Overview
ISO standards are published by the International Organization for Standardization. Businesses adopt them to show customers that they follow recognised practices for quality, environment, safety, information security or food safety. Certification is granted after an audit by an independent certification body, which should preferably be accredited by a recognised accreditation body.
The most commonly chosen standards are ISO 9001 for quality management, ISO 14001 for environmental management, ISO 45001 for occupational health and safety, ISO 27001 for information security and ISO 22000 for food safety.
Our work is the preparation. We explain what the standard requires, assess where you stand, help you build the policies, procedures and records, and run an internal audit so the certification body's audit goes smoothly. We do not issue certificates and we do not guarantee a result.
Is ISO certification the right fit?
It helps most where customers or tenders ask for it, or where you want more structure in the way work is done.
Usually a good fit if
- Tenders, large customers or export buyers require ISO certification from vendors.
- You want a documented, repeatable way of working as the team grows.
- You handle sensitive data and want to demonstrate security controls.
- You make or handle food and need a recognised food safety system.
Think twice if
- You only want a certificate for display; auditors look for working practice, and a certificate obtained without it will not hold up at surveillance audits.
- Your operations change rapidly and there is no one to own the system day to day.
Key benefits
Customer confidence
A recognised standard reassures buyers about your processes.
Tender eligibility
Many public and private tenders prefer or require certification.
Process discipline
Written procedures and records reduce dependence on individuals.
Fewer errors
Corrective action and audits catch problems early.
Continual improvement
The standard builds in regular review and improvement.
Market access
Certification can help in export and large-account sales.
What we need from you
The paperwork is mostly about how you work, so what we need is your current practice.
About the organisation
- Registration documents, GST and Udyam details
- Organisation chart and list of locations
- Scope of products or services to be certified
- List of key customers and regulatory requirements
About your processes
- Existing procedures, work instructions and checklists
- Sample records, such as inspection and purchase records
- Details of suppliers, equipment and facilities
- Customer complaints and corrective action records, if any
For specific standards
- Information security: asset list, access control and incident records
- Food safety: hazard analysis, layout and cleaning plans, FSSAI licence
- Environment and safety: legal compliance register and risk assessments
How the process works
Choose the standard and scope 2 to 3 days
We discuss which standard fits your customers and needs and define what the certificate will cover.
Gap analysis 3 to 5 days
We compare your practice against the clauses of the standard and list what is missing.
Build documentation and systems 3 to 6 weeks
Policies, procedures, forms and records are drafted with your team and then put into use.
Training and implementation 4 to 8 weeks
Staff are trained and the system runs for a period so there are records to audit.
Internal audit and management review 1 to 2 weeks
We run an internal audit and a management review before the external audit.
Certification audit 2 to 4 weeks
An independent body audits in two stages, and issues the certificate after any findings are closed.
How long it takes
| Preparation and implementation | About 2 to 3 months |
| Certification audit | 2 to 4 weeks |
| Overall | Roughly 2 to 4 months |
Time depends on the size of the organisation and how formal your processes already are.
After certification
A certificate is the start of ongoing obligations.
- Surveillance auditsThe certification body audits again, usually every year.
- RecertificationThe certificate is typically valid for three years, after which a full recertification audit applies.
- Internal audits and reviewsKeep running them on schedule.
- Corrective actionsClose every finding and keep the evidence.
- Scope changesTell the certifying body about new sites, products or major changes.
Common ISO standards
| Standard | Topic | Often chosen by |
|---|---|---|
| ISO 9001 | Quality management | Manufacturers and service providers |
| ISO 14001 | Environmental management | Industrial units and exporters |
| ISO 45001 | Occupational health and safety | Construction and factories |
| ISO 27001 | Information security | IT and data-handling firms |
| ISO 22000 | Food safety | Food producers and caterers |
Frequently asked questions
Do you issue the ISO certificate?
No. Certificates are issued by independent certification bodies after an audit. We prepare you for it.
How do I choose a certification body?
Choose one accredited by a recognised accreditation body, so that the certificate is accepted by customers and tenders. We can share what to check.
How long is the certificate valid?
Usually three years, with surveillance audits in between.
Can a very small business get certified?
Yes. The standard scales to size, and a small company's system can be simple.
Is ISO certification mandatory?
Not by general law. It may be required by customers, tenders or specific regulations for your sector.
What if the audit finds gaps?
Auditors raise findings, and you correct them within the set time. Most organisations see some findings the first time.
This page is general information to help you prepare, not legal, tax or professional advice for your situation. Rules, forms, thresholds and due dates change, so we confirm the current position before we file anything for you. Taxswami Consultants is an independent professional services firm and is not a government body.