Thinking of buying software with ready-made ISO 9001 documents? It’s possible — but beware of audit risks, culture mismatches, and long-term pitfalls.
At Yonder, we are in the unsexy, no-nonsense, but relevant business of electronic documentation. And we have customers who expect us to be ISO 9001 and ISO 27001 certified.
So what could be better than using our own software product to set up and manage our ISO 9001 / 27001 documentation?
We’ve been following this approach for more than 3 years, and have successfully achieved ISO 9001 and 27001 certification.
Without help from expensive consultants.
Without a single paper folder.
Without buying ten different software tools.
Interestingly enough, we get more and more interest from companies to buy our software for their own ISO 9001 / 27001 documentation. I am the Founder & CEO of Yonder, a B2B SaaS company that provides a documentation solution for controlled documents such as operations manuals, norms, regulations, etc. Therefore, ISO 9001 / 27001 documentation is right in the sweet spot of what our software was designed for: Every change request goes through an approval workflow, and changes are notified to users and groups only after the QM or CISO has approved the changes. Plus it’s easy to track changing ISO 9001 / 27001 norms.
These software features have given us good traction in the ISO 9001 / 27001 documentation space. Interestingly enough, we are increasingly asked if we could not just sell our software but also a copy of our ISO 9001 / 27001 documents for the client to get started quicker with their own ISO 9001 / 27001 documentation.
Here are the pros and cons.
The Pro’s
1. Use what has worked in an audit before
The world of ISO 9001 / 27001 is special. Just from reading the norm, it’s hard to translate the essence into your daily work and formulate it so that the auditor will like it. If you are under time pressure to complete your ISO 9001 / 27001 certification, using another company’s documentation might kick-start your efforts.
However, make sure you’re only using another company’s documentation after it has successfully passed the certification audit.
2. Economies of scale
Except for ISO 9001 / 27001 consultancies, getting ISO 9001 / 27001 certified is no company’s core business. Therefore, steal with pride, and keep focusing on your core business.
3. Same size of company
Using another company’s ISO 9001 / 27001 certification works well if the two companies are similar in size. Typically, it’s small and medium-sized companies who reach out to use our ISO 9001 / 27001 documentation — that makes sense, as we are also a small and medium-sized company. However, it wouldn’t make sense to use our ISO 9001 / 27001 documentation in a large enterprise or use a large enterprise’s documentation in a small or medium-sized company.
The Con’s
1. You will be alone in the audit
In my opinion, one of the reasons why we passed all our ISO 9001 / 27001 without major findings is because we were really on top of the content of our documentation. Remember, we’ve written it all by ourselves, from scratch. That will be different if you use somebody else’s documentation; the auditor will notice when you’re not on top of the content of your documentation. So therefore, you will need to factor in enough time to adapt the documentation, and thoroughly get to know the content.
Don’t forget to have your entire team get to know the content — certification audits typically include not just interviews with the CEO and the QM, but with randomly chosen colleagues as well.
2. It’s a process, it’s not over after the audit
ISO 9001 / 27001 is not just about a single approval, it’s a process. It needs to be maintained after the certification audit, and there are maintenance and recertification audits after certain periods.
So if you’re not prepared to live the process after the certification audit, you’ll crash-land your efforts at the first maintenance audit.
3. The cultural thing
Processes are often an artifact of company culture. They are the description of “how we do things around here”. If you copy another company’s ISO 9001 / 27001 documentation, you need to understand its organizational culture and map it to your own culture. If you don’t, you’re running the risk that your team is alienated by “your” processes and doesn’t stick to “your” processes. If that happens, the whole exercise of getting certified was for absolutely nothing.
Conclusion
Using things that already exist is often a great strategy to get stuff done quickly, and widely used amongst startups and small and medium-sized companies.
However, there are pitfalls when copy-pasting without thought: Whilst in daily life people might notice that you copy-pasted but not care, an ISO 9001 / 27001 auditor will notice for sure and also will care.
