If you are preparing for ISO certification, your first question may be simple: what documents do I need? Business registration details are a starting point, but management system certification also involves evidence of how your organisation works.
The documents required for ISO certification depend on the standard, certification scope, business activities, and applicable requirements. There is no universal bundle of identity documents that completes certification for every company.
This guide separates application information from management system documentation. It will help you organise existing records, identify gaps, and request a checklist that fits your business before spending time on unnecessary paperwork.
Understand the two types of certification documents
The first group identifies your business and helps define the application. These details allow the service provider and certification body to understand the organisation, activities, locations, and audit requirements.
The second group demonstrates how your management system operates. Policies explain commitments, procedures describe relevant working methods, and completed records show what actually happened.
For example, a blank customer complaint form is a template. A completed complaint record showing the issue, investigation, response, and follow-up provides evidence of implementation. Auditors need to assess that implementation, so purchasing a folder of templates is not enough.
Business information to prepare for the application
Your provider may request the following information, depending on your legal structure and certification arrangements:
· Legal business name and trading name, where different.
· Registration or incorporation evidence appropriate to the organisation.
· Registered address and the locations proposed for certification.
· Description of products, services, and principal activities.
· Employee numbers, shifts, and relevant outsourced processes.
· Authorised contact person’s name and contact details.
· Existing certificates, if transferring or extending certification.
· Relevant customer, contract, or tender requirements.
PAN, GST, Udyam registration, or address evidence may be requested where relevant. They are not universally mandated by every ISO management system standard. Ask why each item is needed and provide applicable documents through an agreed secure channel.
Management system scope and process information
Your scope should explain which activities, services, and locations the management system covers. Keep this consistent with your business description and intended certificate wording.
A process overview helps demonstrate how work moves through the organisation. For a trading business, this might cover enquiry handling, purchasing, receipt of goods, storage, dispatch, and complaints. A digital service business will have different processes.
You can present this information in a simple flowchart or written description. The important point is that responsibilities and handovers are clear. Avoid including activities your business does not perform simply because they appear in a generic template.
Policies and measurable objectives
Prepare the policy and objectives required by the selected standard. These should connect to your business priorities and the management system’s purpose.
For quality management, a useful objective might concern order accuracy or timely completion of work. Define how you will measure progress, who will monitor results, and what happens when performance falls short.
As an illustration, a service team could track the proportion of projects delivered by the agreed date. The relevant records might include promised dates, completion dates, reasons for delay, and review actions. The measure should help the business make decisions, rather than exist only for an audit.
Operating procedures and evidence of completed work
Identify the instructions your team needs to perform work consistently. Depending on your activities, these might cover customer requirements, purchasing, service delivery, inspection, maintenance, or handling mistakes.
Then gather records showing those processes in use. Examples include approved orders, delivery checklists, supplier evaluations, inspection results, and complaint responses. These examples are not a mandatory list for every organisation.
For businesses preparing for ISO 9001 certification, relate each record to a process or requirement. A practical question is: what evidence would help us demonstrate that this task was completed correctly?
Training and competence records
Your team needs the competence required for its responsibilities. Relevant evidence might include qualifications, experience, training records, supervised practice, or assessments of ability.
Attendance alone may not demonstrate that someone can perform a critical task. Where appropriate, record how competence was evaluated and what further support was needed.
For example, a warehouse supervisor could assess whether an employee follows the dispatch checking process correctly. Keep that evidence accessible and update it when responsibilities change. The record can be simple, provided it clearly identifies the person, task, assessment, and outcome.
Risk information and standard-specific records
The required evidence changes with the management system. An information security programme needs different supporting records from an environmental programme.
- For ISO 27001 certification, key documentation includes information security risk assessment and treatment information, plus a Statement of Applicability explaining necessary controls and relevant inclusion or exclusion decisions. Supporting evidence depends on the controls selected and implemented.
- For ISO 14001 certification, relevant information concerns environmental aspects, impacts, compliance obligations, operational controls, and performance. Examples could include waste handling records or monitoring results where applicable.
- For ISO 45001 certification, evidence relates to hazards, health and safety risks, worker consultation, controls, incidents, and other applicable requirements. A workplace with machinery will need a different practical evidence set from a small office.
Confirm the applicable standard edition and scope before finalising your checklist. Do not assume one documentation pack fits all these standards.
Internal audit and management review records
Internal audit records show what was checked, the evidence considered, findings, and follow-up. They should allow another person to understand the audit without relying entirely on the auditor’s memory.
Management review records should capture the relevant inputs considered and decisions made by leadership. Record actions, responsibilities, and resource decisions clearly enough to support follow-up.
If a review identifies repeated supplier delays, document the decision and subsequent action. For instance, the business might revise supplier approval criteria or develop another supply option. The useful evidence is the link between the problem, decision, action, and result.
Corrective action and improvement records
When something goes wrong, retain appropriate evidence of the issue and the response. A practical corrective action record can explain the problem, immediate correction, cause, action owner, completion date, and effectiveness check.
Avoid recording “staff advised” as the answer to every recurring problem. If an unclear instruction caused the issue, revise that instruction and check whether the change works.
The exact format can vary. A controlled spreadsheet, approved form, or suitable software record may work, provided it captures the required information and your team uses it consistently.
How to organise documents before an audit
Create folders or a document register that makes current information easy to find. Separate working templates from completed records, and identify who owns each key document.
Use sensible version control so employees do not follow obsolete instructions. Establish appropriate access, backup, retention, and disposal arrangements for the information you hold.
Check a sample of records before the audit. Can you trace a customer order through delivery? Can you show what happened after a complaint? Practical checks reveal missing evidence more effectively than counting how many files are in a folder.
If your team is unsure where to begin, ask Get ISO Certificate about your documentation requirements. Share your standard, business activity, and the records you already maintain.
Frequently asked questions
Is a quality manual compulsory for every ISO certificate?
No universal rule makes a quality manual mandatory for every ISO standard. Requirements vary by standard and edition. For ISO 9001:2015 specifically, ISO’s guidance treats a quality manual as a possible document, rather than a universally required one. Check your applicable requirements.
Can we use digital documents and records?
Yes, documented information can be electronic. Your arrangements still need to keep it usable, appropriately controlled, and available when required. Agree secure access arrangements for audit evidence, particularly where records contain customer or employee information.
Can we start if some documents are missing?
You can begin a readiness discussion using the information available. Identify the missing requirements and plan how to address them. Do not create false historical records or backdate evidence; demonstrate actual implementation and discuss readiness before scheduling the certification assessment.
Request a checklist for your business
An effective ISO documentation checklist reflects your operations and chosen standard. Start with existing records, improve what is useful, and create additional documents only where requirements or business needs justify them.
Contact Get ISO Certificate for documentation guidance with your industry, location, team size, preferred standard, and target date. Include any buyer requirement so the discussion can address the certification you actually need.