The most common thing we hear from a small business looking at ISO 9001 is that it feels built for companies ten times the size. The standard does not work that way, and nor should the system you build to meet it.
The standard does not scale with headcount
ISO 9001 sets out what a quality management system has to do, not how much paper it has to produce. The same clauses apply to a firm of six and a firm of six hundred. What changes is the size of the answer.
The 2015 version made this easier than most people realise. It dropped the requirement for a quality manual altogether and moved to a risk-based approach rather than a prescribed set of documented procedures. A small business that reads the standard expecting a filing cabinet is reading an older version of it.
What a small business actually has to document
Documented information is still required in specific places. Management review and internal audits are the two that catch people out, because they are activities as much as records, and a small business often does both informally without writing anything down.
That is usually the real gap. The work is being done. A director who knows every job in the building is reviewing performance constantly, and a supervisor who spots a problem and fixes it is auditing in everything but name. What is missing is the evidence that it happened.
What we look for when we assess a small business
We are looking for a system that is real and in use. A short procedure that the people doing the work actually follow is worth more than a thick manual nobody has opened since it was written, and it is a great deal easier to defend at audit.
The system that causes trouble is the one bought or copied from a much larger organisation. It describes roles that do not exist, approval steps nobody takes, and processes the business does not run. Every one of those is a finding waiting to happen, because the audit tests what you said you do against what you actually do. Write down what you actually do, and the audit becomes straightforward.
A new edition of ISO 9001 is expected in September 2026. It changes very little for a smaller organisation, and what it does change is covered in the ISO 9001 revision, what to expect.
What it costs a small business
Our fee is based on the number of days the audit takes. It is not based on your turnover and it is not based on how many people you employ, which is why a small business is not subsidising anyone else. For most small and medium organisations the audit is completed in a single day, and up to three standards can often be covered in that day.
Current prices are published in full on the certification costs page, including what is and is not included. There are no travel charges and no admin fees.
Which route suits a smaller organisation
We are an independent certification body, and much of our work is supporting clients to UKAS-accredited certification through third-party UKAS certification bodies, so we support both routes. The difference between them is explained in ISO accredited or ISO certified.
For a small business the independent route is often the proportionate one. It is usually faster and lower cost, and the audit days are not set by rules written with much larger organisations in mind. The accredited route is the right answer when a customer, a tender or a regulator specifically asks for it, and it is worth checking whether yours does before assuming.
If you are not sure what your customers are asking for, send us the wording and we will tell you what it means.