ISO 9001 for small businesses: a right-sized quality system, without the bureaucracy

What ISO 9001 actually requires of a 10- to 50-person company

The same requirements as any other organisation, met with far less. ISO 9001:2026 calls its requirements generic and applicable to any organisation, whatever its type or size; there is no lighter edition for small firms.

What scales is the extent. ISO's guidance on documented information ties the amount a company needs to its size and activities, the complexity of its processes and the competence of its people. The standard's introduction adds that your documents need not mirror its clause structure or vocabulary, so write the system in your own words. Top management is usually the owner or managing director, and no requirement calls for a quality department, a committee or a quality manager title.

The documented information, and what can share one document

Under the standard's clause titles, the named list is short. The right-hand column is common small-firm practice, not requirement.

Four combinations do most of the work: scope, policy and objectives on one page; the process map and every process description in one document; complaints, nonconforming output and corrective actions in one log; training, licences and awareness in one competence matrix. There is no quality manual and no quota of procedures; ISO 9001 documentation: what you need and what you do not covers documents, records and their control.

How many people it takes, and how much of their time

Typical ranges for one site with stable processes; your starting point and workload will move them:

• Owner or managing director: decisions more than hours, on scope, policy, objectives, resources and the management review; a few half-days across the project.
• Coordinator: an existing manager, not a new hire; half a day to a day and a half a week during the build, then a few hours a week.
• Process owners: three to six people, two to four hours a week each, mostly in workshops and checking their process descriptions.
• Internal auditors: two trained members of staff, one to two days each per audit cycle.
• Everyone else: a short awareness session, now including the quality culture and ethical behaviour added in the 2026 edition.

Size shortens the writing, not the calendar: the system must run for two to three months before Stage 2 to produce records, so three to six months remains typical. See ISO 9001 timeline: how long certification takes, stage by stage.

What the certification audit looks like for a small scope

Small firms take the same accredited route as large ones: a Stage 1 readiness review, a Stage 2 certification audit, a certification decision, yearly surveillance and recertification every three years.

What shrinks is audit time. The certification body calculates it from the number of people within the scope and the complexity of their work, so a small, simple scope needs fewer audit days. Fewer days are not a lighter audit: every requirement is still examined, often through the same few people. Choosing an ISO 9001 certification body: accreditation, sector codes and quotes explains what a quotation should show, and ISO 9001 Stage 1 and Stage 2 audits: what auditors check covers each stage.

Four mistakes small firms make

• Buying a template manual. The pack describes departments, job titles and forms you do not have, and the auditor holds you to every word. Use templates for structure; take the content from how your people work.
• Letting one person own everything. The system stops when the coordinator is on leave, nobody else can explain their own process at Stage 2, and nobody independent is left to audit the coordinator's work.
• Writing procedures nobody follows. Written to impress the auditor, they describe an ideal, and the gap with the real work becomes nonconformities. Write them with the person who does the job, on a page or a checklist.
• Inventing forms for records you already have. Double entry is abandoned within weeks; job files, the CRM and timesheets already hold most of the evidence.

Worked example: a right-sized system for a 25-person service company

A facilities maintenance contractor has 25 people: a managing director, an operations manager, two supervisors, sixteen technicians, two account managers, an office manager, a purchasing officer and an HR and finance officer. Work orders run on a job management app; the office manager coordinates, about a day a week during the build.

Total: two written documents, the app's own checklists and eight registers or logs, mostly owned by people other than the coordinator. No manual, no duplicate forms; at Stage 2 the auditor can open last week's work orders on a technician's phone.

How Sterling's Design™ route fits a small firm

Sterling offers two routes. In Design™, your team builds the system with Sterling's structure, templates and coaching; in Drive™, Sterling's consultants take on the agreed consulting and documentation work. Design™ usually suits 10 to 50 people: the documents come out in your own words, and the knowledge stays in the company. Drive™ fits when managers cannot free the hours. ISO 9001 gap analysis: what it covers and what you get describes the first stage.

ISO 9001 for small businesses: questions buyers ask