ISO 9001 Checklist for Small Business: 10 Steps to Readiness

A small business works through ISO 9001 in seven areas: context, leadership, planning, support, operation, performance evaluation and improvement. Go through them in order and write down only what you actually do. At the end you know whether your quality management system is ready for certification.

The checklist below follows ISO 9001:2015 Quality Management, clauses 4 to 10. You do not need a quality department, only a clear picture of how your business delivers its work and a few simple records.

What ISO 9001 asks of a small business

ISO 9001 does not prescribe how to run your business. It wants proof that you know your customers, deliver consistently, check your results and fix what does not work. A five-person agency and a 150-person manufacturer work to the same standard. Only the volume of paperwork differs.

No thick manual is required. The standard asks for documented information in specific places, such as your scope, your quality policy and your quality objectives. Anything beyond that you document only where the work needs it to run reliably. For more on how the standard fits smaller companies, see our guide to ISO certification for small and medium businesses.

The checklist, clause by clause

Treat the lists below as a working document. Tick an item only when you can show it to a customer or an assessor within a few minutes.

Clause 4: Context of the organization

Here you describe your business and where its boundaries lie.

• Write down the main internal and external issues that affect your ability to deliver quality (market, staff, suppliers, technology, regulation).
• List your interested parties: customers, employees, owners, key suppliers, authorities. Note what each expects from you.
• Define the scope of your quality management system: which products, services, locations and teams it covers.
• Sketch your main processes and how they connect, from enquiry to delivery and invoicing. One page with a simple diagram is enough.

Clause 5: Leadership

In a small business, leadership means you, the owner or the managing director.

• Confirm that management takes responsibility for the system and gives it time and resources.
• Write a short quality policy that fits your business. Three to five sentences are enough.
• Make the policy available to staff and to anyone who asks.
• Assign roles, responsibilities and authorities. Name who decides what, and who stands in when someone is absent.

Clause 6: Planning

Planning means looking ahead instead of reacting afterwards.

• Identify the main risks and opportunities for your quality of delivery. A short table with the risk, its likely effect and your countermeasure works well.
• Set measurable quality objectives, for example on-time delivery, complaint handling or rework.
• For each objective, note who is responsible, what is needed and how you will measure it.
• Decide how you handle changes to the system, so that a new tool or a new service does not break existing processes.

Clause 7: Support

Support covers the people, tools and information your processes depend on.

• Confirm that you have the people, equipment, software and working environment you need.
• Define the competence required for each key role and keep evidence: training records, qualifications or experience notes.
• Make sure staff know the quality policy, their objectives and what happens if the system is not followed.
• Decide how you communicate internally and externally on quality matters.
• Control your documented information: version, owner, location and who may change it.

Clause 8: Operation

Clause 8 is the core of the standard. It covers how you deliver.

• Plan and control how each product or service is delivered, including criteria for acceptance.
• Capture customer requirements before you commit: quotes, briefs, contracts, changes.
• If you design or develop products or services, define how you plan, review and approve that work.
• Evaluate and monitor external providers, such as subcontractors, freelancers and key suppliers.
• Deliver under controlled conditions, and keep the records that show what was done.
• Define how you release work to the customer and who signs it off.
• Define how you identify and handle nonconforming work, so that errors do not reach the customer unnoticed.

Clause 9: Performance evaluation

Now you check whether the system works.

• Decide what you monitor and measure, and how often. Link it to your objectives.
• Collect customer feedback in a simple, repeatable way, such as a short follow-up message or a review call.
• Plan and carry out an internal audit. In a small company a trained colleague or the owner can do it, as long as nobody audits their own work.
• Hold a management review at least once a year. Record the inputs, the decisions and the actions.

Clause 10: Improvement

• Keep a simple log of nonconformities, complaints and near misses.
• For each issue, record the cause, the correction and the action taken to prevent a repeat.
• Check later whether the action worked.
• Show that you use audit findings, feedback and review results to improve.

What you can safely keep short

Over-documenting is the usual mistake in small businesses. Three habits keep the paperwork down.

1. Prefer one page to ten. Staff read a process description that fits on one page. A long one stays in the drawer.
2. Reuse what exists. Your project tool, ticket system or shared drive may already hold records that satisfy the standard. Point to them instead of rewriting them.
3. Write what you do, not what sounds good. An assessor or a customer will compare your text with your daily practice. Honest and simple beats ambitious and unused.

Common gaps in small businesses

These six weak points turn up again and again. Check them before you go further.

• No defined scope. The business says it is certified, but nobody can say what the certificate covers.
• Objectives without numbers. "Deliver good quality" cannot be measured. "Answer support requests within one working day" can.
• No evidence of competence. The skills exist, but nothing shows how they were checked.
• Internal audit skipped. It is often the first task to slip when the workload rises.
• Management review done informally. A talk in the corridor leaves no record.
• Suppliers never evaluated. Freelancers and subcontractors affect your quality, so the standard expects you to look at them.

Self-assessment or on-site audit?

Once the checklist is complete, you decide how to confirm the result.

A Zertify certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education) on the basis of an online self-assessment, with no on-site audit. SICE reviews every assessment before the certificate is issued, and anyone can verify the certificate publicly on zertify.ch. It shows that you have reviewed your system against the requirements of the standard and passed a structured assessment. For many small businesses that is a proportionate way to show customers a defined quality system.

Choose the classic route, with an on-site audit by a certification body, when a tender, a customer contract or a regulator explicitly demands one. Our guide on the two routes helps you decide. The work on this checklist counts either way, since an auditor on the classic route asks for the same evidence.

How Zertify fits in

Zertify suits owners who want to confirm their quality system without running an audit project. The self-assessment is based on the requirements of ISO 9001:2015, and its questions follow the same clauses as the checklist above, so your preparation carries straight over.

Once you pass the assessment and complete payment, Zertify issues the certificate within 4 hours. Current fees are on the pricing page. The certificate is valid for three years and is confirmed every year with a short online re-audit. It is a yearly subscription: the first year costs the full price, every following year a lower yearly fee, and you can cancel at any time for the end of the year. You can start the assessment and work through it at your own pace.

A short final check

Before you start the assessment, answer five questions.

• Can I explain in two minutes what my quality system covers and why?
• Do my objectives have numbers and owners?
• Can I show records of delivery, feedback and corrective action?
• Have I done one internal audit and one management review, even a small one?
• Do I know whether any customer or tender requires an on-site audit by a certification body?

Five yes answers mean you are ready. Each no shows where to spend your next hour.