IgeraIndustria Quality Team · Updated 2026-08-02 · 8 min read
ISO 9001:2015 sets the same requirements for every certified organisation, but the standard is deliberately written to be scaled. A 20-person machine shop and a 4,000-employee multinational both satisfy clauses 4–10 — they just do it with radically different scope, headcount dedicated to quality, documentation volume, and internal audit structure. Copying a large-company QMS template onto a small business creates unnecessary bureaucracy; scaling a small-company approach onto a multi-site group leaves gaps auditors will find.
ISO 9001 has no size threshold. There is no separate "small business" version of the standard, and no clause says an SME can skip management review or an internal audit programme. What changes is not what you must do, but how much structure is proportionate to do it well. Understanding that distinction is the difference between a QMS that supports the business and one that strangles it in paperwork nobody reads.
1,220,000+
ISO 9001 certificates issued worldwide across 170 countries — the majority held by small and medium-sized enterprises, not large corporations
Source: ISO Survey 2023
Scope of the QMS: one site vs. a group of legal entities
Clause 4.3 requires every organisation to define the boundaries and applicability of its QMS — but what counts as "the organisation" looks completely different depending on size.
In an SME, scope is usually simple: one legal entity, one or two sites, one set of processes from quote to delivery. The scope statement can often fit in two sentences and the QMS boundary maps directly onto the org chart.
In a multinational, scope decisions are strategic. Does the certificate cover a single plant, a country subsidiary, or the whole group under one multi-site certification scheme? Multi-site certification (a recognised model used by certification bodies such as BSI, Bureau Veritas, SGS, and LRQA) allows a central function plus a sample of sites to be audited each year, rather than every site every year — but it requires a genuinely centralised management system, shared procedures, and a functioning internal audit programme that reaches every site over the certification cycle. Getting this wrong means either paying for audits at every location every year, or building a false "shared" system that does not reflect how sites actually operate.
Resources: who actually owns quality
| Aspect | Typical SME (under 50 staff) | Typical multinational (multi-site) |
|---|---|---|
| Quality role | Quality is one of several hats worn by the operations manager, technical director, or owner | Dedicated quality director plus site-level quality managers reporting into a group function |
| Internal audits | A handful of trained staff auditing each other's areas, often once a year, using a simple checklist | Dedicated internal audit team or trained auditor network, rolling annual programme across sites and processes |
| Management review | One meeting, owner and a couple of managers, minutes on one page | Structured cascade — site review feeding a group-level review, formal agenda against every Clause 9.3 input |
| Documented information | A few dozen procedures and forms, often in one shared folder | Hundreds to thousands of documents, formal document control system, multiple revision states across sites and languages |
| Supplier evaluation | Short approved supplier list, informal review based on delivery and quality history | Formal supplier scorecard system, audits of critical suppliers, sometimes a dedicated supplier quality engineering function |
Neither approach is wrong under ISO 9001 — clause 5.3 simply requires that responsibilities and authorities are assigned and communicated, whatever the size of the team assigning them. Auditors from UKAS-accredited certification bodies are trained to assess proportionality: they do not expect an SME to have a dedicated quality department, but they will expect the person or people responsible for quality to be genuinely competent and empowered, not just named on an org chart.
Documentation load: the SME trap and the multinational trap
The two most common implementation failures sit at opposite ends of the size spectrum.
The SME trap: over-documenting. Many small businesses hire a consultant who hands over a generic, oversized procedure set originally built for a much larger organisation. The result is a QMS nobody follows in practice because it describes a bureaucracy the company does not have — a document control procedure that references committees that do not exist, or a training matrix that requires sign-off from roles nobody holds. Clause 7.5 requires documented information "to the extent necessary" — for a 15-person shop, that might genuinely mean one-page work instructions and a shared spreadsheet for nonconformities, not a 40-tab management system.
The multinational trap: under-integrating. Large groups often already run ERP systems, existing quality tools (SPC software, PLM, supplier portals), and site-specific procedures built up over years of acquisitions. The failure mode here is treating ISO 9001 as a parallel paperwork exercise instead of mapping it onto systems that already exist. Auditors increasingly expect to see the QMS embedded in the tools people actually use daily, not a separate binder that only appears during audit week.
// IgeraIndustria RAG demo — scoping a multi-site QMS query
Group Quality Director: Which of our four plants are due for internal audit this quarter under the multi-site sampling plan, and which procedures differ between the Leeds and Katowice sites?
IgeraIndustria: Under your multi-site internal audit schedule (IA-PLAN-2026, Rev 3), Leeds and Katowice are due for on-site audit this quarter; Turin and Lyon were audited in Q2. Comparing document sets: Leeds uses WI-PACK-014 (Rev 5) for final packaging, while Katowice runs a locally adapted version, WI-PACK-014-PL (Rev 2), which adds an extra label-verification step required by the site's automotive customer. This is the only substantive deviation between the two sites' packaging procedures — all other clause 8.5 documents are identical across the group index.
Cost and timeline: not just a multiple of headcount
It is tempting to assume a multinational simply costs "N times" what an SME pays, but the relationship is not linear. A single-site SME implementation is dominated by building the QMS from scratch — writing procedures, training staff, running the first internal audit cycle. A multinational implementation is dominated by coordination: aligning terminology and processes across sites that may have grown up with different ERP systems, different languages, and different local quality cultures, then agreeing what is genuinely common (and certifiable once) versus what must remain site-specific.
This is exactly why a one-size-fits-all consultancy package or software template underperforms at both ends. If you want a realistic, size-adjusted figure rather than a generic industry average, calculate the exact cost for your company using IgeraIndustria's ISO 9001 cost calculator — it accounts for headcount, number of sites, and current documentation maturity rather than applying a flat SME-vs-large-company multiplier.
Where the requirements genuinely do not change
A few clauses are worth flagging because organisations of every size sometimes assume — wrongly — that they scale down to nothing:
- Management review (Clause 9.3): still mandatory, still needs to cover every listed input (customer satisfaction, audit results, process performance, nonconformities, corrective actions, resource adequacy, risk/opportunity status) — a 20-minute conversation with no record is not compliant, regardless of company size.
- Internal audits (Clause 9.2): an SME cannot skip the programme because it "already knows what's wrong." The audit must be planned, cover the whole QMS over a defined interval, and be conducted with a degree of independence from the process being audited.
- Corrective action (Clause 10.2): root-cause analysis and effectiveness review are required whether the nonconformity happened in a 10-person workshop or a 3,000-person plant.
- Competence and awareness (Clauses 7.2–7.3): every person whose work affects quality must be competent and aware of the quality policy and their contribution — this applies to a two-person production line exactly as it applies to a 24/7 multi-shift operation.
Why IgeraIndustria fits both ends of the spectrum
Whether your QMS is a shared folder of thirty documents or a multi-site library spanning several languages and revision histories, the underlying problem is the same: people need the right document, at the right revision, fast — during an audit, during a customer complaint investigation, or when a new starter needs to find the correct work instruction. IgeraIndustria indexes your existing documentation, whatever its scale, and makes it instantly searchable with citations back to the exact document and clause, so an SME does not need to hire a quality department just to keep documentation findable, and a multinational does not need every site to reinvent its own search process.
Frequently asked questions
Can a very small business realistically get ISO 9001 certified?
Yes. ISO 9001 has no minimum employee count. Certification bodies routinely certify businesses with fewer than ten staff, provided the QMS genuinely covers all applicable clauses at a scale proportionate to the business — simple procedures, a real internal audit, and a documented management review are enough; elaborate bureaucracy is not required and is often counterproductive.
What is multi-site certification and does my company qualify?
Multi-site certification is a scheme, recognised by IAF-aligned accreditation bodies, that allows one certificate to cover several locations of the same organisation under a central management system, with only a sample of sites audited each surveillance visit rather than all of them. Eligibility generally requires the sites to operate under the same management system, with centrally controlled procedures and an internal audit programme that reaches every site within the certification cycle. Your chosen certification body (BSI, Bureau Veritas, SGS, LRQA, TÜV, DNV, and others offer this) will assess eligibility during the application stage.
Should an SME copy a large company's QMS templates to save time?
This is one of the most common and costly implementation mistakes. Oversized templates create documentation that does not match how the business actually operates, which auditors flag as nonconformities during the certification audit ('say what you do, do what you say' is a core audit principle) and which staff simply stop following. It is faster and more durable to build lean procedures sized to the actual organisation from the outset.
Do multinationals need a separate ISO 9001 certificate for each country?
Not necessarily. If sites share a genuinely centralised management system, a multi-site certification scheme can cover multiple countries under one certificate with sampled audits. If sites operate largely independently with different management systems, separate certificates per site or per country are often more accurate and easier to maintain than forcing an artificial single scope.
How much does company size affect certification cost?
Audit duration under IAF MD 5 (the mandatory document certification bodies use to calculate audit days) is driven primarily by employee numbers and process complexity, so larger organisations pay for more audit days. However, per-employee cost is usually lower for larger organisations because fixed costs (initial gap analysis, document control system setup) are spread across more people and processes. Use a calculator that accounts for your specific headcount and site count rather than a flat SME-vs-large-company rule of thumb.
Not sure how much ISO 9001 will actually cost your business? Calculate the exact cost for your company in minutes.
Use the ISO 9001 cost calculatorContinue reading — ISO 9001 series
Article reviewed by IgeraIndustria Quality Team, updated 2026-08-02. References: ISO 9001:2015 Quality management systems — Requirements; ISO Survey 2023; IAF MD 1 (multi-site certification rules); IAF MD 5 (audit time determination).