Management system documentation for small teams: what to write

A small team needs a short set of documents: a policy, a scope, a few objectives, the processes that matter written as one page each, and records that show the system is in use. A dozen documents, kept current, are worth more than a manual nobody opens.

Most owners picture a thick binder when they hear "management system documentation". The standards do not ask for that. They ask for enough written information to run the business consistently and to show someone else how it works.

What the standards actually require

ISO management system standards that follow the high level structure share a clause on support. Clause 7 covers resources, competence, awareness, communication and documented information. Within it, clause 7.5 sets out how documented information is created, updated and controlled.

The wording matters. The standards say "documented information", not "manual" or "procedure". It can be a page in a wiki, a spreadsheet, a checklist, a short video or a signed form. The format is your choice. What the standard cares about is that the information exists where it is needed, that people can find the current version, and that old versions do not circulate.

Some items are named explicitly. In ISO 9001, for example, you keep documented information on the quality policy, the quality objectives, the results of internal audits and management reviews, and on nonconformities and the corrective actions taken. The standard does not prescribe a fixed list of procedures. You decide which processes need written guidance, based on how much can go wrong without it and how many people work on them.

The exact list differs between standards, so check the requirements of the one you are working towards. The standards overview shows what is available.

The documents a team of ten really needs

A team of five to twenty people can cover the core of a management system with the following set. Each item can be one page.

Policy

One page, signed by the owner or managing director. It states what the business commits to: quality for customers, information security, environmental care or safe work, depending on the standard. Two or three real commitments are enough. Write them so that an employee could say whether the business is keeping them.

Scope and context

A short description of what the management system covers: which services, which locations, which teams. Clause 4 asks you to understand your context, your interested parties and their expectations. For a small business this is a half page listing your main customers, your suppliers, the regulations that apply to you and the risks you already know about.

Roles and responsibilities

A table with names. Who owns the system, who handles customer complaints, who approves changes, who looks after IT access. In a small team one person often holds several roles. Write that down; it is perfectly acceptable.

Objectives

Three to five measurable targets for the year, each with an owner and a date. "Answer support requests within one working day" is an objective. "Improve customer satisfaction" is a wish. Clause 6 is where planning for objectives and risks sits.

Process descriptions

Write down the processes where a mistake costs money or a customer: quoting, onboarding a new client, delivering the main service, handling a complaint, onboarding a new employee. Use a one page format: purpose, who does it, the steps, what record it produces. If a process is trivial or only one person ever does it, a checklist is enough.

Risk and opportunity register

A spreadsheet with the risks you identified, how likely and how serious each one is, and what you do about it. Ten to fifteen rows is realistic for a small business. Review it twice a year.

Supplier list

The suppliers whose failure would hurt you, with a note on why you chose them and how you check them. This is often the first thing a customer asks for in a supplier questionnaire.

Documents and records are different things

A document tells people what to do. A record shows what was done. The first is updated when things change. The second is never rewritten after the fact.

Onboarding checklist: document. The completed checklist for the new hire who started in March: record. Meeting agenda template: document. The minutes of the management review: record.

Small teams often over-invest in documents and under-invest in records. A customer audit or a tender evaluation rarely asks to see your perfect procedure first. It asks for proof that you follow it. Completed forms, tickets, signed minutes, test results and training confirmations carry the weight.

Clauses 9 and 10 depend on records. Internal audits (9.2) and management reviews (9.3) produce records by design. Corrective actions (10.2) produce records when something goes wrong. If you run these three honestly once or twice a year, a large part of your evidence builds itself.

How to keep documents short

Short documents get read and updated. Long ones get ignored. A few habits help.

• Write for the person doing the task, not for an auditor. Use the words your team uses.
• One topic per document. A page that covers purchasing, supplier checks and payment approval will be out of date within a year.
• Prefer a table, a flow or a checklist to paragraphs of prose.
• Do not copy sentences from the standard. Describe what you actually do.
• Delete what no one uses. A document with no reader and no owner is a liability.
• Do not describe a process you wish you had. Describe the one you run today, then improve it.

If a procedure runs to more than two pages, check whether it is really two processes.

Where to store documents and who owns them

Pick one place. A shared drive with a clear folder structure, a wiki or a project tool all work. What does not work is a mix of email attachments, local folders and a printed binder that disagree with each other.

Every document needs three pieces of metadata: an owner, a version or date, and a review date. Put them in the header or the file name. Clause 7.5 asks for control over distribution, access, storage and changes, and this is how a small team meets that without software.

Limit edit rights to the owner and read access to everyone who needs it. For anything with confidential content, such as client data or security settings, check who can open the folder before you call the system finished.

Checklist: documentation for a small team

• Policy written, one page, signed by management
• Scope of the management system defined in a few sentences
• Interested parties and their expectations listed
• Roles and responsibilities named, with deputies
• Three to five measurable objectives with owner and date
• Risk and opportunity register started and reviewed at least twice a year
• One page descriptions for the core processes (quote, delivery, complaint, onboarding)
• Supplier list with the critical suppliers marked
• Training and competence records for each team member
• One storage location agreed, with owner, version and review date on each document
• Internal audit done and recorded
• Management review held and minuted
• Corrective action log in place, even if it has only a few entries

Mistakes that cost time later

The most common one is buying or downloading a full template pack and filling it in. The result is a system that describes a larger company than yours. The team cannot follow it, so it drifts away from daily work within weeks.

The second is a single person writing everything alone. The documents then reflect one view of the work. Ask the people who do the task to read the draft. Their corrections are usually the most useful part.

The third is treating documentation as a project with an end date. Policies change, people leave, tools are replaced. Put a recurring review in the calendar, and tie it to the management review so that it is not forgotten.

The fourth is writing records in advance. A completed internal audit form with no audit behind it is easy to spot and damages trust in everything else.

For a wider view of what a small business can realistically take on, see our guide to ISO certification for small and medium businesses.

How Zertify fits in

Zertify issues ISO certificates based on an online self-assessment. There is no on-site audit. You answer the questions for the standard you chose, and the answers show whether your documentation and practice meet its requirements. The documents described above are the material you draw on while answering.

A member of the SICE Certification Board reviews every assessment before the certificate is issued. The certificate comes from G6 Agency AG under licence from SICE and carries a QR code that leads to a public verification page, so a purchasing department or a customer can check it without contacting you. If you want to understand how this differs from the classic route with an on-site audit by a certification body, read our explanation of certification without an audit.

To see which standards you can choose from, open the standards page. The pricing page lists what the certificate and the yearly confirmation cost. When your core documents and records are in place, you can start the assessment. After a passed assessment and payment, the certificate is issued within 4 hours.

The certificate is valid for three years and is confirmed every year with a short online re-audit, which is a yearly subscription. That rhythm suits the documentation habits above: a yearly review of policy, objectives and risks is what keeps both the system and the certificate current.