Preparing for ISO certification: a guide for UK businesses

1. Identify the standard and the business need

Begin with the customer’s requirement or the operational problem you want to address. The three standards below cover different management-system purposes. Confirm the applicable edition, amendments and any transition arrangements with your certification body before booking an audit.

Keep the required outcome specific. For example, record the tender wording and the activities it expects the certificate to cover. A request for “ISO” needs clarification before a supplier can give you a useful proposal.

2. Describe the organisation to be covered

Write down the legal entity, products or services, sites, approximate workforce and important outsourced processes. Explain how work moves from an enquiry or order to delivery and customer feedback.

Include activities carried out away from your office. A contractor’s site operations or a service company’s work at customer premises can be important to the scope discussion. Identify who makes decisions, supervises delivery and controls changes.

A one-page process map is enough for an initial conversation: show the main stages, the person responsible and the record produced. The aim is to give the consultant and certification body an accurate picture of the business.

3. Gather evidence from everyday work

Use this preparation checklist to organise what already exists. The exact evidence needed depends on the standards, scope and processes being assessed.

• Direction: current policies, business priorities, objectives and the measures used to review progress.
• People: role descriptions, training or competence records and examples of how working instructions reach the team.
• Service delivery: an enquiry, order or project followed through to completion, including checks and any changes agreed with the customer.
• Suppliers: how important suppliers and subcontractors are selected, briefed and reviewed.
• Problems and improvement: complaints, defects, incidents or other issues, with the action taken and a check on whether it worked.
• Review: available internal audit findings, management-review records and actions arising from them.
• Standard-specific information: the environmental or health and safety arrangements relevant to your activities, where those standards are in scope.

For each example, ask whether it shows a real process being used. A blank inspection form shows the proposed format; a completed record can show what was checked, what was found and who acted. Keep both clearly identified.

4. Turn gaps into a working system

Review the current arrangements against the applicable standard with someone competent to interpret it. Group gaps by process so that related actions can be completed together. Give each action an owner and a realistic completion date.

Introduce the changes with the people doing the work. For a small business, this might mean improving an existing project folder and a weekly review rather than creating a separate set of documents nobody opens. Record how the revised arrangements work and address problems as they appear.

Plan internal audit and management review as checks on the implemented system. Keep the findings, decisions and resulting actions connected. A useful readiness question is whether the team can explain the process and find the evidence without relying on one person.

The ISO 45001 overview, for example, describes auditing, review and improvement as part of the management-system approach. Preparation should lead to routines the business can maintain after the initial assessment.

5. Understand who carries out certification

ISO develops standards; it does not certify businesses. Certification is carried out by an external certification body. Consultancy helps you prepare and implement the system, while the certification body makes its own assessment and decision. See ISO’s explanation of certification.

When requesting a quotation, provide the same scope and business information to each body. Ask what audit stages are included, what evidence must be ready, how findings are handled, the proposed surveillance arrangements and all charges. Confirm that the body’s accreditation covers the certification you need and that the proposed certificate will meet your customer’s requirement.

Keep consultancy fees separate from certification charges when setting the budget. Also allow for your team’s time and any operational changes. Our ISO consultancy service can help you define that preparation work and organise a practical implementation plan.

Common first-certification questions