Ask ten people what ISO “requires” and you’ll get twelve answers, most of them longer than the standard itself.
That’s the problem.
Somewhere between the clauses and the certificate, a lot of organisations invent a second rulebook: more procedures, more forms, more meetings, more evidence “just in case”. Then they blame ISO for the weight.
ISO didn’t ask for half of it.
Minimum viable isn’t “barely scraping through”
Let’s be precise.
Minimum viable ISO means: meet the requirements of the standard, in a way that fits how your business actually runs, with enough evidence that a competent UKAS-accredited auditor can verify it.
It does not mean:
- Cutting corners on real controls
- Buying a non-UKAS certificate and hoping nobody checks
- Copy-pasting a generic manual and calling it implemented
There’s a difference between lean and hollow. Accendo is interested in the first.
What you generally do need
Without turning this into a clause-by-clause lecture, most ISO 9001 systems for SMEs stand on a familiar set of pillars:
- Leadership and accountability, someone owns the system; policies aren’t wallpaper
- Understanding context and risk, proportionate, living, not an annual essay
- Clear processes, how work gets won, planned, delivered, checked, and improved
- People and competence, right skills for the work, with records that make sense
- Controlled information, current versions used; obsolete stuff not floating around
- Operational control, including suppliers/subcontractors where they affect outcomes
- Checks, monitoring, internal audit, customer satisfaction (not necessarily a survey)
- Fix and improve, NCRs that lead to action; management review that makes decisions
ISO 14001 adds environmental aspects, compliance obligations, and operational controls for significant impacts, still proportionate to what you actually do, not a university dissertation on the biosphere.
That’s the skeleton. Flesh it with your work, not with someone else’s template library.
What you often don’t need
This is where we call BS on the folklore:
- A procedure for every clause → Documented information only where required or useful
- A 40-page quality manual → Many SMEs run fine without a traditional manual
- Customer satisfaction questionnaires → ISO wants you to know satisfaction, method is yours
- Exhaustive legal registers → Relevant obligations, not Victorian kite laws
- Identical paperwork for every supplier → Risk-based control beats equal bureaucracy
- Week-long internal audits → Focused, risk-based sampling can be hours
- Printing everything for the auditor → Searchable digital evidence is normal
If something exists only because “we thought ISO wanted it”, test that assumption. Often it fails.
How to find your minimum
A practical sequence we use with clients:
- Gap against the standard, honestly
Map requirements to what you already do. Construction firms usually have more control than they think: inductions, method statements, inspections, ticket systems. ISO is often about connecting and proving, not inventing a parallel universe. - Separate required / useful / junk
Required: keep. Useful: keep if it helps delivery. Junk: delete or stop doing it. This single exercise kills more admin than any new software purchase. - Digitise the spine
One evidence home. Clear naming. Expiry reminders. Simple workflows for NCRs and actions. You’re not buying “an ISO system” for theatre, you’re removing friction from the minimum you already decided to keep. - Use AI where it accelerates humans
First-pass drafts of procedures that match how work runs. Summaries for management review. Extracting dates from certificates. Consistency checks before an audit. Humans approve; machines speed the boring middle. - Audit the system you actually run
Internal audit should sample reality. If the documented system and the site disagree, fix the system, don’t invent more fiction for the folder.
Why this matters commercially
Every hour spent on non-required admin is an hour not spent on delivery, clients, and cashflow. Your customers don’t pay for your procedure count. They pay for work that turns up right.
A minimum viable system:
- Survives surveillance without a heroic scramble
- Is explainable by the people who use it
- Scales when you add 14001 (or another standard) without doubling the paperwork
- Makes UKAS certification look like what it should be: proof of control, not proof of filing
The Accendo position
We help SMEs design ISO systems around minimum requirements and real operations, then use digitisation and sensible automation so maintenance stays light.
If your current system feels heavy, the answer usually isn’t “try harder”. It’s “strip it back to what the standard actually demands, then make that spine easy to run.”
Want a straight gap view of what’s required vs what’s just accumulated? Let’s talk.
Accendo Consultants: lean ISO, UKAS-credible, built for how you work.
https://accendo.org.uk/
