Frequently Asked Questions

Cost depends on the standard, your staff numbers, turnover, complexity, and which certification body you choose. As a guide, certification body fees typically start around £2,000 + VAT and travel, with Goldenpath's implementation and consultancy fee starting at £3,500 + VAT and travel. ISO 27001 and ISO 45001 can run higher than ISO 9001 due to the extra scope of risk assessment work (information assets for 27001, physical health and safety risks for 45001). Ask us for a bespoke quotation for your specific standard and business.

Be wary of claims about getting ISO certification in 30–45 days. Technically it's possible — and we can fast-track ISO 9001 — but it's unlikely unless you can devote a staff member to the implementation alongside the consultant. Allow 3–5 months, which is a more comfortable timeline.

Each standard manages a different type of risk, but they share the same high-level structure:

ISO 9001 — quality management. Focuses on consistently meeting customer and regulatory requirements through documented processes and continuous improvement.

ISO 14001 — environmental management. Focuses on reducing environmental impact: waste, emissions, energy use and resource efficiency.

ISO 27001 — information security management. Focuses on protecting the confidentiality, integrity and availability of business information and data.

ISO 45001 — occupational health and safety. Focuses on preventing workplace injury and ill health.

An ISO audit is a formal check that your management system meets the requirements of the standard and is genuinely being followed day to day. There are two types: the internal audit, which reviews your own processes ahead of certification and at planned intervals afterwards, and the external audit, carried out by your certification body, which determines whether certification is granted or maintained. The overall process is broadly the same whether you're working towards ISO 9001, ISO 14001, ISO 27001 or ISO 45001 — only the specific risks and controls being checked differ.

It depends on what your business wants to manage, demonstrate or achieve. ISO 9001 focuses on quality management and consistent delivery of products and services. ISO 14001 focuses on environmental management and controlling environmental impacts. ISO 45001 focuses on occupational health and safety. ISO 27001 focuses on information security management.

Some businesses need one standard, while others benefit from combining several within an Integrated Management System. Tender requirements, customer expectations, risk and business objectives can all influence which standard — or combination of standards — is most appropriate for you.

All ISO management system standards (9001, 14001, 27001, 45001) require a documented system including defined processes, performance monitoring, and continuous improvement practices, plus leadership commitment, risk-based thinking, and compliance with applicable legal and regulatory requirements. The specific risks you assess differ by standard — for example ISO 27001 focuses on information security risks, ISO 45001 on health and safety risks, and ISO 14001 on environmental risks. Call us for a detailed breakdown for the standard you're working towards.

A certified company benefits from improved efficiency, more consistent outcomes, and increased stakeholder confidence through standardising processes and continual improvement. Certification also enhances credibility, opens up new market opportunities (many tenders and enterprise clients require it), and helps meet regulatory or contractual requirements — whether that's quality (ISO 9001), environmental performance (ISO 14001), information security (ISO 27001), or health and safety (ISO 45001).

Yes. ISO 9001 for small businesses works in exactly the same way as it does for larger organisations — the standard can be used by businesses of any size. Your management system should be proportionate to how your business actually operates, so a small company doesn't need an unnecessarily complicated system just to achieve certification.

For many small businesses, the key is building a practical Quality Management System that covers how work is controlled, responsibilities, customer requirements, suppliers, performance, internal audits and continual improvement.

Most likely not. Your business is running, you and your staff know how to do things, you're successful, and customers wouldn't keep coming back if they weren't satisfied. ISO puts a system around the running of your business so that your current standards are maintained and improved as the business grows.

Maintaining records is a requirement for ISO compliance, but it's far from burdensome — chances are you already have many of them in place.

With today's electronic systems, record-keeping is simpler and more efficient than ever. These tools not only make transactions easily traceable but also allow you to extract valuable data for analysis and continuous improvement.

Internal audits should be carried out by people who are competent to assess the processes in question and who bring appropriate objectivity and impartiality — this can be a trained member of staff auditing an area outside their own day-to-day work, or a trusted advisor like Goldenpath. External audits are carried out by your certification body's own auditors.

The duration depends on the size and complexity of your business. Internal audits can often be broken into manageable sections, minimising disruption to your daily operations. External audits typically take a day, though larger organisations may need two or three days to complete the process thoroughly.

And don't worry — auditors aren't there to catch you out. Their role is to verify that your processes align with the standard and to help you demonstrate conformance with confidence. Read more about how Goldenpath supports every audit through our ongoing compliance support.

There's no identical document pack that every business must produce. The documented information you need depends on your organisation, its processes, and the evidence required to demonstrate that your Quality Management System is operating effectively.

Typical examples include the quality policy and objectives, process or procedure information where needed, competence and training records, supplier evaluation records, monitoring and performance records, internal audit results, management review records, and nonconformity and corrective action records.

The aim isn't to create paperwork for the sake of it — documentation should support how your business actually operates and provide the evidence needed to show the QMS is being maintained. Our ISO 9001 consultancy service builds this around your existing processes rather than bolting on a generic template.

"Non-conformance" — it's the term that often causes the most concern when it comes to ISO certification.

But whether it's a mistake, a complaint, an error, or simply a misunderstanding, the reality is that things sometimes go wrong. And that's okay — we're all human.

What matters is how you respond. ISO provides a clear framework to help you identify and analyse the root cause of the issue, which often turns out to be different from what you first expected. From there, it guides you toward practical solutions to prevent it from happening again — turning problems into opportunities for continuous improvement. Our Managed Compliance service handles non-conformance tracking and corrective actions for you on an ongoing basis.

ISO certificates are valid for 3 years. Annual surveillance audits are required in years 1 and 2 to maintain certification, followed by a full recertification audit in year 3. This applies across ISO 9001, ISO 14001, ISO 27001 and ISO 45001. Goldenpath's Managed Compliance retainer handles surveillance audit preparation so your certificate stays active without extra admin on your end.

Yes. A certificate can be suspended or withdrawn if a major nonconformity raised at a surveillance audit isn't resolved within the required timeframe, or if the business stops operating its management system as documented. Staying on top of internal audits and corrective actions is the best way to protect your certification long-term.

ISO certification is voluntary in the UK — there's no legal requirement to hold it. However, many tenders, contracts, and enterprise clients require it as a condition of doing business, which is why most SMEs pursue it for commercial rather than legal reasons.

Not every UK tender requires ISO certification, but some buyers and procurement frameworks specify particular ISO standards as a requirement, or use certification as evidence that appropriate management systems are in place. Always check the tender documents carefully — if ISO 9001, ISO 14001, ISO 45001 or another standard is specified, check whether certification needs to already be in place and whether the buyer requires certification from a UKAS-accredited certification body. Our ISO consultancy services can help you work out what a specific tender needs and how quickly you can get there.

A consultant like Goldenpath helps you build, implement, and prepare your management system for audit. A certification body independently audits your system and issues the certificate. Choosing a UKAS-accredited certification body provides independent assurance of that body's competence, and UKAS-accredited certification is often required or preferred by customers, tenders and supply chains. A consultant cannot certify you; the two roles are kept separate to ensure impartiality.

Yes. ISO 9001, ISO 14001, ISO 45001 (and ISO 27001, if you need it) share the same high-level structure, which makes it straightforward to integrate them into a single Integrated Management System (IMS) rather than running separate systems side by side. This allows shared processes — such as document control, internal audits, management review and corrective action — to serve all the standards at once, where appropriate. It usually avoids duplicate documentation and is more cost-effective than certifying each standard separately.

You won't simply "fail" — auditors raise non-conformances rather than pass/fail verdicts. A minor non-conformance gives you time to submit a corrective action plan. A major non-conformance must be resolved, often within 90 days, before certification can be granted or maintained. Your consultant and certification body will guide you through the process.

Certification is the beginning, not the end. ISO certificates require annual surveillance audits in years 1 and 2 and a full recertification audit in year 3. Your management system also needs to be actively maintained between audits — updating documents, completing internal audits, managing nonconformities and corrective actions, and reviewing objectives. Keeping on top of this is what allows a surveillance audit to confirm your system is working well, rather than raising findings that need resolving to keep your certificate active. Goldenpath's Managed Compliance retainer takes all of that off your desk completely.

Managed Compliance is Goldenpath's recommended monthly retainer for businesses that want to stay certified without adding to their management workload. It includes ongoing internal audits, system updates, corrective action management, regular check-ins, and full audit-day support — so your certificate stays active year after year with no last-minute panic.

On average, clients using Managed Compliance save 6–12 hours per month across their leadership and operations team compared to managing it themselves.

A Readiness Sprint is a fixed-fee project designed to get you certified as efficiently as possible — gap analysis, system build, documentation, and pre-audit preparation. It's ideal if you're working towards a tender deadline or want to achieve certification for the first time. Managed Compliance is the monthly retainer that takes over once you're certified, handling all the ongoing maintenance, audits and updates so your certificate stays valid. Many clients start with a Readiness Sprint and roll straight into Managed Compliance.

Yes. Goldenpath offers add-on support for EcoVadis, Constructionline, Achilles, and EN 1090 accreditations, which can be integrated into your existing ISO management system. These are particularly useful for companies strengthening their tender submissions and supply chain credibility. They're designed to expand your compliance without creating duplicate documentation or extra overhead.

Yes — this is something we do regularly. If you're already certified but your current management system has become a burden, your previous consultant has moved on, or you simply want more reliable ongoing support, Goldenpath can step in and take over. We'll carry out a review of your existing system, identify any gaps, and transition you into our Managed Compliance retainer with minimal disruption. Call us on 01553 341004 to discuss.