ISO & compliance · Guide
Does my small business need ISO certification?
Most small businesses do not need ISO certification until a customer, tender or regulator asks for it. When they do, the work is easier if the evidence is already being kept as part of everyday work.
Updated · Nexus Digital Ireland
Certification is voluntary, but often expected
ISO certification is not a legal requirement for most businesses in Ireland. It becomes important when customers, public tenders or larger contractors ask for it, or when you want to show that quality or information security is managed properly. Many small businesses first hear about it in a tender document or a customer's supplier questionnaire.
The standards small businesses meet most often
- ISO 9001
- Quality management: consistent delivery, customer focus and improvement.
- ISO 27001
- Information security management: protecting the information you and your customers rely on.
- ISO 14001
- Environmental management.
- ISO 45001
- Occupational health and safety management.
Aligned or certified: what is the difference?
Being aligned means you run the business in line with a standard's requirements and keep the evidence, without an external audit. Being certified means an independent certification body has audited you and issued a certificate, followed by regular surveillance audits.
In Ireland, look for a certification body accredited by the Irish National Accreditation Board (INAB) or another recognised accreditation body. Customers and tenders usually ask for accredited certification.
Signs you should consider certification
- Tenders or customers you want are asking for an ISO certificate.
- You keep answering long supplier security or quality questionnaires.
- You are growing and want consistent ways of working that do not depend on one person.
- You handle sensitive customer data and want to show it is protected.
What getting certified involves
- Understand the requirementsRead the standard or a reliable summary, and decide the scope: which services and sites.
- Find the gapsCompare how you work today with what the standard expects.
- Put the system in placePolicies and processes that people actually follow, with the records to show it.
- Run it for a whileBuild up evidence over a few months, and carry out an internal audit and a management review.
- Choose a certification bodyGet quotes from accredited bodies and agree audit dates.
- Certification auditUsually in two stages; then surveillance audits keep the certificate valid.
Timelines and costs vary with the size of the business, the scope and how much is already in place. Ask certification bodies for quotes based on your situation.
How Nexus helps you get ISO-ready
Nexus Digital does not award certification. The Operations Register keeps the supplier, purchasing and evidence records that ISO 9001 and ISO 27001 expect, and Nexus can help you prepare.
- Supplier register, approvals, reviews and evidence kept together as you work.
- An audit trail and exportable records for your certification body.
- ISO readiness support from Nexus: understanding the gaps and the evidence you need.
Questions
Is ISO certification a legal requirement in Ireland?
For most businesses, no. It is usually a commercial requirement set by customers, tenders or contracts rather than by law.
What is the difference between ISO compliant and ISO certified?
Compliant or aligned means you follow the standard's requirements; certified means an accredited certification body has audited you and issued a certificate.
Who certifies businesses in Ireland?
Certification bodies, which should be accredited by the Irish National Accreditation Board (INAB) or another recognised accreditation body. Nexus Digital does not certify businesses.
How long does certification take?
It depends on your size, scope and starting point. Many small businesses allow several months to put the system in place and build evidence before the certification audit.
Related guides
ISO audit evidence checklist for supplier management
Most audit stress comes from evidence that exists somewhere but cannot be found quickly. This checklist lists the supplier evidence auditors commonly ask for, so you can keep it ready as you work.
Read the guide →ISO 9001 supplier evaluation for small businesses
ISO 9001 asks you to control what you buy in: choose suppliers against criteria, check they keep delivering, and keep a record of it. For a small business that can be simple, as long as it is done consistently.
Read the guide →