9001. Some — particularly in digital, technology, and data services — require ISO 27001 or equivalent. Defence and national security contracts may require both.

6. Do you have budget and bandwidth for one standard or two? If budget is constrained, start with the standard your market demands most urgently. Build the management system backbone to accommodate the second standard later. You do not need to implement both simultaneously.

If ISO 27001 is the one you need first, ISO 27001 compliance for small businesses sets out the five-step route from scope definition to certification audit.

Practical Checklist Before You Start

Whether you choose ISO 9001, ISO 27001, or both, these steps apply:

1. Check what your customers actually require. Read the tender documents, supplier questionnaires, and contract clauses. "ISO certified" is not specific enough — confirm which standard they mean.
2. Run a readiness assessment. The ISO 9001 readiness quiz gives you a quick baseline score for quality management. For ISO 27001, start with a gap analysis against the 93 Annex A controls to see where you stand.
3. Estimate costs. Use the ISO 9001 cost estimator to model quality certification costs. For ISO 27001, the certification cost guide breaks down the numbers.
4. Choose a UKAS-accredited certification body. Get at least three quotes. Prices for the same scope can differ substantially between bodies. Use the UKAS directory to find accredited bodies.
5. Decide: sequential or simultaneous. If you need both, decide whether to implement them in sequence (less resource pressure, slower) or in parallel (faster, more intensive). Most SMBs with 5–50 employees prefer sequential implementation with an integrated backbone.
6. Allow realistic timelines. ISO 9001 from scratch: 3–9 months. ISO 27001 from scratch: 4–12 months. Both together: 6–14 months with an integrated approach.

Key Takeaways

1. ISO 9001 covers quality management — how you deliver consistent products and services. ISO 27001 covers information security — how you protect data and systems. They address different risks.
2. Both follow the Annex SL structure: shared clauses for context, leadership, planning, support, performance evaluation, and improvement. Running both is appreciably less effort than running them independently — on this site's own estimate, roughly 40% of the second system's work is already done by the first.
3. Your sector and customer requirements determine which you need. Manufacturing and construction typically need ISO 9001 first. IT services and data processors typically need ISO 27001 first. MSPs, SaaS companies, and data-intensive service firms usually need both.
4. Total first-year cost for a UK SMB: £5,000–£15,000 for ISO 9001, £8,000–£25,000 for ISO 27001. Integrated audits save 20–30% on audit days.
5. If you need both, build one integrated management system — not two separate ones. Design the backbone to accommodate multiple standards from day one.
6. Start with whichever standard your customers are asking for. Add the second when budget and bandwidth allow.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This is the full 2026 breakdown, covering every cost category a UK SMB will face on the road to ISO 27001 certification.

Why ISO 27001 Costs More Than ISO 9001

Before the numbers, it helps to understand why the price tag is higher. ISO 9001 is a process-focused standard. ISO 27001 is a controls-focused standard. That distinction drives cost at every stage:

• More audit days. An ISO 27001 certification audit typically requires 1–2 more auditor days than an equivalent ISO 9001 audit, because the auditor must assess your Statement of Applicability, test control implementation, and review your risk treatment plan.
• 93 Annex A controls. Each control must be assessed, implemented or justified as not applicable, and documented in the Statement of Applicability. That is a significant documentation effort before the auditor arrives.
• Mandatory risk assessment. ISO 27001 requires a formal information security risk assessment methodology — not a generic risk register, but a structured approach to identifying, analysing, and treating information security risks.
• Penetration testing. While ISO 27001 does not explicitly require pen testing, most certification bodies expect to see recent test results as evidence that technical controls are working. Skipping it is a risk most businesses cannot afford.
• Specialist knowledge. Information security consultancy commands higher day rates than quality management consultancy, because the skill set is more specialised.

If you have already been through ISO 9001 certification, you will recognise the structure. The management system clauses (4–10) overlap significantly. But the Annex A controls, risk assessment, and technical evidence requirements add layers that ISO 9001 simply does not have.

The Six ISO 27001 Certification Cost Categories

1. Certification Body Fees

This is the fee you pay to a UKAS-accredited certification body (CB) to conduct your Stage 1 and Stage 2 audits. UKAS — the United Kingdom Accreditation Service (ukas.com) — accredits certification bodies operating in the UK. Using a UKAS-accredited CB matters: many procurement frameworks, government contracts, and client due diligence processes specifically require UKAS accreditation.

ISO 27001 certification body fees are higher than ISO 9001 because the audit scope is broader. The Stage 1 audit (documentation review) focuses on your ISMS scope, risk assessment methodology, Statement of Applicability, and risk treatment plan. The Stage 2 audit (on-site or remote assessment) tests control implementation across every applicable Annex A control.

Typical UKAS-accredited certification body fees for UK SMBs:

These figures are this site's own planning estimates; UK certification bodies quote per scope and do not publish standard rate cards. Your actual quote depends on scope complexity, number of sites, and the maturity of your ISMS. Companies with complex IT environments or multiple locations will sit at the higher end.

Get at least three CB quotes. Prices for the same scope vary by 30–40% between accredited bodies. The UKAS directory lists all accredited certification bodies for ISO 27001.

2. Consultancy Costs

Information security consultancy is the biggest variable in ISO 27001 certification cost. You can do everything yourself, hire a consultant for the full implementation, or pick specific areas where you need help.

Typical UK consultancy costs for ISO 27001:

ISO 27001 consultant day rates in the UK typically run £600–£1,400, higher than ISO 9001 rates because the work requires information security expertise rather than general quality management knowledge. London rates sit at the upper end.

You can reduce consultancy costs by doing preparation work yourself. Start with a gap analysis against all 93 Annex A controls and the management system clauses. If your team has someone with information security experience, they can handle much of the risk assessment and policy drafting. A consultant who arrives to a well-prepared organisation might need 8–12 days rather than 20+.

For organisations also pursuing ISO 9001, there is significant overlap in the management system clauses. If you have an existing QMS, your consultant can build on that foundation rather than starting from scratch. Our ISO 9001 cost estimator can help you model the quality management side if you are running both standards.

3. Internal Staff Time

This is the cost most businesses undercount. Someone — usually a combination of IT and management — needs to:

• Conduct the information security risk assessment
• Write or update information security policies (typically 15–25 policies)
• Create the Statement of Applicability, documenting decisions on all 93 Annex A controls
• Implement technical and organisational controls
• Set up evidence collection and record-keeping processes
• Conduct a management review
• Run an internal audit
• Train staff on information security awareness
• Manage corrective actions from internal audits

For a typical 20–30 person UK SMB, expect the person leading implementation to spend 3–5 days per week on it for 3–6 months. That is 150–300 hours of internal effort.

If that person earns £40,000–£55,000 per year, the internal cost of their time is roughly £3,000–£5,000. For smaller businesses where the founder or a senior manager handles it alongside their normal role, the cash cost may be lower but the opportunity cost is real. Those are hours not spent on revenue-generating work.

The documentation workload is heavier than ISO 9001. Where an ISO 9001 quality manual might be a single document with supporting procedures, ISO 27001 requires a risk assessment report, risk treatment plan, Statement of Applicability, and individual policies for areas like access control, cryptography, supplier relationships, and incident management.

4. Penetration Testing

Penetration testing sits in its own category because it is a significant cost that ISO 9001 does not require. While ISO 27001 does not contain the words "penetration test," Annex A control A.8.8 (Technical vulnerability management) requires organisations to identify and address technical vulnerabilities. In practice, most UKAS-accredited auditors expect to see a recent penetration test report as evidence.

Typical penetration testing costs for UK SMBs:

Most small businesses need at minimum an external infrastructure test and a web application test if they run customer-facing software. Budget £2,000–£5,000 for initial testing, depending on your footprint.

Penetration testing is also an ongoing cost. Annual retesting is standard practice, and your surveillance auditor will want to see current results. Some businesses reduce the scope in subsequent years if the environment has not changed significantly.

5. Tools, Training, and Miscellaneous

These individual items are modest but add up:

• Copy of the standard: budget around £138 from BSI — BSI does not publish a price to visitors who are not signed in, so treat that as this site's own estimate and check it at the point of purchase. Buy against BSI's own designation rather than ISO's, and rather than an older PDF someone already has on file: BSI's standard document page for BS EN ISO/IEC 27001 records the current release as BS EN ISO/IEC 27001:2023+A1:2024, and lists BS EN ISO/IEC 27001:2023 and BS EN ISO/IEC 27001:2017 as historical versions. BSI Knowledge lists other documents as their own separate products: BS ISO/IEC 27001:2022 — a BSI designation, which BSI describes as "the UK implementation of ISO/IEC 27001" and "identical to ISO/IEC 27001:2022", published 31 Dec 2022 — and the standalone ISO-published amendment ISO/IEC 27001:2022/Amd 1:2024, published 23 Feb 2024. Check which document a listing actually covers before you buy. If you are also working with ISO 9001, that is another standard to buy — ISO 9001:2026 published on 16 September 2026 and supersedes the 2015 edition over a transition period ending 30 September 2029, so check which edition you need (see our ISO 9001:2026 revision guide).
• Information security awareness training: ISO 27001 requires all staff to receive awareness training. Budget £500–£1,500 for initial training across a 20–30 person company, depending on whether you use an online platform or in-person sessions.
• Security tooling: You may need to invest in or formalise tools for vulnerability scanning, endpoint protection, SIEM, or backup monitoring. Many SMBs already have these in place but need to document and evidence them. Budget £0–£2,000 depending on gaps.
• Document management: Some businesses invest in an ISMS platform for policy management, risk registers, and audit tracking. Costs range from free (spreadsheets and shared drives) to £100–£400/month for dedicated platforms.
• Internal auditor training: ISO 27001 internal auditor courses typically run £400–£800 per person for a two-day course.

6. Surveillance Audits and Ongoing Annual Costs

Certification is a three-year cycle, not a one-off:

• Year 1: Initial certification (Stage 1 + Stage 2)
• Year 2: Surveillance audit 1 (typically 2–3 days)
• Year 3: Surveillance audit 2 (typically 2–3 days)
• Year 4: Recertification audit (similar to initial, 4–6 days)

Surveillance audit fees for a 10–50 employee company typically run £2,000–£3,500 per year. That is higher than ISO 9001 surveillance costs because the auditor needs time to sample Annex A controls and review your risk treatment plan updates.

Annual ongoing costs beyond CB fees:

Budget £5,000–£12,000 per year to maintain ISO 27001 certification. This catches businesses out — they plan for year one but not years two and three.

Total First-Year ISO 27001 Certification Cost UK: Summary

Most UK SMBs with 10–50 employees, using some consultancy support, land between £12,000 and £18,000 in year one.

These cost figures and ranges are this site's own estimates, last reviewed February 2026. They are not drawn from, or checked against, any published rate card — certification bodies, information security consultancies and penetration testing firms all quote per scope, and BSI does not publish a price for the standard itself to visitors who are not signed in. Actual costs vary by scope, complexity, and provider. Get quotes for your specific situation.

For comparison, ISO 9001 certification typically costs £5,000–£15,000 for the same size of business. The difference is driven by the additional audit days, penetration testing, and the specialist consultancy that ISO 27001 demands.

How to Reduce ISO 27001 Certification Cost

Get multiple CB quotes. This is the single easiest saving. Three quotes from UKAS-accredited bodies will show you the range. Do not assume the most expensive CB is the most thorough — accreditation ensures a baseline standard.

Do your gap analysis first. Before engaging a consultant, work through the 93 Annex A controls and the management system clauses yourself. Identify what you already have in place. A consultant who receives a completed gap analysis needs fewer days than one starting with a blank sheet.

Build on existing management systems. If you already hold ISO 9001, your management system clauses (context of the organisation, leadership, planning, support, operation, performance evaluation, improvement) are largely done. The integration saves both consultancy and audit time. Our ISO 9001 gap analysis checklist covers the management system foundation that both standards share. Budget for the ISO 9001:2026 transition cost in the same plan if your 9001 certificate is still on the 2015 edition — an integrated audit is the cheapest place to absorb it.

Start with your biggest risks. Not all 93 controls require the same level of effort. Focus implementation time on controls that address your most significant risks. The Statement of Applicability lets you justify proportionate implementation — a 15-person consultancy does not need the same access control infrastructure as a bank.

Use the right level of documentation. ISO 27001 requires documented information for specific items (risk assessment, Statement of Applicability, policies, procedures for key controls). It does not require a 200-page manual. Write what is necessary, not what looks impressive. If you have been through the DIY ISO 9001 route, you already know the principle: document what you do, do what you document.

Bundle penetration testing with ongoing contracts. Many penetration testing firms offer discounted rates for annual retesting agreements. Negotiate the year-one and year-two tests together.

Use tools to reduce manual effort. For the ISO 9001 side of an integrated system, the readiness quiz gives you a baseline assessment in under five minutes.

ISO 27001 vs ISO 9001 Certification Cost: Quick Comparison

If you are considering both standards, an integrated audit typically saves 20–30% on CB fees compared with two separate audits.

Practical Checklist: Before You Spend Money

Use this checklist to avoid overspending on ISO 27001 certification:

1. Define your scope. A narrower scope means fewer audit days and fewer controls to implement. Certify the part of your business that handles information security-sensitive work, not necessarily the entire company.
2. Get three CB quotes. Compare UKAS-accredited bodies. Ask for a breakdown of audit days, not just a total price.
3. Run a gap analysis. Work through the 93 Annex A controls and Clauses 4–10 before engaging a consultant. Know what you already have.
4. Assess your risk. Conduct a basic risk assessment before consulting. Even a rough version clarifies where your biggest gaps are.
5. Budget for penetration testing. Get quotes early. If you have never had a pen test, expect findings that need remediation before your Stage 2 audit.
6. Plan for ongoing costs. Year one is the biggest outlay, but budget £5,000–£12,000 per year for surveillance audits, pen testing, and tooling.
7. Check for management system overlap. If you already hold ISO 9001, quantify what carries across. The management system clauses are nearly identical.
8. Model your costs. Use the ISO 9001 cost estimator for the quality management side if you are running an integrated system.

If you are still deciding whether ISO 27001 is worth starting at all, ISO 27001 compliance for small businesses covers where to start and what the first three months actually involve.

Key Takeaways

1. Total first-year ISO 27001 certification cost for a UK SMB typically ranges from £8,000 (small scope, experienced team) to £25,000 (larger scope, full consultancy support). Most land £12,000–£18,000.
2. Certification body fees run £3,500–£8,000 for initial certification, depending on company size and scope complexity.
3. Consultancy is the biggest variable: £3,000–£12,000 depending on how much preparation you do yourself.
4. Penetration testing adds £2,000–£5,000 that ISO 9001 does not require.
5. Ongoing annual costs of £5,000–£12,000 catch businesses out. Budget for surveillance audits, annual pen testing, and security tooling from day one.
6. If you also hold or plan to pursue ISO 9001, an integrated approach saves 20–30% on audit fees. See our ISO 9001 cost breakdown for the full comparison.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide covers what ISO 9001 actually requires from small businesses, where the standard is deliberately proportionate, and how to keep your QMS lean enough that people use it. If you want the procedure rather than the principles, the nine-step certification process runs from gap analysis to certificate.

Why ISO 9001 Certification Matters for Small Businesses

The most common sectors for small business ISO 9001 certification in the UK are manufacturing, construction, and IT services. The reasons are practical, not aspirational:

Tender requirements. UK public sector tenders frequently require ISO 9001 certification. Construction companies bidding for principal contractor work, IT services firms tendering for government contracts, and manufacturers supplying to larger OEMs all encounter this. Without the certificate, you don't get past the PQQ stage.

Customer expectations. Larger customers increasingly flow down quality management requirements to their supply chain. A 15-person precision engineering firm supplying automotive components will face ISO 9001 as a condition of doing business — not because they chose it.

Operational improvement. This gets dismissed as marketing, but it's real. A structured approach to managing customer complaints, controlling supplier quality, and reviewing business performance produces measurable results. The discipline of ISO 9001 forces you to do things many small businesses know they should do but never get round to: recording what went wrong, working out why, and preventing it from happening again.

Insurance and liability. Some professional indemnity and product liability insurers offer reduced premiums for ISO 9001-certified organisations. The reduction varies, but it reflects the lower risk profile of businesses with formal quality controls.

The Proportionality Principle: What "Appropriate to the Size" Actually Means

ISO 9001 does not prescribe a fixed set of documents or a specific system structure. It sets requirements — things your QMS must achieve — and leaves the method to you. This is deliberate, and it's the single most misunderstood aspect of the standard.

Here's what proportionality looks like in practice:

Documented information. ISO 9001 mandates certain documented items: quality policy, quality objectives, scope, and specific records throughout Clauses 4–10. Beyond those, you decide. A 20-person company typically needs 15–30 documents in total — a quality manual, a handful of procedures, some forms and templates, and operational records. Not the 200+ document sets that consultants sometimes produce for enterprise clients.

Process complexity. A 15-person manufacturer might have 8–12 core processes. A 30-person IT services company might have 6–10. You don't need sub-processes, process hierarchies, or SIPOC diagrams for every activity. A one-page process map showing how your main business processes connect is sufficient for most small businesses — and it's what auditors actually want to see.

Risk management. Clause 6.1 requires risk-based thinking, not a formal risk management framework. For a small business, this can be a single spreadsheet listing key risks to quality, their likelihood and impact, and what you're doing about them. You don't need bow-tie diagrams, Monte Carlo simulations, or dedicated risk management software.

Internal audit. You need an internal audit programme (Clause 9.2), but the standard doesn't prescribe how many audits or how long they take. A 20-person company can audit its entire QMS in 2–3 days per year. Compare that to the 20+ audit days a large organisation might schedule.

ISO 9001 for Small Business: What Each Clause Area Actually Requires

Here's a clause-by-clause breakdown of what a proportionate QMS looks like for a UK small business. This is what passes a UKAS-accredited certification audit — not the enterprise version.

Clause 4 — Context and Scope

What's needed: A documented scope statement (one paragraph to half a page), a list of interested parties and their requirements (one page), and an analysis of internal and external issues affecting your QMS (one to two pages). Update annually at management review.

What's not needed: A PESTLE analysis with 50 factors. A stakeholder mapping exercise. Quarterly context reviews. For a 20-person business, your context is straightforward: your customers, your regulators, your competitors, and your staff. Write it in plain English.

Clause 5 — Leadership

What's needed: A quality policy signed by the managing director (one page), defined responsibilities for quality (usually covered in job descriptions or a simple responsibility matrix), and evidence that top management is involved in the QMS — attending management reviews, making resource decisions, communicating the policy.

What's not needed: A separate leadership committee. Formal communication cascades. In a 15-person business, the MD probably walks past every employee on the way to the kettle. Communication happens naturally. Just make sure there's evidence of it.

Clause 6 — Planning

What's needed: Quality objectives that are measurable and tracked (3–6 objectives is typical for a small business), a risk register or risk log (a single spreadsheet works), and evidence that you plan changes before making them.

What's not needed: Separate risk and opportunity registers. Strategic planning frameworks. A change management procedure with approval workflows. If your MD decides to add a new service line, a brief documented plan showing what changes to the QMS are needed is sufficient.

Clause 7 — Support

What's needed: Training records showing staff competence for their roles, a method for controlling documents and records (version numbering, a shared drive structure, and a basic document register), and evidence that your infrastructure and work environment are adequate.

What's not needed: A formal competence framework with skills matrices for every role. Dedicated document management software. Your existing HR records and a well-organised shared drive meet the requirement for most small businesses.

Clause 8 — Operation

This is the largest clause and the most variable, because it depends on what your business does.

For a 15-person manufacturer: Customer order review process, production planning, work instructions for key processes, inspection and testing records, supplier evaluation and approved supplier list, control of nonconforming product, and (if applicable) design and development procedures. Expect 8–12 documents in this clause area alone.

For a 30-person IT services company: Service requirements capture, project or service delivery procedures, supplier and subcontractor management, service acceptance criteria, and handling of service failures. Clause 8.3 (Design and Development) may be excluded if you deliver to customer specifications rather than designing products. Expect 5–8 documents.

The difference matters. A consultant who gives both companies the same documentation package is over-serving one and under-serving the other.

Clause 9 — Performance Evaluation

What's needed: A method for monitoring customer satisfaction (this can be as simple as tracking complaints and repeat business — you don't need an annual survey programme), an internal audit schedule and records, and management review meeting minutes with specific required inputs and outputs per Clause 9.3.

What's not needed: A balanced scorecard. Customer satisfaction software. Monthly KPI dashboards. Monitor the metrics that matter to your business and review them at management review. For most small businesses, quarterly or six-monthly management reviews are more practical than monthly ones.

Clause 10 — Improvement

What's needed: A process for recording nonconformities, determining root causes, and implementing corrective actions. Evidence that you actually learn from problems — not just log them.

What's not needed: A separate continual improvement procedure. Six Sigma. Lean methodologies. If your corrective action process works and you can show auditors that problems get fixed and stay fixed, you meet the requirement.

Common Myths About ISO 9001 and Small Businesses

"ISO 9001 is only for big companies"

It isn't. We are not putting a number on how many certificates small firms hold, because we cannot source one: ISO publishes an annual ISO Survey, but we have not been able to retrieve the underlying dataset, and the figures secondary sources quote from it do not agree with each other. What is not in doubt is the design intent — the standard's requirements are written in terms of your processes rather than your headcount, so it scales down. The problem is that most guidance doesn't.

"You need a full-time quality manager"

You don't. ISO 9001 requires someone to have responsibility for the QMS, but it doesn't require a dedicated role. In a 10-person company, this is often the operations manager or the MD. In a 30-person company, it might be a part-time quality coordinator who spends one or two days a week on QMS activities. What matters is that the person has authority, competence, and time — not that "Quality Manager" is their job title.

"You need hundreds of documents"

The mandatory documented information in ISO 9001 amounts to roughly 20 specific items (policies, procedures, and records) across Clauses 4–10. Everything else is your choice. A well-implemented QMS for a 20-person company typically runs to 15–30 documents total. If someone tells you that you need 200+ documents, they're building a system for a different sized organisation.

"The audit takes weeks"

Audit duration is set under a mandatory accreditation document — Global ACI-TECH-3-004 (M), the reissue of IAF MD 5 that took effect on 28 August 2026 after the International Accreditation Forum ceased operations on 1 January 2026 — which starts from your effective number of personnel and is then adjusted for complexity. Its Table QMS 1 gives a combined Stage 1 + Stage 2 starting point of 1.5–5 auditor days for 1–65 personnel. A 20-person manufacturer with a single site starts at 3 days across both visits — say a 1-day Stage 1 and a 2-day Stage 2. Annual surveillance is derived from that total rather than tabled separately, at "about 1/3 of the audit time spent on the initial certification audit", and the document adds that it is "unlikely that a surveillance audit duration will be less than one (1) audit day".

"It's all bureaucracy, no benefit"

If your QMS is just bureaucracy, it's been implemented badly. A proportionate system should make your business easier to run, not harder. The companies that get value from ISO 9001 are the ones that use it as a management tool — tracking quality performance, managing suppliers properly, learning from problems — rather than treating it as paperwork to satisfy an auditor.

What Certification Actually Costs a Small Business

Total first-year certification cost for a UK small business with 10–50 employees typically falls between £5,000 and £15,000. That range depends on how much external help you use. Here's how it breaks down:

Ongoing costs are lower: surveillance audits run £1,200–£2,500 per year, plus internal time to maintain the system. For a detailed estimate based on your company size and scope, use the ISO 9001 cost estimator. The full breakdown of every cost category is in our certification cost guide.

Two Examples: What Proportionate Looks Like in Practice

A 15-Person Precision Manufacturer

This company machines components for aerospace and automotive customers. They have one site, one production process (CNC machining), and 15 staff including 2 in the office and 13 on the shop floor.

Their QMS includes:

• Quality manual (18 pages)
• 6 procedures: document control, internal audit, corrective action, purchasing and supplier evaluation, inspection and testing, control of nonconforming product
• Work instructions for 4 key machining processes
• Quality policy (1 page)
• 5 quality objectives tracked monthly
• Risk register (1 spreadsheet, 12 risks)
• Approved supplier list with evaluation criteria
• Calibration schedule for measuring equipment
• Management review minutes (quarterly, using a standard agenda template)
• Internal audit records (full system audited annually over 3 days)

Total document count: 22 documents. Certification audit: 3 days (1-day Stage 1 + 2-day Stage 2). Annual surveillance: 1 day. Clause 8.3 (Design and Development) is excluded because they manufacture to customer drawings.

A 30-Person IT Services Company

This company provides managed IT services and cloud migration projects to mid-market UK businesses. They have one main office and 8 staff who work remotely. 30 employees total.

Their QMS includes:

• Quality manual (15 pages)
• 5 procedures: document control, internal audit, corrective action, supplier and subcontractor management, service delivery
• Service level agreement template
• Project delivery checklist
• Quality policy (1 page)
• 4 quality objectives tracked quarterly
• Risk register (1 spreadsheet, 15 risks)
• Customer satisfaction tracking (complaint log plus annual review of repeat business data)
• Management review minutes (six-monthly)
• Internal audit records (full system audited annually over 2 days)

Total document count: 18 documents. Certification audit: 3–4 days (1-day Stage 1 + 2–3 day Stage 2). Annual surveillance: 1–2 days. Clause 8.3 is included because they design technical solutions. Clause 7.1.5 (Monitoring and Measuring Resources) has limited applicability — no physical calibration, but they do validate software tools used for service monitoring.

Both companies passed their certification audits. Neither needed 200 documents.

How to Get Started Without Over-Building

If you're a UK small business considering ISO 9001, here's the sequence that avoids the enterprise trap:

1. Assess where you stand. The ISO 9001 readiness quiz gives you a baseline score across all major clause areas in under 5 minutes. This tells you how far you are from certification — and where your gaps are.

2. Run a structured gap analysis. Work through Clauses 4–10 systematically using our gap analysis checklist. Score each requirement against what you actually do today. This becomes your implementation project plan.

3. Build only what you need. Start with mandatory documented information, then add procedures and records only where your processes genuinely need them. If you already track jobs in a spreadsheet, that spreadsheet can be part of your QMS. The quality manual template guide shows you how to structure the core document in 15–25 pages.

4. Decide on your implementation approach. You can self-implement, use targeted consultant support, or go full consultancy. Our guide on the DIY certification route covers the honest pros and cons of each approach.

5. Operate before you audit. Run your QMS for at least 2–3 months before booking a certification body. You need evidence of the system working — management review minutes, internal audit records, corrective action evidence, customer satisfaction data.

6. Choose a UKAS-accredited certification body. Get at least three quotes. Check the UKAS directory to find accredited bodies. Prices for the same scope can differ substantially between bodies.

7. Consider the 2026 revision timing. The ISO 9001:2026 revision published on 16 September 2026. If you don't need certification urgently, building your QMS against the new edition avoids transitioning later. Use the clause comparison tool to see what changed.

Practical Takeaway Checklist

1. ISO 9001 is proportionate by design. Clause 1 says your QMS should match the size and complexity of your organisation. Hold every implementation decision against that test.
2. A 20-person company typically needs 15–30 documents total. If you're building more, ask why.
3. Certification audit duration for 1–65 personnel starts at 1.5–5 auditor days for Stage 1 and Stage 2 combined (Table QMS 1, Global ACI-TECH-3-004 (M), the current reissue of IAF MD 5). It is not a weeks-long exercise.
4. Total first-year cost for a UK SMB is typically £5,000–£15,000, including certification body fees and some consultancy support.
5. You don't need a full-time quality manager. You need someone with responsibility, authority, and protected time.
6. Build your QMS around what you actually do. Document real processes, not aspirational ones. If the manual says you do something and you don't, that's a nonconformity.
7. Start with a readiness assessment and a gap analysis before spending money on consultants or certification bodies.
8. Plan your project with a realistic certification timeline — for most UK SMBs, 6–9 months from gap analysis to first certification is achievable.
9. Keep it lean. A small business QMS that people actually use beats an enterprise QMS that gathers dust every time.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Certification audits happen in two stages. Stage 1 is a document review. Stage 2 is the implementation audit where the auditor verifies your QMS works in practice. Both stages matter, and failing to prepare for either wastes audit days at £800–£1,200 per day.

How the certification audit works (and what it costs you)

Your UKAS-accredited certification body follows a structure defined by ISO/IEC 17021-1, and determines how long the audit takes under a separate mandatory accreditation document. That document was IAF MD 5 for years; the International Accreditation Forum "ceased operations on 01 January 2026" (per its own legacy site) and the text has been reissued by Global Accreditation Cooperation Incorporated as Global ACI-TECH-3-004 (M), in force since 28 August 2026 and carrying MD 5's text "without any substantive change". It gives a starting point for audit time based on your effective number of personnel, which the body then adjusts for complexity.

Stage 1 — documentation review

The auditor reviews your documented QMS, confirms the scope is appropriate, checks you have the mandatory documented information, and assesses whether you are ready for Stage 2. This typically takes 0.5–1 day for a company with fewer than 50 employees, and is the smaller share of the total audit time tabled below. It can be conducted on-site or remotely, though most certification bodies prefer at least a partial site visit.

Stage 1 is not a formality. If the auditor identifies significant gaps — missing procedures, no evidence of an internal audit, no management review — they will not schedule Stage 2 until you fix them. That delay costs you weeks and potentially another audit day fee.

Stage 2 — implementation audit

This is the main event. The auditor spends time on-site, interviews staff at all levels, reviews records, and observes processes.

Audit time is tabled for the two stages together, not for Stage 2 on its own. Table QMS 1 of Global ACI-TECH-3-004 (M) — "Relationship between Effective Number of Personnel and Audit Time (Initial Audit only)" — gives the combined Stage 1 + Stage 2 starting point:

Two things about that table matter when you read a quotation. It is a starting point rather than a floor: clause 4.2 says the tables "provide a starting point for estimating the audit time of an initial audit (Stage 1 + Stage 2)", and the floors it states are percentages rather than day counts. Clause 2.1.2 says duration "should typically not be less than 80% of the audit time calculated following the methodology in Section 3", and clause 4.1 adds a second: audit time for combined offsite activities "should not reduce the total on-site duration of management systems audits to less than 80% of the audit time calculated from the tables", with planning or report-writing time expressly not a justification for reducing on-site duration. And the split between the two visits is your body's to set, with one steer — "Normal practice is that time spent for Stage 2 exceeds time spent for Stage 1" — so Stage 2 is normally the larger share of the total rather than a fixed number of days. Multi-site operations, complex supply chains, or design activities can increase the time. Your certification body will confirm the exact duration, and its basis, in their quotation.

Stage 2 must happen within six months of Stage 1 completing. If you wait longer, you repeat Stage 1.

ISO 9001 audit checklist: Stage 1 document readiness

Stage 1 focuses on documented information. The auditor is answering one question: has this organisation built a QMS that covers the standard's requirements on paper?

Prepare these items before the Stage 1 auditor arrives:

QMS scope and boundaries

• Documented QMS scope statement (Clause 4.3), naming your products/services, sites, and any clause exclusions with justification
• Organisation chart showing quality responsibilities

Quality policy and objectives

• Signed quality policy (Clause 5.2) — current, dated, and communicated to staff
• Quality objectives (Clause 6.2) — measurable, with targets, owners, timeframes, and tracking method
• Evidence that objectives are being monitored (even one data point helps)

Process documentation

• Process map or interaction diagram showing how your key processes relate (Clause 4.4)
• Documented procedures for the processes within your scope — these do not need to be 20-page documents; a one-page flowchart with controls and responsibilities is often sufficient
• Document control procedure (Clause 7.5) — how documents are approved, reviewed, updated, and distributed

Mandatory documented information ISO 9001 explicitly requires documented information for specific items. The auditor will check these exist:

• Context analysis — internal and external issues (Clause 4.1)
• Interested parties and their requirements (Clause 4.2)
• Risk and opportunity register (Clause 6.1)
• Competence records — training, qualifications, experience (Clause 7.2)
• Monitoring and measuring equipment records, if applicable (Clause 7.1.5)
• Operational planning and control criteria (Clause 8.1)
• Design and development records, if Clause 8.3 is in scope
• Supplier evaluation records (Clause 8.4)
• Product/service release criteria and traceability records (Clauses 8.5, 8.6)
• Nonconforming output records (Clause 8.7)
• Internal audit programme, reports, and findings (Clause 9.2)
• Management review minutes with all required inputs and outputs (Clause 9.3)
• Corrective action records (Clause 10.2)

Internal audit and management review

• At least one complete internal audit cycle covering all QMS processes
• At least one management review conducted with minutes covering all inputs required by Clause 9.3.2
• Corrective actions raised from internal audit findings, with evidence of closure

If you do not have a quality manual pulling these documents together, the quality manual template guide covers what to include and how to structure it.

ISO 9001 audit checklist: Stage 2 evidence by clause area

Stage 2 is where the auditor tests whether your documented QMS works in practice. They will sample records, interview staff, and observe activities. Below is a clause-by-clause ISO 9001 audit checklist of the evidence they typically request.

Clause 4 — Context of the organisation

• Can you explain your external and internal issues and how they influence QMS decisions?
• Can you name your interested parties and their specific requirements (not vague categories)?
• Does your scope match the work you actually deliver? The auditor may check recent contracts against your scope statement.

Common finding: scope statements that are too broad ("all engineering services") or too narrow (excluding processes the business clearly performs). Be precise.

Clause 5 — Leadership

• Can the managing director or senior leader describe how they are involved in the QMS — not just that they signed the policy?
• Is there evidence of resource decisions linked to quality objectives (budget approvals, training spend, equipment purchases)?
• Do staff know the quality policy exists and can they explain what it means for their role?

The auditor will likely interview the MD directly. Prepare them. "I leave quality to our quality manager" is a problem — Clause 5.1 requires top management to demonstrate leadership and commitment personally.

Clause 6 — Planning

• Risk register with likelihood/impact assessments and treatment actions — dated and reviewed
• Quality objectives with measurement data (not just targets, but actual performance against those targets)
• Evidence that planned changes to the QMS were managed — if you changed a process in the last six months, show the before, after, and reasoning

Clause 7 — Support

• Training records and competence evidence for staff performing QMS-relevant work (not just attendance certificates — evidence that training achieved its objective)
• Calibration certificates or verification records for measuring equipment, if applicable
• Evidence that staff are aware of the quality policy, objectives, and their contribution to the QMS
• Document control: the auditor will pick a random procedure and verify it is the current version and accessible to the people who need it

Clause 8 — Operation

This is where the auditor spends the most time. Expect them to:

• Select 2–3 recent jobs, orders, or projects and trace them from customer enquiry through to delivery
• Check that customer requirements were captured and confirmed before work started (Clause 8.2)
• Review supplier evaluation records and verify your approved supplier list is current (Clause 8.4)
• Examine product/service release records — who authorised the release and against what criteria (Clause 8.6)
• Ask to see nonconforming output records and the dispositions applied (Clause 8.7)
• If design is in scope (Clause 8.3): review a recent design from inputs through verification and validation

Clause 8 generates more nonconformities than any other section in UK certification audits. Have your operational records organised and accessible.

Clause 9 — Performance evaluation

• Customer satisfaction data — surveys, complaint trends, repeat business metrics, NPS scores — with analysis showing what you learned and what you did about it
• Internal audit reports with findings classified and corrective actions tracked to closure
• Management review minutes covering all inputs per Clause 9.3.2: audit results, customer feedback, process performance, nonconformity and corrective action status, monitoring and measurement results, external provider performance, resource adequacy, risk/opportunity actions, and improvement opportunities
• Management review outputs per Clause 9.3.3: decisions made, resources needed, improvement actions

Clause 10 — Improvement

• At least 2–3 completed corrective action records showing: the nonconformity, containment action, root cause analysis, corrective action, and effectiveness verification
• Evidence of continual improvement — this can be process changes, efficiency gains, updated procedures based on lessons learned, or measurable quality improvements
• Records showing that corrections go beyond fixing the immediate symptom ("we re-did the work") to addressing systemic causes ("we revised the briefing process and retrained the team")

Auditors check the audit programme itself as well as the reports it produced — see the ISO 9001 audit schedule template for what a credible annual programme contains.

What happens if you get a nonconformity

Auditors classify findings into three categories:

Minor nonconformity: A single lapse or isolated failure that does not break the system. Example: one supplier on your approved list without a current evaluation. You can still get certified with minor nonconformities open, provided you submit a corrective action plan that the auditor accepts. You typically get 90 days to close minors before your next surveillance audit.

Major nonconformity: A systemic failure or complete absence of a required element. Example: no internal audit programme, no management review conducted, or a documented procedure that nobody follows. A major nonconformity means the auditor cannot recommend certification until it is resolved.

You get a 28-day window to close a major nonconformity. Closure requires submitting evidence to the auditor that:

1. The root cause has been identified
2. Corrective action has been taken
3. The action is effective

If the major is significant enough, the certification body may require a follow-up audit visit to verify closure — at an additional cost of £800–£1,200 per day. If you cannot close the major within the window, the audit fails and you start again.

Opportunity for improvement (OFI): An observation, not a finding. The auditor notes something that works but could be better. No action is required, though addressing OFIs demonstrates commitment to continual improvement.

Most first-time certification audits result in a few minor nonconformities. That is normal. Zero findings is unusual and sometimes means the auditor was not thorough enough. The goal is no majors.

Every nonconformity needs a formal record, not an email. The ISO 9001 non conformance report template covers containment, root cause, and the closure evidence auditors ask for.

Choosing your certification body

Your certification body must be accredited by UKAS (the United Kingdom Accreditation Service) for ISO 9001 certification. This is non-negotiable for most procurement purposes — many public sector tenders and supply chain requirements specify UKAS accreditation explicitly.

To find accredited bodies, search the UKAS directory. Filter by "management systems certification" and ISO 9001. There is a fuller guide to choosing an ISO 9001 certification body, including what the 2026 transition changes about the decision.

When comparing quotations:

• Get at least three quotes. Certification body fees for the same scope can differ substantially between bodies. Our certification cost breakdown covers the full fee structure.
• Check the proposed audit duration against Global ACI-TECH-3-004 (M). Table QMS 1 above is the starting point for both stages combined; the document's own floor is clause 2.1.2's rule that duration "should typically not be less than 80% of the audit time calculated following the methodology in Section 3". A quote materially below that is a shorter audit rather than a better price. Clause 4.4 also entitles you to the figures: "The CAB shall provide the audit time determination and the justification to the client organisation as part of the contract and make it available to its Accreditation Body." Ask for both. Under-auditing is a UKAS compliance issue and could affect your certificate's credibility.
• Ask about auditor sector experience. A certification body may be UKAS-accredited but assign an auditor with no experience in your industry. Ask whether your assigned auditor has audited similar businesses.
• Confirm what happens if you get a major. Some CBs include one follow-up visit in their fee. Others charge separately. Know this before you sign.

Most Stage 2 findings trace back to a small set of avoidable errors — the expensive mistakes UK SMBs make during ISO 9001 certification covers the ones that most often cost time and money.

The week before your audit: final preparation

With your audit date confirmed, use this final-week checklist:

1. Confirm logistics. The auditor needs a quiet room, access to relevant areas, and access to staff. Block out interview time in people's diaries.
2. Brief all staff. Everyone should know an external audit is happening, what an auditor might ask them, and that honesty matters more than perfection. Coach people to answer what they actually do, not what they think the auditor wants to hear.
3. Run a quick document check. Verify every controlled document is at the current revision. Remove or archive obsolete versions from shared drives, notice boards, and workshop areas.
4. Review corrective action status. Every corrective action raised in internal audits should be closed or have a documented plan. Open corrective actions with no progress signal a broken improvement process.
5. Check your records are retrievable. The auditor will ask for specific records — a recent customer complaint, a training record, a supplier evaluation. Know where they are and confirm you can retrieve them within minutes, not hours.
6. Review management review minutes. Ensure the most recent management review covers all required inputs. If your last review was more than 12 months ago, consider holding one before the audit.
7. Walk the site. Look at what the auditor will see. Outdated quality posters, unmarked chemicals, equipment with expired calibration stickers — these are easy wins to fix before the audit and easy findings if you don't.

If you are unsure whether you are ready, the ISO 9001 readiness quiz gives you a clause-by-clause QMS assessment in under five minutes. For businesses going through certification for the first time without consultant support, the DIY certification guide covers the full process from start to finish.

Two things make the final week easier. The ISO 9001 Audit Readiness Checker walks through every Stage 1 document and Stage 2 evidence item and flags what is still outstanding. And a free audit schedule template gives you a programme document to plan the year and track findings.

Practical takeaway checklist

Print this. Work through it before your Stage 1 date.

• QMS scope documented, accurate, and matching your actual work
• Quality policy signed, dated, and communicated
• Quality objectives measurable, tracked, and showing real data
• Risk register completed and reviewed
• All mandatory documented information in place per the Stage 1 checklist above
• At least one full internal audit cycle completed with findings and corrective actions
• Management review held within the last 12 months with all required inputs and outputs
• Corrective actions showing root cause analysis, not just symptom fixes
• Operational records organised and retrievable for 2–3 sample projects
• Supplier evaluations current for active suppliers
• Staff briefed on the audit and prepared for interviews
• Certification body confirmed as UKAS-accredited, with audit dates and logistics agreed
• Budget confirmed: Stage 1 + Stage 2 fees, plus contingency for a follow-up visit if needed

Get these right and you walk into your certification audit with evidence rather than anxiety. The auditor is checking whether your QMS works — not whether it is perfect. Demonstrate that you know your system, use it daily, and improve it when things go wrong, and the certificate follows.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. Audit-time figures are quoted from Table QMS 1 of Global ACI-TECH-3-004 (M), issue 1.0, which states it carries IAF MD 5:2023's text "without any substantive change"; that table covers Stage 1 and Stage 2 combined, and how the total is split between the two visits is set by your certification body. Day rates and budget figures are this site's own estimates, not published prices. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Most UK SMBs get the quality manual wrong. They produce 80-page documents nobody reads, or thin summaries that leave auditors asking questions for hours. This ISO 9001 quality manual template gives you a practical structure with detail on what UKAS-accredited auditors actually check.

Does ISO 9001 require a quality manual?

Strictly speaking, no. ISO 9001:2015 removed the explicit requirement that existed in the 2008 edition. Clause 7.5 requires "documented information" but does not prescribe a manual format.

In practice, every UKAS-accredited auditor expects one. Without it, they search through scattered documents, which extends your audit days and cost. A typical Stage 1 audit for a 10-50 person company is around a day on this site's own estimate. The mandatory accreditation document (Global ACI-TECH-3-004 (M), the current reissue of IAF MD 5) tables audit time for Stage 1 and Stage 2 combined rather than for Stage 1 alone — 2 days in total for 6-10 personnel, rising to 3 for 16-25 and 5 for 46-65 — and notes that "Normal practice is that time spent for Stage 2 exceeds time spent for Stage 1." So at the small end of that range a two-day Stage 1 would leave nothing for Stage 2, which is why the estimate here is a day rather than two. A well-organised manual keeps you at the lower end.

Write one. Keep it between 15 and 25 pages. Treat it as a working document.

ISO 9001 quality manual template: 8 sections

1. QMS scope and exclusions (Clause 4.3)

List your products/services by name, every site where the QMS applies, and any clause exclusions with justification. The most common exclusion is Clause 8.3 (Design and Development) for businesses manufacturing to customer specifications.

Auditors check: Is the scope realistic and consistent with what you deliver? Are exclusions justified?

2. Normative references

One paragraph referencing ISO 9001:2015 (or the 2026 revision) and ISO 9000:2015 for vocabulary. Auditors rarely spend time here.

3. Context of the organisation (Clause 4)

Document external issues (regulations, market conditions — reference specific legislation like the Building Safety Act 2022 or UK GDPR where relevant), internal issues (staff capability, infrastructure), interested parties, and their requirements.

Auditors check: Is this specific to your business? "Our key customers require 48-hour turnaround on quotations" passes. "Customer requirements are met" does not.

4. Quality policy (Clause 5.2)

One page from top management. Must include commitments to meeting requirements and continual improvement. Avoid generic statements. "We deliver structural engineering reports with zero calculation errors, reviewed by a chartered engineer before release, within 10 working days" is useful. "We are committed to excellence" is not.

Auditors check: Can the MD explain it? Can a site worker describe what it means for their work?

If you have not drafted a policy yet, the free ISO 9001 Quality Policy Generator produces a first draft tailored to your sector and objectives.

5. Quality objectives (Clause 6.2)

Each objective needs: what will be achieved, how measured, resources required, who is responsible, and a deadline. Example: "Reduce complaint rate from 4.1% to below 2.5% by December 2026, measured monthly."

Auditors check: Are they measurable? Is there tracking data? Objectives unchanged for two years suggest the system is inactive.

6. Roles, responsibilities, and authorities (Clause 5.3)

Define top management, quality manager, process owners, and all staff responsibilities. Use a RACI chart for teams above 20 people.

Auditors check: Do staff know their QMS responsibilities? Is the quality manager given authority to act?

7. Process map and interactions (Clause 4.4)

This is the section auditors value most and SMBs under-invest in. Map customer-facing processes (enquiry to delivery), support processes (purchasing, HR, maintenance), and management processes (audit, review, corrective action).

Use a one-page interaction diagram showing inputs, outputs, and connections. For each process, identify the owner, applicable clauses, records generated, and KPIs.

Auditors check: Do documented processes match reality? Can staff explain how their process connects to others?

8. Reference to supporting procedures

Do not embed every procedure. Reference them: internal audit (Clause 9.2), management review (Clause 9.3), corrective action (Clause 10.2), control of nonconforming outputs (Clause 8.7), document control (Clause 7.5). The manual provides the map; procedures provide the detail.

Where a procedure needs step-level detail, that detail belongs in a work instruction rather than the manual — see the ISO 9001 work instruction template guide.

What auditors actually focus on

UKAS auditors spend most quality manual review time on four things:

1. Scope and exclusions — accurate and justified?
2. Process interactions — does the business understand how processes connect?
3. Consistency with practice — does the manual match what employees do?
4. Management involvement — is top management engaged?

They spend minimal time on formatting or length. A 15-page manual passes the same audit as a 60-page one — usually faster.

Common over-documentation mistakes

Copying ISO clauses verbatim. Describe what your business does, not the standard's requirements. Auditors can read ISO 9001 themselves.

Documenting aspirational processes. If the manual says you hold monthly data analysis meetings but you never have, that is a nonconformity. Only document what you do.

Including every work instruction. Work instructions belong in a separate library. The manual describes what; instructions describe how.

Neglecting version control. A manual last reviewed in 2023 raises questions at a 2026 audit. Review annually, aligned with your management review (Clause 9.3).

Practical takeaway checklist

1. Use the 8-section structure above as your template
2. Keep each section to 1-3 pages (15-25 pages total)
3. Write in plain English — not ISO jargon
4. Include a one-page process interaction diagram
5. Reference supporting procedures rather than embedding them
6. Have someone outside the quality function read it — if they cannot understand your QMS, rewrite
7. Set a review date and record who approved each version

If you are preparing for the ISO 9001:2026 revision, your manual structure will need updating. Use the clause comparison tool to see what moved. For a quick readiness assessment, try the ISO 9001 readiness quiz. And if you have not done a structured gap analysis yet, start with our ISO 9001 gap analysis checklist.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

Here's an honest look at the DIY route — what it actually requires, where it goes wrong, and when it genuinely works.

When DIY ISO 9001 Works

The businesses that successfully self-implement ISO 9001 tend to share certain characteristics:

Someone on the team has quality or compliance experience. This doesn't mean a full-time quality manager. An operations manager who previously worked in a certified organisation, or someone who's been an internal auditor, counts. They already understand the language and logic of management system standards.

The business is relatively simple. A 12-person IT services company with one office and one service line is a simpler certification than a 40-person manufacturer with three product lines, a supply chain, calibrated equipment, and design processes. More complexity means more clauses to address in depth — particularly Clause 8 (Operation).

There's no urgent deadline. DIY takes longer. Allow 6–12 months for a first-time implementation without consultant support, compared to 3–6 months with a consultant. If you need the certificate for a tender due in four months, DIY isn't realistic.

The team is engaged. ISO 9001 isn't a quality manager project — it's a business-wide system. If leadership and staff actively participate, you can self-implement. If the quality manager is working in isolation while everyone else ignores the QMS, you'll produce documents nobody follows.

What You Actually Need to Know

ISO 9001 is a 30-page standard, but implementing it requires understanding several concepts that aren't obvious from reading the text:

Process approach. You need to map your business as a set of interrelated processes, each with defined inputs, outputs, controls, and resources. This is Clause 4.4, and it's the foundation of everything else.

Risk-based thinking. Clause 6.1 requires you to identify risks and opportunities that could affect the QMS. You don't need a formal risk management framework (that's ISO 31000), but you do need to show you've thought about what could go wrong and what you're doing about it.

Documented information. ISO 9001 specifies certain items that must be documented (quality policy, quality objectives, scope, plus various records throughout the standard). Beyond those, you decide what's needed. The common DIY mistake is documenting everything — producing hundreds of pages that nobody reads or follows.

Internal auditing. Clause 9.2 requires an internal audit programme. Someone in your organisation needs to audit the QMS. They can't audit their own work. In a 10-person company, this means at least two people need basic audit skills. A one-day internal auditor course (£200–£400 per person through CQI, BSI, or other training providers) is a worthwhile investment even on the DIY route.

Management review. Clause 9.3 defines specific inputs and outputs for management review meetings. This isn't a general team meeting with "quality" on the agenda. It has required content: audit results, customer feedback, process performance data, risk status, and improvement actions. Many DIY implementations get this wrong by treating it too casually.

Where DIY ISO 9001 Goes Wrong

Based on common nonconformity data from UKAS-accredited certification bodies, these are the areas where self-implemented QMS systems most frequently fail at Stage 2 audit:

Clause 7.1.5 — Monitoring and Measuring Resources

If your business uses any equipment that measures something — scales, thermometers, pressure gauges, even software that produces measurements — you need to demonstrate those resources are suitable and maintained. For physical equipment, this usually means calibration against traceable standards. Many DIY implementers don't realise this clause applies to them until the auditor asks about it.

Clause 8.4 — Control of Externally Provided Processes, Products, and Services

Supplier management trips up small businesses regularly. You need to define criteria for evaluating, selecting, and monitoring suppliers. A simple approved supplier list with evaluation criteria is usually sufficient — but you need it, and you need evidence of it being applied.

The ISO 9001:2026 revision strengthens these requirements further, so getting supplier management right now will pay off when you transition.

Clause 6.2 — Quality Objectives

"Improve quality" is not a quality objective. "Reduce warranty returns from 3.2% to below 2% by December 2026" is. Objectives must be measurable, monitored, communicated, and updated. Many self-implemented systems have vague objectives that auditors can't verify.

Clause 10.2 — Nonconformity and Corrective Action

You need a defined process for handling nonconformities (things that go wrong), determining root causes, and implementing corrective actions. The key word is "root cause." Fixing the symptom without addressing why it happened will get flagged. Auditors check whether your corrective actions actually prevent recurrence, not just whether you logged them.

Clause 4.1 and 4.2 — Context and Interested Parties

These clauses feel abstract, which is why DIY implementers often treat them as a tick-box exercise. But auditors expect you to explain how your external and internal context influences your QMS decisions. A one-page context analysis that nobody references is a red flag. The Clause 4.1 and 4.2 climate change determination is the part most DIY implementers miss outright.

The Real Cost of DIY

Skipping the consultant saves money on fees but costs time. Here's what the numbers look like:

Every figure in that table is this site's own estimate rather than a published price. UK certification bodies and consultancies quote per scope and publish no rate card, and BSI does not publish a price for the standard to visitors who are not signed in — check that one at the point of purchase, via BSI's standard document page for BS EN ISO 9001.

The internal time figure is the critical one. 200–400 hours is 5–10 weeks of full-time work, spread over 6–12 months. If the person doing this work has other responsibilities (they almost certainly do), the implementation stretches. Projects that stretch tend to stall.

For a more specific estimate based on your company, use the ISO 9001 cost estimator.

The Middle Ground: Targeted Consultant Support

Most UK SMBs that succeed without full consultancy support don't go fully DIY. They use targeted help:

Gap analysis only. Pay a consultant for a 1–2 day gap analysis (£800–£2,000), then close the gaps yourself. You get expert eyes on your system without paying for full implementation. Our gap analysis guide explains what this involves.

Documentation review. Do the writing yourself, then pay a consultant 1–2 days to review your documentation before the certification audit. This catches structural errors and missing requirements that you might not spot.

Pre-audit (mock audit). Some consultants offer a pre-audit service: they audit your system as if they were the certification body, identifying nonconformities before the real audit. This costs £500–£1,500 and significantly reduces the risk of failing Stage 2.

This hybrid approach typically costs £1,500–£4,000 in consultancy fees — a fraction of full support — while covering the areas where DIY implementations most commonly fail.

Tooling sits between full DIY and paid support: a documentation tool does the structuring work a consultant would charge for, without the day rate. The criteria for choosing an ISO 9001 documentation tool covers what separates a useful one from an expensive template pack.

How to Start the DIY Route

If you decide to self-implement, here's the sequence:

1. Buy the standard. You can't implement what you haven't read. If you're starting fresh, buy ISO 9001:2026 rather than the 2015 edition — it published on 16 September 2026, and certifying to it directly avoids a transition later. The full step-by-step certification process sets out what follows.

2. Take the readiness quiz. Our ISO 9001 readiness quiz gives you a baseline assessment in under 5 minutes. It tells you which clause areas you're strongest and weakest in.

3. Run a gap analysis. Work through every clause systematically. Follow the step-by-step checklist.

4. Build your documentation. Start with the mandatory items: quality policy, scope, quality objectives, and the documented procedures and records the standard requires. Add supporting documentation only where your processes genuinely need it.

5. Implement and operate. Run your QMS for at least 2–3 months before booking your certification audit. You need evidence of the system working — records of management reviews, internal audits, corrective actions, monitoring data.

6. Conduct your internal audit. Audit the entire QMS. Record findings. Raise corrective actions for any gaps.

7. Book your Stage 1. Contact UKAS-accredited certification bodies (check the UKAS directory) and get quotes. The cost breakdown explains what to expect.

Key Takeaways

1. DIY ISO 9001 certification is possible. UK SMBs do it successfully, particularly those with some quality experience on the team and a straightforward business scope.
2. It takes significantly more internal time: 200–400 hours versus 80–150 hours with consultant support. That time has a real cost.
3. The most common failure points are Clause 8.4 (supplier management), Clause 7.1.5 (monitoring and measuring resources), and Clause 6.2 (quality objectives). Focus your preparation on these areas.
4. The smart middle ground is targeted consultant support — gap analysis, documentation review, or a pre-audit — rather than full implementation or fully DIY.
5. Whatever route you choose, start with a readiness assessment and a structured gap analysis to understand where you stand before spending money.
6. Still deciding whether certification is worth it? Read what UK businesses actually gain from ISO 9001 for a clear-eyed look at real-world benefits.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This is the full breakdown for 2026, covering every cost category a UK SMB will encounter.

The Five Cost Categories

ISO 9001 certification cost breaks down into five categories. Some are fixed. Some you can control. All of them are real.

1. Certification Body Fees

This is the fee you pay to a UKAS-accredited certification body (CB) to conduct your audits. UKAS — the United Kingdom Accreditation Service (ukas.com) — accredits certification bodies operating in the UK. Using a UKAS-accredited CB matters: many procurement frameworks and customer contracts specify UKAS accreditation.

Certification body fees depend on your organisation's size (measured by employee count) and complexity (number of sites, scope of operations). The fees cover:

• Stage 1 audit (document review): Typically 1 day for a company with fewer than 25 employees. The auditor reviews your documented QMS, checks scope, and confirms you're ready for Stage 2.
• Stage 2 audit (certification audit): Typically 2–3 days for companies with 10–50 employees. The auditor assesses your QMS in practice — interviewing staff, reviewing records, observing processes.

Typical UKAS-accredited certification body fees for SMBs:

These figures are this site's own planning estimates. UK certification bodies do not publish standard rate cards — fees are quoted per scope — so there is no published schedule to check them against. Treat them as a budgeting range, not a price, and get your actual quote from the bodies you shortlist.

2. Annual Surveillance Audits

Certification isn't a one-off. After your initial certification, you'll have surveillance audits — typically annually — to maintain your certificate. The three-year certification cycle looks like this:

• Year 1: Initial certification (Stage 1 + Stage 2)
• Year 2: Surveillance audit 1 (usually 1–2 days)
• Year 3: Surveillance audit 2 (usually 1–2 days)
• Year 4: Recertification audit (similar scope to initial, 2–3 days)

Surveillance audit costs for a company with 10–25 employees typically run £1,200–£2,500 per year. Recertification in Year 4 costs £2,500–£4,500.

Over a three-year cycle, budget roughly £7,000–£12,000 in certification body fees for a 25-person company. That's £2,300–£4,000 per year.

3. Consultancy Costs

This is the biggest variable. Some businesses do everything themselves. Others hire a consultant for the full implementation. Most land somewhere in between.

Typical UK consultancy rates for ISO 9001:

Consultant day rates in the UK range from £500 to £1,200, depending on experience and location. London-based consultants sit at the upper end.

You can reduce consultancy costs by doing preparation work yourself — particularly the gap analysis and initial documentation drafting. A consultant who arrives to a well-prepared organisation needs fewer days than one starting from scratch.

For a detailed estimate based on your specific situation, try our ISO 9001 cost estimator.

4. Documentation and Implementation Time

This is the cost most businesses underestimate: your own staff time. Someone needs to:

• Write or update procedures, policies, and work instructions
• Set up records and forms
• Conduct a management review
• Run an internal audit programme
• Train staff on new or updated processes
• Manage the corrective actions that come out of audits

For a typical 20-person UK SMB, expect the quality manager (or whoever owns the QMS) to spend 2–4 days per week on implementation during the initial 3–6 month setup period. That's 100–200 hours of internal effort.

If that person earns £35,000–£45,000 per year, the internal cost of their time on ISO 9001 implementation is roughly £2,500–£5,000. This isn't an additional expense — it's existing salary — but it's time they're not spending on other work.

Documentation is also the cost line most affected by tooling. If you are weighing a documentation tool against a template pack or a consultant, the criteria that matter are set out in what to look for in an ISO 9001 documentation tool.

5. Hidden and Ongoing Costs

These catch people out:

• Copy of the standard: budget around £138 from BSI. BSI does not publish a price to visitors who are not signed in, so that is this site's own estimate rather than a quoted price — check it at the point of purchase, via BSI's standard document page for BS EN ISO 9001, which links to the BSI Knowledge and BSOL storefronts. You need at least one copy, and BS EN ISO 9001:2026 is now the current UK release, so budget for the edition your certificate will name (see the 2026 revision guide).
• Training: Beyond internal auditor training, you may need to train staff on specific procedures. Budget £500–£1,500 for initial training across the business.
• Calibration: If you use measuring equipment (scales, gauges, test equipment), ISO 9001 requires it to be calibrated or verified. Calibration costs vary: £50–£200 per instrument through a UKAS-accredited calibration lab.
• Software and tools: Some businesses invest in QMS software for document control, audit management, and corrective action tracking. Costs range from free (spreadsheets and shared drives) to £100–£500/month for dedicated platforms.
• Travel and expenses: If your certification body's nearest auditor is far from your site, you may be charged travel expenses on top of audit fees. Ask upfront.
• Nonconformity closure: If your certification audit identifies major nonconformities, you may need an additional audit visit (at additional cost) to verify closure before the certificate is issued.

Most of the hidden cost above is avoidable. The expensive mistakes UK SMBs make during ISO 9001 certification covers the five that most often turn a £6,000 project into a £12,000 one.

Total First-Year Cost: Summary Table

Most UK SMBs with 10–50 employees, using some consultancy support, land between £7,000 and £15,000 in Year 1.

These cost figures and ranges are this site's own estimates, last reviewed February 2026. They are not drawn from, or checked against, any published rate card: UK certification bodies and ISO consultancies quote per scope and do not publish standard fees, and BSI does not publish a price for the standard itself to visitors who are not signed in. Actual costs vary by scope, location, and provider. Get written quotes for your specific situation.

If you already hold ISO 9001:2015, the figures above are the first-time-certification picture — see what the 2026 transition adds on top of a certificate you already pay for.

How to Reduce ISO 9001 Certification Cost

Get multiple CB quotes. Quotes from different UKAS-accredited bodies for the same scope can differ substantially, mostly because they allocate different numbers of audit days. Get at least three quotes and compare quotes by audit day rather than by headline price. Check the UKAS directory to find accredited CBs.

Do preparation work yourself. The more you do before engaging a consultant, the fewer days you'll need. Start with a gap analysis and get your basic documentation in order.

Don't over-document. More documents means more consultant time, more review time, and more to maintain. ISO 9001 requires specific documented information — but it doesn't require a procedure for everything. A 15-person company doesn't need the same documentation as a 500-person manufacturer.

Combine with other standards. If you also need ISO 14001 (environmental) or ISO 27001 (information security), an integrated audit saves certification body days. Auditing two standards together typically costs 20–30% less than auditing them separately.

Time it around your financial year. Certification body fees are often invoiced in stages. Align your certification timeline so that Stage 1 falls in one financial year and Stage 2 in the next, if cash flow is tight.

Key Takeaways

1. Total first-year ISO 9001 certification cost for a UK SMB typically ranges from £5,000 (fully DIY, small company) to £15,000+ (consultant-supported, larger scope).
2. Certification body fees are the most predictable cost: £2,000–£7,000 for initial certification, depending on company size.
3. Consultancy is the biggest variable: £0 if you do it yourself, up to £15,000 for full implementation support.
4. Don't forget ongoing costs: surveillance audits (£1,200–£2,500/year), recertification every three years, and the upcoming transition to the 2026 revision.
5. Use the ISO 9001 cost estimator to model costs for your specific situation.
6. Get at least three certification body quotes — prices vary significantly.
7. Planning your project? See our ISO 9001 certification timeline guide for a realistic week-by-week breakdown.
8. Weighing up the investment? Our benefits of ISO 9001 certification guide covers what UK businesses actually gain.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This guide walks you through a 7-step gap analysis process, referencing ISO 9001:2015 clause numbers. If you are preparing for the ISO 9001:2026 revision, the same approach applies — but map against the 2026 edition's own clause numbering, which UKAS confirms has been restructured.

What Is an ISO 9001 Gap Analysis?

A gap analysis compares what ISO 9001 requires against what your organisation currently does. The output is a list of gaps — requirements you don't yet meet — ranked by severity and effort to close.

It's not an audit. You're not issuing nonconformities. You're creating a project plan.

Before You Start

Gather these before you begin:

• A copy of the standard. ISO 9001:2026 published on 16 September 2026 and ISO 9001:2015 remains valid until the transition deadline of 30 September 2029, so which one you need depends on which edition your certificate names — see the ISO 9001:2026 revision guide. Both are available from the BSI Shop — budget around £138 for a single copy, though BSI does not publish a price to visitors who are not signed in, so check it at the point of purchase.
• Your existing quality documentation: quality manual (if you have one), procedures, work instructions, forms, records.
• Access to the people who actually do the work. A gap analysis done entirely at a desk, by one person, is unreliable.

The 7-Step ISO 9001 Gap Analysis Checklist

Step 1: Map Your Existing Processes

Before you open the standard, document what you actually do. Map your core business processes from order to delivery (or enquiry to completion, depending on your business). Include:

• Who does what
• What records are created
• What checks or approvals happen
• Where handoffs occur between teams or individuals

This gives you a baseline. Many UK SMBs discover they already follow sensible processes — they just haven't written them down.

Step 2: Work Through Clauses 4–10 Systematically

Go clause by clause. For each requirement, ask three questions:

1. Do we do this? (Yes / Partly / No)
2. Can we prove it? (Is there a record, document, or evidence?)
3. Is it consistent? (Does it happen every time, or only when someone remembers?)

Here's what to look for in each clause:

Clause 4 — Context of the organisation

• Have you identified external issues (market conditions, regulations, customer expectations) and internal issues (staff capability, infrastructure, culture) that affect your QMS?
• Have you identified interested parties (customers, regulators, suppliers, staff) and their requirements?
• Is your QMS scope defined and documented?

Clause 5 — Leadership

• Is there a documented quality policy? Does top management actually reference it in decisions?
• Are quality responsibilities assigned to specific people?
• Does top management participate in management reviews (not just sign off)?

Clause 6 — Planning

• Have you identified risks and opportunities related to your QMS?
• Do you have measurable quality objectives? ("Improve quality" doesn't count — "reduce customer complaints by 15% by Q4" does.)
• When you make changes to the QMS, do you plan the change before implementing it?

Clause 7 — Support

• Are resources adequate? (People, infrastructure, work environment, monitoring and measuring equipment.)
• Is staff competence assessed and recorded? (Training records, qualifications, performance evidence.)
• Is documented information controlled? (Version control, access control, retention.)

Clause 8 — Operation

• Are your operational processes planned and controlled?
• How do you handle customer requirements? (Contract review, order confirmation, change management.)
• How do you control externally provided products/services? (Supplier evaluation, incoming inspection, ongoing monitoring.)
• Do you have criteria for product/service release? Who authorises it?

Clause 9 — Performance evaluation

• Do you monitor customer satisfaction? (Surveys, complaint data, repeat business rates — anything measurable.)
• Do you conduct internal audits? (Planned programme, trained auditors, recorded results.)
• Does top management conduct management reviews at defined intervals? (Minimum annually, though quarterly or six-monthly is more practical for SMBs.)

Clause 10 — Improvement

• Do you have a process for handling nonconformities and corrective actions?
• Can you show evidence of continual improvement? (Not just fixing problems — actually making things better.)

Step 3: Score Each Requirement

Use a simple scoring system. A three-point scale works:

This gives you a heatmap of your compliance. Anything scoring 0 is a major gap. Anything scoring 1 needs tightening.

Step 4: Prioritise Your Gaps

Not all gaps are equal. Prioritise based on:

• Audit risk: Clauses 8 (Operation) and 9 (Performance evaluation) generate the most nonconformities in Stage 2 audits, according to data published by UKAS-accredited certification bodies. Fix these first.
• Business impact: A gap in your customer complaints process (Clause 10) affects customer retention. A missing document header template (Clause 7) doesn't.
• Effort to close: Some gaps need a new process. Others just need you to write down what you already do.

Step 5: Assign Ownership and Deadlines

For each gap, assign:

• Who will close it
• By when
• What "done" looks like (specific deliverable: a documented procedure, a completed training record, a populated risk register)

Gaps without owners don't get closed. This is where most DIY certification attempts stall — everything is identified, nothing is assigned.

Step 6: Close the Gaps

Do the work. Write the procedures. Conduct the training. Set up the records. Run a management review. Start your internal audit programme.

Two practical points:

• Don't over-document. ISO 9001 requires documented information for specific items (quality policy, quality objectives, scope, and others listed in the standard). Beyond those mandatory items, document only what's needed for your processes to run consistently. A 10-person company doesn't need 200 pages of procedures.
• Use your existing systems. If you track jobs in a spreadsheet, that spreadsheet can be part of your QMS. You don't need specialist software on day one.

Step 7: Verify With an Internal Audit

Before you spend money on a certification body, audit yourself. Conduct a full internal audit against ISO 9001 using your gap analysis as a guide. This catches remaining gaps, tests your documented processes, and gives you audit evidence for Clause 9.

Your internal auditor should be someone who wasn't directly responsible for creating the processes they're auditing. In a small company, this can be tricky — consider swapping: the operations manager audits the sales process, and vice versa.

Not sure where you stand right now? Our ISO 9001 readiness quiz gives you a quick assessment across all major clause areas in under 5 minutes.

Common Mistakes in ISO 9001 Gap Analyses

Doing it alone. The quality manager writes the gap analysis in isolation, without talking to the people who run the processes. The result looks good on paper but doesn't reflect reality.

Treating it as a one-off. Your gap analysis should be a living document. Update it after internal audits, management reviews, and any significant business change.

Ignoring Clause 4. Context of the organisation sounds abstract, but auditors check it. If you can't articulate your external and internal issues and how they affect your QMS, expect a nonconformity.

Focusing on documents over processes. ISO 9001 is a process standard, not a documentation standard. The gap analysis should assess whether your processes work, not just whether you have paperwork.

Key Takeaways

1. A gap analysis is your project plan for ISO 9001 certification. Do it before engaging a certification body.
2. Work through Clauses 4–10 systematically, scoring each requirement against what you actually do today.
3. Prioritise gaps by audit risk and business impact — not by clause number.
4. Assign every gap an owner and a deadline. Gaps without owners stay open.
5. Verify your work with an internal audit before booking your Stage 1 assessment.
6. Take the ISO 9001 readiness quiz for a quick snapshot of where you stand.
7. Pursuing ISO 27001 alongside or instead? See our ISO 27001 gap analysis guide for the information-security equivalent of this checklist.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.

This post covers exactly what changed, what stayed the same, and what you need to do — clause by clause — to stay compliant.

Background: Why ISO 9001 Is Being Revised

ISO standards follow a systematic review cycle. ISO Technical Committee 176, Sub-Committee 2 (ISO/TC 176/SC 2) — the group responsible for ISO 9001 — conducts a formal review every five years. The 2015 edition was reviewed in 2020, and the committee voted to begin a revision rather than simply reconfirm the existing text.

That decision wasn't arbitrary. Feedback gathered during the review highlighted several issues:

• The 2015 edition's "risk-based thinking" concept was too vague for many organisations to implement consistently.
• The standard didn't adequately address digital transformation, remote working, or data-driven decision-making — all of which have accelerated since 2020.
• Clause structure needed alignment with the updated Annex SL (the harmonised structure shared by all ISO management system standards), which was itself amended in February 2024 when ISO incorporated two climate-change statements into it — the IAF/ISO joint communiqué of 22 February 2024 records that the changes "will be incorporated into the new text of the Harmonized Structure (Appendix 2 of the Annex SL in the ISO/IEC Directives Part 1 Consolidated ISO Supplement)" and that "The amendments to the standards will be published on February 23rd 2024."
• Auditors and certified organisations reported confusion around documented information requirements — specifically, what needed to be documented versus what was optional.

The revision process followed ISO's standard stages: working drafts, a Committee Draft (CD), and then the Draft International Standard. ISO/TC 176/SC 2 announced on 10 September 2025 that ISO 9001 "has now reached the Enquiry Stage" and that "[t]he Draft International Standard (DIS) has been released for ballot", with the ballot closing 19 November 2025. The Final Draft International Standard (FDIS) was approved in August 2026, and the sixth edition published on 16 September 2026.

What the ISO 9001:2026 Revision Is Reported to Change

Where this section comes from. ISO 9001:2026 published on 16 September 2026, but its text is a paywalled document we have not seen and do not reproduce. The clause-level descriptions below are drawn from publicly available commentary written before publication, not from ISO's own wording, and are not a citable statement of what the standard requires.

⚠️ Treat the clause numbers below as unverified. UKAS's technical bulletin confirms that the majority of changes relate to "clarification of existing requirements, restructuring of clauses, harmonisation with Annex SL and current ISO drafting conventions". Because the clauses have been restructured, we cannot tell you whether any given requirement still sits at the number shown here. Buy the published standard from BSI and check the numbering yourself before you cite a clause to an auditor.

Clause Structure

The 2015 edition has 10 clauses, and commentary on the revision indicates the core management system clauses (4 through 10) remain, with changes to their internal organisation rather than to the overall shape.

The points below summarise what commentary reports about each clause. None of them is a statement of what ISO 9001:2026 requires — the text is paywalled and we have not seen it, and UKAS confirms the clauses have been restructured. Treat them as a list of areas to watch, and re-check every one against the published standard:

• Clause 4 (Context of the organisation) — commentary reports a more explicit link between external and internal issues and specific QMS processes, where the 2015 wording left this largely implicit. Separately, and already in force, the February 2024 amendment requires you to determine whether climate change is a relevant issue.
• Clause 5 (Leadership) — commentary reports expanded expectations around organisational knowledge and competence at leadership level, with a firmer line that top management cannot simply sign a quality policy and delegate the rest.
• Clause 6 (Planning) — commentary reports a more integrated planning framework, with risks, objectives and changes handled together rather than as separate activities, and more explicit expectations about risk methodology.
• Clause 7 (Support) — commentary reports added coverage of technological resources and information management, and of organisational knowledge (7.1.6). If reported accurately, businesses running their QMS on software tools or cloud systems will need to show how those are managed and maintained.
• Clause 8 (Operation) — commentary reports tighter expectations around outsourced processes and supply chain oversight: evaluating, monitoring and controlling externally provided processes, not only products and services.
• Clause 9 (Performance evaluation) — commentary reports more specific criteria for internal audit programmes and management review inputs, where the 2015 wording left more latitude.
• Clause 10 (Improvement) — commentary reports a stronger link between corrective action and organisational learning: corrections feeding back into the system to prevent recurrence across related processes, not just closing the one failure.

Annex A: Expanded Supplementary Guidance

ISO 9001:2015 already carries an informative Annex A — "Clarification of new structure, terminology and concepts", running from A.1 to A.8 — so an explanatory annex is not new to ISO 9001. Public commentary on the 2026 revision describes that annex as substantially expanded. We have not seen the published text — ISO's own text is paywalled — so neither its length nor its contents have been verified against it.

An informative annex is guidance, not additional requirements. But auditors read it and certification bodies reference it. If your implementation contradicts the annex without good reason, expect questions during your audit.

Commentary on the draft indicates the expanded annex addresses risk-based thinking proportionality, documented information, the interpretation of "externally provided processes", and organisational knowledge. Treat that as an indication of direction rather than a description of the published text.

If the expansion is as described, it may reduce confusion for UK SMBs. One of the biggest complaints about ISO 9001:2015 was its vagueness — particularly around documented information.

You can compare the old and new clause structures side by side using our ISO 9001:2026 clause comparison tool.

For a clause-by-clause breakdown of exactly what moved, what was added, and what was reworded between the two editions, see the ISO 9001:2026 vs 2015 comparison.

The Transition Timeline

The transition period is not set by ISO. It is set by the international accreditation body and applied by the national accreditation bodies — in the UK, UKAS. The International Accreditation Forum (IAF) filled that role until IAF ceased operations on 1 January 2026, the same date Global Accreditation Cooperation Incorporated (Global ACI) commenced full operations. Global ACI has assumed the former roles of IAF and ILAC.

Global ACI published the transition requirements on 16 September 2026, the same day the standard itself published, as Global ACI-TECH-3-TR 2029-09-30 (M). Global ACI states that it "has established a three-year transition period" and that "Organisations already certified to ISO 9001:2015 will have until 30 September 2029 to complete their transition." Global ACI adds that this "may take place during a scheduled surveillance or recertification audit, or through a separate transition audit" — so for most certified businesses it folds into an audit you were already going to have.

This is a published requirement, not an expectation: Global ACI's requirements "are mandatory for Global ACI Multilateral Recognition Arrangement (MRA) accreditation body signatories and their accredited certification bodies operating within the applicable scope." UKAS is one of those signatories.

Here's what that means in practice. The UK dates come from UKAS's ISO 9001:2026 technical bulletin of 16 September 2026; the international dates from Global ACI.

The practical read for a certified SMB: your certificate is safe until 30 September 2029. If you want to certify for the first time against the familiar 2015 edition, work back from 16 March 2028 — that is the date UKAS requires UK certification bodies to stop accepting new applications against the 2015 edition, so it is a cut-off on your application, not on your certificate. (Internationally, Global ACI's equivalent rule bites a fortnight later: "From 31 March 2028, new and initial accredited certifications may only be issued to ISO 9001:2026." The UK date is the one that governs a UK application.)

UKAS published its UK transition guidance the same day the standard did. It did the same for the ISO 27001:2022 transition: UKAS's technical bulletin "Transition arrangements for ISO/IEC 27001:2022" was issued "to update Certification Bodies and stakeholders on the UKAS assessment process and overall timelines for assessment against the requirements of the revised certification standard", and set out a milestone table running from "25 October 2022 Publication of ISO/IEC 27001:2022" to "31 October 2025 All CB transitions of clients completed".

BSI (the British Standards Institution — bsigroup.com) records the UK national adoption, BS EN ISO 9001:2026, as published on 30 September 2026 on its standard document page for BS EN ISO 9001, two weeks after the ISO publication date.

What Happens If You Miss the Deadline?

The deadline is set: UKAS's transition timeline lists 30 September 2029 as the date for "CABs to transition all certified customers to the revised standard". On previous transitions, once the deadline passed the outgoing certificate ceased to be valid — it was not "downgraded" or extended. If you need ISO 9001 for contract requirements — accredited certification is commonly specified in UK public sector tender requirements — losing certification means losing eligibility.

ISO 9001:2026 Changes: Impact on Currently Certified UK Businesses

If you already hold ISO 9001:2015 certification, you need a transition plan. Here's the practical breakdown.

1. Conduct a Gap Analysis

Map your current QMS documentation against the 2026 clause structure. Identify where your existing processes already meet the new requirements and where gaps exist. Most organisations will find that 60–70% of their existing system carries over — the core principles of quality management haven't changed. But the structural changes mean your documentation almost certainly needs reorganising, even where the underlying requirements are similar.

A structured gap analysis is the best starting point — work through each clause systematically and score your compliance.

2. Update Documentation

On what commentary reports, the areas most likely to need documentation work are:

• Context of the organisation (Clause 4): documented links between your context analysis and your QMS processes.
• Support — technological resources (Clause 7): how you manage the technology your QMS runs on, if you do not document that today.
• Performance evaluation (Clause 9): more specific content in internal audit programmes and management review records.

Confirm each against the published standard before you rewrite anything — this list is a planning prompt, not a requirements list.

3. Train Your Team

Anyone involved in maintaining the QMS — quality managers, process owners, internal auditors — needs to understand the new structure. This doesn't require expensive courses. BSI, UKAS-accredited training providers, and professional bodies like the Chartered Quality Institute (CQI) will all offer transition training. Budget for at least one person to attend formal transition training; that person can then cascade the knowledge internally.

4. Plan Your Transition Audit

Contact your certification body early. During the ISO 27001:2022 transition, popular audit slots filled up 6–12 months in advance, particularly with UKAS-accredited bodies. You can transition during a surveillance audit or a recertification audit, depending on your certification cycle.

Most certification bodies won't charge significantly more for a transition audit than a standard surveillance or recertification audit — but check. Some add a surcharge for the additional time needed to assess against the new standard. There is a fuller breakdown of the transition cost, including the parts of the bill that are not the audit fee.

ISO 9001:2026 Changes: Impact on Businesses Pursuing First-Time Certification

If you haven't started the certification journey yet, the revision actually works in your favour. (If you're weighing up whether to do it yourself or hire a consultant, the answer depends on your team's experience with management systems.)

Certify Directly to the 2026 Edition

The standard has published. Once certification bodies begin offering accredited assessments against it — UKAS transition decisions commence 1 January 2027 and are all to be completed by 30 September 2027 — you can certify directly to ISO 9001:2026. This means:

• No transition audit later.
• Your QMS is built to the current standard from day one.
• You avoid the cost and disruption of re-mapping documentation during a transition.

Timing Considerations

If you're planning to start certification now, you have two options:

1. Start now against ISO 9001:2015 and transition later. This makes sense if you need certification urgently — for example, to meet a tender deadline. In the UK this route stays open until 16 March 2028, when UKAS requires certification bodies to "stop accepting new applications against the previous version of the standard".
2. Certify directly against the 2026 edition. This makes sense if you don't have an immediate deadline and want to avoid doing the work twice — but note that your certification body cannot issue an accredited 2026 certificate until UKAS has granted it transition, and UKAS transition decisions only commence on 1 January 2027.

There is a timing trap in option 2. UKAS is explicit: "Until UKAS has made an accreditation decision to transition, certification issued against ISO 9001:2026 must not be represented as accredited certification." A body offering you a 2026 certificate before it has been granted transition is offering you an unaccredited one, which will not satisfy a procurement requirement.

If you're weighing the costs of either approach, our ISO 9001 cost estimator can help you model the numbers.

What Stayed the Same

Commentary is consistent that the revision is an evolution rather than a replacement. The core principles reported to carry over:

• Process approach. You still need to manage your organisation as a system of interrelated processes.
• Customer focus. Clause 5 still requires top management to ensure customer requirements are determined and met.
• PDCA cycle. Plan-Do-Check-Act remains the underlying framework.
• Risk-based thinking. This was introduced in 2015 and remains central; commentary reports better-defined expectations in the 2026 edition.
• Continual improvement. Still a fundamental requirement, with commentary reporting a stronger emphasis on organisational learning.

If your 2015 QMS is well-implemented (not just a set of documents gathering dust), you're in a stronger starting position than you might think.

UK-Specific Considerations

Public Sector Procurement

UK government procurement regularly references ISO 9001: contracting authorities commonly specify accredited quality management system certification in their tender requirements. If you supply to the public sector, maintaining valid certification through the transition is non-negotiable.

Check gov.uk/government/collections/procurement-policy-notes for current procurement policy notes relevant to your sector.

Regulatory Overlap

If you operate in a regulated sector — construction (Building Safety Act 2022), medical devices (UK MDR 2002, as amended), food (Food Safety Act 1990) — your QMS likely serves double duty. Changes to ISO 9001 clause structure may require corresponding updates to how you demonstrate regulatory compliance through your management system.

Brexit and Standards Adoption

The UK continues to adopt ISO standards through BSI. There's no divergence between the ISO publication and the UK adoption of ISO 9001. BS EN ISO 9001:2026 will be identical in requirements to ISO 9001:2026. The "EN" prefix confirms the European standard adoption route, which the UK continues to follow for management system standards.

Practical Next Steps

Here's a concrete timeline for UK businesses:

Now (the standard has published)

• Buy the published standard from the BSI Shop. This is the point at which clause numbering is final, and UKAS confirms the clauses have been restructured — so a gap analysis run against pre-publication commentary needs re-checking against the real text.
• Run a gap analysis against your current QMS.
• Identify your biggest gaps and start planning how to address them.
• Ask your certification body when it expects to be granted UKAS transition. It cannot audit you to the 2026 edition under accreditation until it is.
• If you want this sequenced week by week, there is a separate guide to the first 90 days after publication.

Late 2026 / 2027

• Finalise your documentation updates against the published text.
• UKAS is "ready to begin transition assessment activity" from 1 December 2026, and transition decisions commence on 1 January 2027. All UKAS transition decisions are to be completed by 30 September 2027.
• Contact your certification body to schedule your transition audit once it has been granted transition.
• Conduct at least one internal audit against the new standard before your certification body arrives.

2027–2029

• Complete your transition audit. Global ACI notes this "may take place during a scheduled surveillance or recertification audit, or through a separate transition audit" — so align it with an audit already in your programme rather than buying an extra one.
• Address any nonconformities identified during the transition.
• Update your certificate.

The deadline: 30 September 2029

• Global ACI-TECH-3-TR 2029-09-30 (M) sets it: organisations certified to ISO 9001:2015 "will have until 30 September 2029 to complete their transition." UKAS's own timeline matches — "30 September 2029 CABs to transition all certified customers to the revised standard". Do not leave it to the last surveillance visit; transition periods create bottlenecks.

Key Takeaways

1. ISO 9001:2026 published on 16 September 2026, and the transition deadline is confirmed: 30 September 2029. It was set the same day by Global ACI — the body that took over the roles of IAF and ILAC when IAF ceased operations on 1 January 2026 — in Global ACI-TECH-3-TR 2029-09-30 (M), and is applied in the UK by UKAS. This is a three-year period, mandatory for MRA signatories, not an inference from previous transitions.
2. The clause structure has been restructured — UKAS names "restructuring of clauses" among the majority of changes. We have not seen the published text (it is paywalled), so we cannot tell you where any specific requirement now sits. Buy the standard and map it yourself; your documentation structure will need updating.
3. Annex A is reported to be expanded in the 2026 edition. ISO 9001:2015 already has an informative Annex A, so this is a change of scale rather than something new, and how much it helps cannot be judged from outside the paywalled text.
4. If you're already certified, start your gap analysis now. Use the ISO 9001:2026 clause comparison tool to map what's changed.
5. If you're pursuing first-time certification, consider certifying directly against the 2026 edition — but check that your certification body has been granted UKAS transition first, or the certificate will not be accredited. If you want the 2015 edition instead, UK certification bodies stop accepting new applications against it on 16 March 2028.
6. Contact your certification body early to secure audit slots. Transition periods create bottlenecks.
7. Don't panic. The core principles of quality management haven't changed. This is an update, not a reinvention.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.