The £10k/month question: what a small contractor actually needs before its first ISO 9001 audit

The email usually reads the same way. A framework or a main contractor has asked for ISO 9001 certification as a condition of the next order, the order is worth a five-figure sum every month, and the question is what the business actually needs to have in place before it can call a certification body. Not the ideal system. The minimum that passes, run honestly. Here it is.

First, what certification is

A UKAS-accredited certification body audits your business in two stages. Stage 1 is a readiness review: does the documented system cover the standard, is it in use, is there enough evidence for a full audit to be worth doing. Stage 2 is the audit proper: the auditor samples your records against the standard and your own procedures. If there are no major nonconformities, or they are closed, a certificate follows, valid for three years with surveillance audits between. Buying documents does not get you a certificate; the audit does. The documents are what make the audit about your business rather than about your paperwork.

The minimum document set

ISO 9001:2015 does not prescribe a quality manual or a list of procedures. It requires documented information where the standard says so and wherever you need it for the process to work. For a contractor of five to fifty people, our minimum is this:

1. A top-level description of the system, mapped clause by clause to the standard, with the scope of certification written down. Call it a quality manual if you like; the auditor uses it to find things.
2. The quality policy, signed by whoever runs the business, and quality objectives that can be measured: right-first-time at hold points, NCRs closed within a stated period, audits completed to programme.
3. Procedures for the processes that carry risk: document control, tender and contract review, supplier and subcontractor approval, materials control, planning and control of the works, inspection and test, nonconformance and corrective action, calibration, competence and training, internal audit, management review. If you design nothing, say so in the scope and leave design out.
4. The forms those procedures produce: the NCR, the corrective action request, the inspection and test record, the concession, the goods receipt check, the audit checklist, the management review agenda and minutes.
5. The registers that hold the evidence: documents and standards, ITPs, NCRs and corrective actions, approved suppliers, calibration, training, the audit programme, risks and opportunities.
6. A project quality plan for at least one live job, with its inspection and test plans and the signed check sheets behind them. This is the evidence the Stage 2 auditor spends most of the day on.
7. One completed internal audit against the programme, with findings recorded and closed, and one management review with minutes showing the inputs the standard lists and the decisions taken.

That is the whole list. Everything else in a full QMS is there because it makes the system easier to run at scale, not because the auditor will fail you without it.

A realistic timeline

Ninety days is achievable for a contractor with no full-time quality manager if someone owns it and the documents are not being written from a blank page. The roadmap we build into the QMS runs roughly like this:

• Weeks one and two: brand and tailor. Put your name on the documents, delete the procedures that do not apply, fix the scope, sign the policy, set the objectives. Do not add anything yet.
• Weeks three to eight: run it on a live job. Issue the project quality plan, get the ITPs approved, sign the check sheets, raise the first NCR and close it properly, log the calibration certificates, approve the subcontractors you already use with the evidence you already hold. This is where a system either becomes real or stays a folder.
• Weeks nine to twelve: audit and review. Do the internal audit, close the findings at root cause, hold the management review, and only then book the certification body. Booking earlier is the commonest mistake: a Stage 1 with no records behind it is a paid rehearsal.

Certification bodies need lead time for Stage 1 and Stage 2, so speak to two or three early, ask what their diary looks like, and compare the day rates and the scope wording rather than only the price. Tell them you intend to be ready in a stated month and ask them to hold it.

What goes wrong

Three things, in our experience of taking a contractor through it and of auditing the ones that struggled. First, the system was written by someone who does not work in the business, so nobody on site recognises it. Second, procedures promise records that do not exist: a procedure says "the site manager completes form F-12" and there is no F-12. Third, the audit and the review were done the week before Stage 1 with nothing behind them, and the auditor could tell. The fix for all three is the same: use the documents on a live job before anyone external looks at them.

What it costs, honestly

We will not quote you a figure for certification, because it depends on your headcount, your sites and the certification body's day rate, and anyone who quotes a number without knowing those is guessing. What we can say is that the document set above, done properly, is the smaller part of the cost. The larger part is the time of the person who runs it for ninety days. Budget for that person, or for a consultant to stand in for them, and the certificate follows.

One more thing. ISO 9001:2026 was published on 16 September 2026. If you are starting now, build to the edition your certification body will audit you against, which for the moment is 2015; this post explains why that is not a reason to wait.