ISO certification projects have a well-understood structure: gap analysis, documentation, implementation, internal audit, management review, then the certification body's stage 1 and stage 2 audits. Yet many run months late. The reason is rarely the consultant's work. It's the client's.
Why ISO projects overrun
- The client's team is busy with day-to-day work.
- Policy and procedure approvals sit with one senior person.
- Records needed as evidence aren't kept until someone asks.
- The certification audit is booked before the system has run long enough.
Plan the whole journey up front
Lay out every stage with dates, owners and outputs:
- Gap analysis against the standard.
- Documentation: policies, procedures, risk assessment, and for ISO 27001, the statement of applicability.
- Implementation: training, running the processes, keeping records.
- Internal audit.
- Management review.
- Certification audits: stage 1 and stage 2.
Share the plan with the client and get named owners on their side for each part.
Track what you need from the client
Most delays are about the client's inputs: approvals, evidence, people's time. Keep a checklist of everything you need from them, with due dates, and review it every week.
Allow time for the system to run
The certification body wants evidence that the system works in practice: records, internal audit results, a management review. Plan enough time between implementation and the stage 2 audit.
Bill by stage
Staged billing keeps the project moving and reflects the work done: a share at the gap analysis, during implementation, after the internal audit, and at certification.
How MSMEPulse helps
MSMEPulse includes ISO 9001 and ISO 27001 implementation templates with each stage as a milestone, tasks by role, and a checklist of client documents and approvals. The client sees progress and uploads evidence in their portal, and each stage is invoiced when it's complete.
