ISO certification for SMEs: how to get your proof

SMEs rarely certify out of devotion to a standard. Usually somebody asks: a customer, a tender or their own management, who wants more structure. Both are good reasons. The logo alone is not.

There is also an effect many underestimate: once you hold proof, the effort per customer enquiry falls. Instead of answering every questionnaire from scratch, you point to a verifiable certificate and add detail where needed. That saves sales and management time, especially in small teams.

Customer requirements

More and more clients send supplier questionnaires with questions on ISO 9001 or information security. Without proof you lose time, or the contract.

Tenders

Public clients and large groups often demand certification, sometimes accredited. Check the exact requirement before you invest.

Structure

A standard forces you to write down responsibilities, processes and improvement. For growing teams this pays off, because knowledge no longer sits with one person.

Choose by what your customers ask for, not by what is best known.

ISO 9001 quality

The standard for almost every sector. If it is unclear which standard you need, ISO 9001 is usually the right place to start.

ISO 27001 information security

For IT service providers, agencies that hold client data, software vendors and anyone who has to answer security questionnaires. More demanding than ISO 9001.

ISO 14001 environment

For trades, construction, manufacturing and retail when customers or authorities ask for environmental evidence or sustainability is part of the tender.

• ISO 9001
• ISO 27001
• ISO 14001
• All standards

For a team of 10 to 30 people, accredited certification takes three to nine months as a guide, nearer the upper end if you start without a management system. The certification body alone costs several thousand francs for the initial audit, plus annual surveillance audits. With consulting, five-figure sums are usual.

Many overlook the biggest item: your own time. Plan for 60 to 150 hours, spread across management and key people. The Zertify assessment takes 20 to 30 minutes, and the certificate costs CHF 599 to 849 depending on the standard. The price of that speed is the lack of accreditation.

• ISO certification cost in detail

Most problems arise before the first audit. Five mistakes are particularly common.

1. 01

   Certifying without knowing the customer's question

   If you pick a standard before you know what customers accept, you may certify the wrong thing. Ask first.

2. 02

   Paperwork instead of practice

   A thick manual nobody reads will not convince an auditor. The standard asks for processes that are lived day to day.

3. 03

   Choosing too broad a scope

   Not every department has to be in from the start. A clearly bounded scope lowers effort and cost.

4. 04

   Underestimating internal time

   Consultants and software take work off your hands, but not the decisions. Block fixed hours in the calendar.

5. 05

   Confusing certificate and accreditation

   Anyone who buys a certificate and only later finds that the tender requires an accredited one pays twice.

Before you spend any money, a short preparation pays off. Five steps are usually enough to gain clarity.

1. 01

   Ask your customers

   Ask your three most important customers which proof they accept, and write down their answers word for word.

2. 02

   Define the scope

   Decide which sites, services and teams the certificate should cover. It is better to start a little narrower.

3. 03

   Assign responsibility

   Name one person to lead the topic and give them fixed hours each week.

4. 04

   Check where you stand

   Take the free assessment as a status check. It takes 20 to 30 minutes and shows where gaps exist.

5. 05

   Choose route and budget

   Use the customer answers and your result to decide whether route A or route B suits you, and set a budget and timetable.

• Common questions about Zertify

For SMEs there are essentially two routes. They can be combined.

Route A: accredited

Audit by an accredited body, valid for three years with annual surveillance. Right for tenders, regulated sectors and group requirements. Takes months and a budget from several thousand francs.

Route B: Zertify

Self-assessment with 30 questions, certificate from SICE within 4 hours, from CHF 599 one-off. Right as evidence for customers, in questionnaires and on your website. Not accredited, no audit.

• Accredited or not
• Certification without an audit
• How Zertify works

The following cases are typical situations, not customer reports. They show how differently the answer can turn out.

Agency

An agency of 12 people regularly answers client questionnaires on quality and data protection. ISO 9001 documents order in project delivery, ISO 27001 the handling of client data. For questionnaires, a self-assessment certificate is often enough.

IT service provider

A provider of 25 people pitches to banks and insurers. There, ISO 27001 is usually required with accreditation. The self-assessment helps with preparation but does not replace the audit.

Trades

An installation firm of 18 people supplies municipalities. Public contracts ask for quality and environmental evidence. Read the tender: ISO 9001 and ISO 14001 are the usual candidates.

Retail

An online retailer of 10 people wants suppliers and customers to see that order handling and complaints are under control. ISO 9001 by self-assessment works as quick evidence.