First ISO certification for mid-market teams: what “ready” means

Picking a registrar is one job. Writing the RFQ is another. This page sits upstream of both: are you actually ready to send a scope pack and book Stage 1?

It is written for mid-market manufacturers and professional-services firms — typically operations, quality, IT, or compliance leads — about to run their first registrar RFQ for ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001.

It does not teach you how to choose a certification body. It does not teach you how to write the outbound pack. It does not walk what happens at Stage 1 and Stage 2. Those chapters assume the system exists. This one asks whether it does. It does not invent prices, day-rate totals, or accreditation identifiers.

1. First certificate versus adding a standard later

A first certificate and a later add are different procurement problems. Treat them that way.

First certificate. You are buying a management-system habit, not a logo. The organization has to learn scope, documented information, internal audit, management review, and how an independent auditor samples work. That learning is cheaper on a standard you already half-operate than on a fashionable number nobody owns.

Adding a standard later. You already have a registrar relationship, a surveillance calendar, and (if you were honest) a living system. The add is a scope extension or a second certificate — still an RFQ, still Stage 1 for the new scheme, but you are not inventing owners from zero. If you already hold a mark and the question is stay-or-move, that is transfer, not this page.

For most mid-market manufacturers, the first certificate is ISO 9001. Customers, primes, and export paperwork still start there. 14001 and 45001 often land beside it as an operations stack. That is rational. Whether those three belong on one CB RFQ this cycle is the IMS buying guide — after the QMS exists. If the argument on this first RFQ is only ISO 9001 or ISO 14001, use the ISO 9001 vs ISO 14001 comparison. If the argument is only ISO 9001 or ISO 45001, use the ISO 9001 vs ISO 45001 comparison. If the argument is only ISO 14001 or ISO 45001, use the ISO 14001 vs ISO 45001 comparison. The mistake is treating the first RFQ as a shopping trip for every standard a salesperson mentioned.

For professional-services and IT-led firms, 9001 is still a good teacher if you deliver repeatable client work. Many of you will meet ISO/IEC 27001 first because a questionnaire, insurer, or enterprise customer made it the gate. That is also rational — if the ISMS exists. A security badge on a bid form is not a system.

When 27001 or 42001 is the forced gate this cycle. Start there only when a customer, portal, or bid will not let you through without that mark and you can show the work: information-asset scope and a used Statement of Applicability for 27001; an actual AI management system for 42001, not a slide about copilots. Do not invent an AIMS because a competitor put 42001 on a homepage. Sequence and later-add habits live on the 9001 → 27001 → 42001 path. If the room is still torn between 9001 and 27001 for this RFQ, the head-to-head buying comparison is ISO 9001 vs ISO 27001. If the room is torn between 27001 and 42001, the comparison is ISO 27001 vs ISO 42001. If the room is torn between 9001 and 42001, and 27001 is not the choice this cycle, the comparison is ISO 9001 vs ISO 42001. This page only requires that the standard on the first RFQ is one you can staff. If the missing piece is who may approve a model rather than a certificate, ChiefAIOfficer.com publishes a mid-market operating cadence — readiness work, not this RFQ.

If 27001 or 42001 is twelve to twenty-four months out, it is a later add. Do not put it on the first pack to “get a number.”

2. What “ready for Stage 1” means in practice

Stage 1 is a design review of readiness, not a dress rehearsal for Stage 2. What the visit does sits in Stage 1 versus Stage 2. What “ready” means before you invite a body is four facts you can defend in a room:

Scope sanity. You can name the legal entity, the standards and editions this cycle, the sites the certificate will claim, and the exclusions you will actually defend. “ISO, about 400 people, headquarters” is not a scope. If two plants, a warehouse, and a sales office all do certified work, the map is a multi-site problem — one pointer, then stop. A location left off because travel is annoying is under-scoping, not an exclusion.

Documented processes that match reality. Procedures, work instructions, and (for 27001) a Statement of Applicability that describe the company you operate on Tuesday, not the company the consultant sketched in March. Stage 1 will sample whether documented information exists where the standard expects it. Stage 2 will walk the floor. If the SOP says first shift and the line runs two, you are not ready. If the SoA claims a cloud estate nobody can show, you are not ready.

Internal audit and management review that are not orphan binders. The standard expects you to have audited this system and reviewed this system before an external body designs Stage 2. A folder labeled “internal audit” from a previous consultant engagement, or a management-review agenda that never names the processes in scope, will not survive a competent Stage 1. The audits do not need to be pretty. They need to have found something, assigned owners, and closed or carried findings. A review that rubber-stamps “we are ready for certification” with no inputs is theater.

Named owners. Someone can answer “who owns the system?” without a committee. Process owners can speak without reading a script. You know who the auditor will interview on the floor or in the practice. If that list is blank, you are collecting quotes for a programme nobody can staff.

You do not need a perfect system. You need a true one. Stage 1 is allowed to find gaps. It is not supposed to discover that the system was a plan.

3. People checklist

Write names, not roles on an org chart. If you cannot fill a row, you are not ready to send an RFQ.

Seat	What “named” means	What “missing” looks like
Management-system owner	One person who owns documented information, internal audit, management review, and the authority to make the rest of the company follow the same rules	“Quality and operations share it”; an external consultant who will not be in the closing meeting
Process owners	People who run the processes in scope and can describe them without a binder	A quality engineer answering for CNC, receiving, and purchasing because the supervisors are “too busy”
Shop-floor / practitioner voices	Operators, technicians, case leads, or developers who do the work the certificate will claim	A conference room of managers; the people who know where the system is weak kept off the list
IT / security (27001 / 42001)	Someone who can walk access, incidents, suppliers, and (for 42001) how a model is approved or retired	The quality lead holding the SoA; “we’ll bring IT in at Stage 2”
Executive	A leader who can speak context, policy, and resources at opening and closing	A signature on a quality policy and an empty calendar for the visit

The management-system owner is not always the quality manager. In a plant it often is. In a professional-services firm it may be operations or compliance. In an ISMS it is often a security lead who still has to borrow 9001 habits. What matters is one named owner, not a steering committee that meets after the RFQ goes out.

Process owners have to be real. Auditors sample. They will pick receiving, calibration, nonconforming product, access reviews, or a client-delivery process you did not polish. If the only person who can talk is the consultant who wrote the procedure, Stage 2 will notice.

Shop-floor and practitioner voices are not a courtesy. They are how the auditor tests whether the system lives. Hide them and you lose time; they get found anyway.

If 27001 or 42001 is in this cycle, IT and security are not an add-on interview. They own evidence. Quality cannot walk a privilege review from a shared drive.

You do not need everyone available every day of a future visit. You need to know who they are before you ask a certification body to design days.

4. Sites checklist

The RFQ will ask for a site list. Readiness is whether that list is true.

One site. Name the building, the legal entity on the door, the headcount band in that building (plus in-scope contractors), the processes, and the shifts. A single-site programme can skip the multi-site table. It still cannot hide a second shift or an overflow warehouse “we use sometimes.”

More than one site. If more than one location does work the certificate will claim, you have a multi-site programme. Name the central function — the site that owns documented information, internal audit, and management review. How to decide when a warehouse is a site, when an exclusion is honest, and how sampling works is multi-site certification scope. This page only requires that you do not send “several locations” as a headcount.

Headcount bands. Per site, not a company-wide about-page number. Include people who do the in-scope work even if they are contractors. Exclude a corporate function only if it is truly out of the system and you will defend that at Stage 1. Bands exist because quoting managers design from ranges. A fake precise headcount that omits the night shift is worse than “80–120, two shifts.”

Shifts. First only, two-shift, continuous, seasonal peak. Silence here is how Stage 2 discovers interviews you never staffed and how two bodies return unlike programmes. If the line runs nights during a customer ramp, say so. If professional-services delivery is follow-the-sun, say so.

27001 / 42001 site honesty. The plant list for 9001 is not automatically the ISMS or AIMS site list. Information and AI work often live at headquarters, a development office, or a cloud estate the factory certificate never named. If this cycle is 27001 or 42001, name those locations. If they are a later add, leave them off this pack.

If you have not walked the floor (or the remote equivalent) with a site table in hand, you are not ready to collect day counts.

5. What not to fake

Certification bodies are independent. They sample. Paper that does not match Tuesday will not become a certificate because the RFQ was tidy.

Paper systems. Policies printed for the visit, procedures nobody can find on the floor, a risk register last saved before the last reorg. Stage 1 asks whether documented information exists. Stage 2 asks whether it is used. A beautiful manual that the supervisors have never seen is a finding, not a head start.

Consultant-only binders. Implementation help is legitimate. A system that lives only in the consultant’s folder is not. If the people who do the work cannot retrieve the procedure, name the record, or describe the last nonconformity without calling the consultant, you are not ready. Disclose who implemented the system — that fact belongs on the later pack — but disclosure does not replace ownership.

Under-scoped sites. Leaving off a warehouse, a second plant, a satellite office, or a development shop because it complicates the quote. Stage 1 asks whether the scope is sane. Surveillance will sample whether the wall still matches the network. Under-scoping is how “cheap” programmes become change-orders and findings. It is also how two CBs return unlike day counts and you blame price.

“We’ll finish SOPs after Stage 1.” Stage 1 is the readiness gate. Booking it to create deadline pressure is a common mid-market habit. It produces written findings, a delayed Stage 2, and a quoting manager who now knows you scoped a plan. Finish the system you will claim. Then send the pack. If a procedure is genuinely in revision, say that on the pack as a known gap — do not pretend the set is complete.

Other fakes that die in the same room:

• An internal audit programme that never audited the processes in scope.
• A management review that exists as a calendar invite.
• A 27001 SoA that copies Annex A with no “not applicable” that you can defend.
• A 42001 line for a pilot chatbot nobody governs.
• A promise that IT will “get involved once we have dates.”

You can be imperfect. You cannot be fictional.

6. Consultant versus CB independence

Keep this short. Who sells implementation versus accredited certification is consultant vs certification body. The lookup is how to verify accreditation.

ISO/IEC 17021-1 restricts certification bodies from certifying a management system they consulted on. The firm that wrote your procedures should not be the firm that issues the certificate. Gap assessments a CB sells are bounded; implementation is yours or a disclosed consultant’s.

Before you send an RFQ:

• Name who implemented the system (internal, named consultant, or none).
• Do not invite the implementer as a certifier.
• Do not let a referral fee you will not disclose steer the shortlist.

Independence is a fact on the pack, not a personality test. Readiness includes knowing that fact. It does not include running the accreditation lookup on this page — do that before you award, off-site.

7. A 90-day readiness outline (not a guarantee)

This is a planning sketch a quality lead can run before the RFQ. It is not a priced project, not a promise that Stage 1 will land on day 91, and not a substitute for your own risk. Plants in the middle of a launch, professional-services firms in busy season, and ISMS programmes with no asset inventory will take longer. That is information, not failure.

Window	What the quality lead actually does
Days 1–15	Freeze the standard(s) for this cycle. Name the management-system owner. Walk sites with a draft list: legal entity, processes, shifts, headcount bands. Write exclusions you will defend. Decide first certificate versus later add.
Days 16–45	Make documented information match the walk. Kill orphan procedures. Give process owners their processes. Run or finish an internal audit of this system; log findings with owners. If 27001 is in cycle, make the SoA a used document. If 42001 is in cycle, name where models are approved — or take it off the pack.
Days 46–75	Hold a management review that uses the audit results, customer or questionnaire pressure, resources, and remaining gaps. Close or schedule the findings you cannot live with at Stage 1. Confirm the people checklist with calendars, not wishes.
Days 76–90	Re-walk the site list. Confirm nothing material changed. Write the one-page pack (RFQ / scope pack). If a row is still an argument, do not send. If the facts are true, send the same pack once.

Three habits that keep this from becoming another binder:

• Audit before you invite. An internal audit that finds nothing in a mid-market plant or ISMS is usually an audit that did not look.
• Review before you invite. Management review is an input to Stage 1, not a celebration scheduled after the certificate.
• Owners before logos. Do not open the directory until the people and sites tables have names.

If day 90 arrives and the site list is still political, wait. A stale pack produces unlike quotes. A true pack can wait a month; a fake one cannot be unsent cleanly.

8. When to send the RFQ versus wait

Send when all of these are true enough to put on one page:

• You know which standard is this cycle (first certificate or a later add you can staff).
• Scope, sites, headcount bands, and shifts are no longer an argument.
• Documented processes match the work, including a used SoA if 27001 is in cycle.
• Internal audit and management review have touched this system, with named owners and open items you can explain.
• The people checklist has names, including IT/security if 27001 or 42001 is in cycle.
• You know who implemented the system, and they will not be the certifier.

Wait when any of these are still true:

• The warehouse, second shift, or development office is a fight, not a line on a table.
• SOPs will be “done by Stage 1.”
• The only person who can speak the system is the consultant.
• Management review is a placeholder.
• 42001 (or 27001) is on the pack because it looks current, not because the work exists.

Waiting is not timidity. It is how you avoid buying unlike day counts and a Stage 1 that exists to write findings you already knew.

When the facts are true, switch chapters. Write one outbound pack — how to build a registrar RFQ / scope pack — and send it to every body you might award. How to pick those bodies is how to choose a registrar. What the visits will actually do is Stage 1 versus Stage 2. Once the system is real enough to quote, the buying calendar from that pack through certificate issue and first surveillance is how long ISO certification takes. This page is only the gate: ready or not.

If you are ready, submit that pack with the Get quotes button below. Do not send a thinner story to the logo you already like. Do not collect prices before the page is written. Do not treat this site’s directory tags as a live accreditation feed.