Can you do ISO 9001 yourself? More and more small businesses are trying to do ISO 9001, or any ISO certification, themselves. Budgets are tight, there is plenty of free information out there and AI can produce a quality manual in minutes. So why pay a consultant?
It’s a fair question. And the honest answer is that you can manage ISO 9001 in-house, especially if you have the finances and resource to have an in-house ISO/Quality/SHEQ/Compliance manager. But after working with small businesses across Kent and the South East, I have noticed that DIY ISO tends to hit the same few walls. Here is where they are and how to get past them without handing over control of your system.
Yes, you can do ISO 9001 yourself
“We’ve been limping along with it.”
That’s how a client described their ISO 9001 system when I first sat down with them.
They had done it all themselves. Hours of reading. Evenings with the standard open on one screen and AI on the other. A manual, procedures, records, the lot. And they had passed their certification audit.
They were proud of it, and they should be. I’ve read ISO 9001 more times than I’d care to admit and I still wouldn’t take it on holiday.
So if you are wondering whether a small business can get certified without outside help, the answer is yes. Plenty do. Some get through stage 1 and 2 audits, some don’t. But most DIYers feel like they have only just scraped through it.
Where trying to do ISO 9001 yourself gets difficult
The annual audit stress
That same client said something that stuck with me.
“We just don’t want to stress every time the auditor comes.”
That is the part nobody tells you about managing ISO 9001 in-house. Getting certified is one thing. Keeping the system alive between audits, while everyone has a day job, is another.
Surveillance audits start to feel like an exam you have to cram for, every year.
When you are in this situation, you pass and feel relieved, but you still don’t feel like you have everything together. My clients are glad when an audit’s finished too, but they go into it with confidence (with the bonus that they don’t have to sit with the auditor all day).
Using AI to write your ISO 9001 documents
Another small business took a different route. They used AI to write their quality manual.
On the surface it looked great. But the auditor wasn’t happy.
Nothing in it was wrong exactly. It was just general. It could have belonged to any company in any industry and the auditor is looking for the opposite: does this system describe how your business actually works?
AI can write a manual but it cannot write your manual. It doesn’t know who signs off a job, what tends to go wrong on a Friday afternoon, or why you changed supplier two years ago.
It also tends to assume you need the belts and braces for all of the things, which makes for a disproportionate and overwhelming system.
Internal audits and impartiality in a small team
Then came the second problem. They needed to carry out an internal audit of their own system. But they are a very small team, so the people doing the checking were the same people who built it and run it every day.
I don’t blame them at all. When there are only a handful of you, there is not anyone independent down the corridor. But ISO 9001 expects internal auditors to be objective and impartial and you cannot really mark your own homework, however honest you are.
Signs your in-house ISO 9001 system needs support
Neither of these businesses did anything wrong. One got there through sheer graft. The other was being resourceful with the tools they had. Alot of businesses have done the same.
They just hit a ceiling. If any of these sound familiar, you might be close to yours: –
- You dread the surveillance audit and spend the week before it catching up on records.
- ISO sits with one person, usually whoever’s “good with paperwork”, on top of their actual job.
- Nobody else would know where anything is if that person left or was off sick.
- Your manual or procedures came from a template or AI and haven’t really been tailored.
- The people carrying out your internal audits are the same people who run the processes.
- You are not sure whether your system still matches how the business works today.
The middle ground is keeping ownership, get independent support
This does not have to be all or nothing. You don’t need to hand your whole system to a consultant, you can of course have a consultant managing your system but ultmately it should be yours.
What an outsourced compliance or quality manager actually does
Think of it as having an ISO expert on your team without the cost of employing one. In practice that usually means:-
- Independent internal audits, so you get a genuinely impartial view and a clean answer for your auditor.
- A regular sense check that your system still fits how you really work, rather than how you worked when you wrote it.
- An early warning when something’s drifting, so you hear about it from a friendly face before the auditor finds it.
- Support around the audit itself, so the visit becomes a bit of a non-event.
You stay in the driving seat. You just stop doing it alone.
