How to Prepare for ISO Certification: A Practical Guide

Pick the standard that matches your reason for certifying, define the scope, and write down how your business already works. Then compare that practice with the requirements, close the gaps and decide which type of certificate you need.

Most small businesses already do much of what ISO asks. The work lies in making it visible, consistent and provable. The steps below follow the order in which they are easiest to handle.

What does preparing for ISO involve?

An ISO standard sets requirements for a management system. It does not tell you how to run your business. It asks whether you have clear goals, defined responsibilities, working processes, and a way to check and improve them.

Preparing means reaching a state where you can answer those questions honestly. You do not need a large manual. A few clear documents, some records and staff who know their role are enough.

For a team of five to fifty people, this takes weeks, not years. How long exactly depends on how much currently exists only in people's heads. If you are unsure whether ISO suits a company of your size, our guide to ISO certification for small and medium businesses explains what is proportionate.

Step 1: Choose the standard for a clear reason

Ask why you want certification. The answer points to the standard.

• A customer asks for proof that you manage quality consistently. That usually points to a quality management standard.
• A client wants assurance that you protect their data. That points to an information security standard.
• You want to show environmental responsibility. That points to an environmental management standard.
• You need to demonstrate safe working practice. That points to an occupational health and safety standard.

A standard's fame is a poor reason to choose it. Choose the one that someone you care about will recognise. The options are listed on our standards page.

If you cannot decide, ask your three most important customers what they look for in suppliers. Their answers often settle it.

Step 2: Define the scope

The scope states which parts of your business the certificate covers: the whole company, one location, one service line or one team.

A narrow scope you can stand behind beats a broad one you cannot support. Write it in one or two plain sentences, for example: "Design, development and support of web applications for business clients, from our office in Zurich."

Note anything you deliberately exclude, and give the reason. Whoever reads the certificate should see exactly what it does and does not cover.

Step 3: Learn the structure of the requirements

Most current management system standards share one high level structure, so once you know it, every standard looks familiar. The clauses are:

• 4 Context of the organization: who your interested parties are, what affects your business, and what your scope is.
• 5 Leadership: management commitment, a policy, and defined roles and responsibilities.
• 6 Planning: risks and opportunities, objectives, and how you plan to reach them.
• 7 Support: resources, competence, awareness, communication and documented information.
• 8 Operation: the processes that deliver your product or service, planned and controlled.
• 9 Performance evaluation: monitoring, internal review and management review.
• 10 Improvement: handling problems, corrective action and continual improvement.

Clauses 1 to 3 cover scope, references and terms. The requirements you act on begin at clause 4. Each standard then adds its own content, such as security controls or environmental aspects, so read your chosen standard with this map beside you.

Step 4: Name an owner and involve management

The project needs one owner. In a small business that is often the managing director, an operations lead or an office manager. A few hours a week from one person is enough; a committee is not.

Management involvement is more than a formality. Clause 5 expects leaders to set direction, approve the policy and take part in reviews. If the business owner stays out, the system stays on paper.

Tell your team early what you are doing and why. Documented processes meet less resistance when people understand the purpose and helped describe them.

Step 5: Write down what you actually do

This is the core of the work. Describe your real processes, not an idealised version.

For each main process, such as quoting, delivery, support, hiring or purchasing, note:

• the trigger and the result,
• who is responsible,
• the key steps,
• what record proves it happened.

A one-page description or a simple flowchart is usually enough. Add the documents the standard explicitly requires, such as a policy, objectives and a scope statement.

Collect the records you already produce: meeting notes, customer feedback, supplier lists, training logs, incident reports. You probably have more evidence than you think. Where you have none, start keeping it now, because a record with a date and a name is worth more than a long description.

Step 6: Check for gaps and fix them

Go through the requirements clause by clause and compare them with your processes and records. Mark each one as met, partly met or missing.

Typical gaps in small businesses:

• no written objectives, or objectives nobody tracks,
• no record of staff training or competence,
• no routine review of how the system performs,
• no clear way to log and resolve complaints or errors,
• risks that are known but never written down.

Fix the most important gaps first. Perfection is not the aim; a system that works and that you can explain is. Run at least one internal check and one management review, even a short one, so that clause 9 is real and not just claimed.

Step 7: Decide which type of certificate you need

Teams often skip this step and lose time later. There are two broad routes.

The classic route means an on-site audit by an external auditor from a certification body. A tender, a regulated sector or a large customer may explicitly require it.

A self-assessment certificate rests on your own structured answers and evidence, with no external audit. It shows structure, commitment and a documented approach, particularly to customers who do not demand an on-site audit.

Read the wording in your tender documents or customer contract before you decide. If it requires an on-site audit by a certification body, you need the classic route. Our guide on the two routes sets out the difference and when each applies.

Readiness checklist

Go through this list before you apply or book an audit.

• We know why we want certification and who will recognise it.
• We have chosen a standard that fits that reason.
• Our scope is written in one or two clear sentences.
• One person owns the project and has time for it.
• Management has approved a policy and measurable objectives.
• Our main processes are described and match what we do.
• Roles and responsibilities are written down.
• We keep records that prove the processes run.
• We have assessed our main risks and opportunities.
• Staff know the policy and their part in it.
• We have run an internal check and a management review.
• We have a way to log problems and act on them.
• We have confirmed whether the customer or tender requires an on-site audit by a certification body.

If most boxes are ticked, you are ready. The open ones form your work plan.

How Zertify fits in

Zertify issues ISO certificates based on a self-assessment. G6 Agency AG issues them under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before a certificate goes out.

The preparation above applies here too. You work through a structured assessment in which you confirm and describe how your business meets the requirements. It doubles as a readiness check, since it shows quickly where your documentation is thin.

The sequence:

1. Review the available options on the standards page.
2. Check the pricing page to see what is included.
3. Start the assessment once your documents and records are in order.

If you pass the assessment and complete payment, the certificate is issued within 4 hours. That suits a customer who wants proof of your approach and does not require an on-site audit. Where a tender or regulator does require one, take the classic route with an on-site audit by a certification body. Your preparation carries over, because the documentation is the same.

Common mistakes to avoid

Copying templates without adapting them. Generic text that does not match your work falls apart as soon as someone asks about it.

Writing too much. Every extra document has to be maintained. Write what the standard requires and what your people actually need.

Treating it as an IT or admin task. The system covers how the whole business runs, so involve the people who do the work.

Leaving management out. Leadership is a requirement, not a courtesy.

Preparing once and stopping. Clauses 9 and 10 expect regular review and improvement. A certificate reflects a point in time, but the system has to keep running.

A realistic timeline

A small business that already works in an organised way can expect a few weeks of part-time effort. One with little in writing will need longer. Plan around your real workload, not around a deadline picked in advance.