With dozens of certifiable ISO management system standards available, it is easy to end up pursuing the wrong one — or too many at once. These questions will help you choose.
Step 1: What are your customers and tenders asking for?
This is usually the deciding factor. Check:
- Tender documents you bid for — they often name a specific standard and sometimes require accreditation.
- Supplier questionnaires and contracts from your largest customers.
- Export market expectations in your sector.
If a customer requires ISO 9001, that is your starting point regardless of anything else.
Step 2: What are your biggest risks?
Match the standard to the risk that matters most to your business:
| Main concern | Standard to consider |
|---|---|
| Consistent quality, customer satisfaction, fewer errors | ISO 9001 — Quality management |
| Pollution, waste, resource use, environmental compliance, climate commitments | ISO 14001 — Environmental management |
| Accidents, occupational illness, contractor safety | ISO 45001 — Occupational health and safety |
| Data breaches, cyber attacks, client data protection | ISO/IEC 27001 — Information security |
| Contamination, allergens, food recalls | ISO 22000 (or schemes built on it) — Food safety |
| Energy cost and efficiency | ISO 50001 — Energy management |
| Disruption to critical operations | ISO 22301 — Business continuity |
| Bribery and corruption risk | ISO 37001 — Anti-bribery management |
| Medical device regulatory expectations | ISO 13485 — Medical devices QMS |
| IT service delivery quality | ISO/IEC 20000-1 — IT service management |
Step 3: What does your sector typically expect?
As a general pattern (always confirm against your actual customers):
- Manufacturing and engineering: ISO 9001, often with ISO 14001 and ISO 45001
- Construction and infrastructure: ISO 9001, ISO 14001 and ISO 45001 are frequently requested together
- IT, software and ITES: ISO 9001 and ISO/IEC 27001; sometimes ISO/IEC 20000-1
- Food processing, catering and packaging: ISO 22000 or a GFSI-recognised scheme such as FSSC 22000, alongside the legally required FSSAI licence
- Healthcare and laboratories: ISO 9001, ISO 13485 for device makers; national accreditation (NABH/NABL) is a separate route
- Government departments and public offices: ISO 9001 is common for service delivery; ISO 37001 where anti-bribery controls are a priority
Step 4: One standard or several?
All the major management system standards share the Harmonized Structure (clauses 4–10), so they can be combined into an integrated management system with a common policy framework, risk process, document control, internal audit and management review.
- Start with one if you are new to management systems and have limited capacity. ISO 9001 is often a sensible foundation.
- Integrate from the start if customers already require several standards — combined implementation and audits can reduce duplication.
Step 5: Check the edition and timing
Standards are revised periodically. For example, ISO 9001:2026 and ISO 14001:2026 were published in 2026, with transition deadlines in 2029, and revisions of ISO 45001 and ISO 22000 are in draft. If you are starting now, plan against the current edition and ask your certification body about timing. See our guides to ISO 9001 and ISO 14001.
Step 6: Check what the certificate needs to prove
Ask whether your customers require accredited certification, and by which accreditation bodies. Make sure the scope on the certificate will cover the products, services and sites your customers care about.
Key takeaways
- Let customer and tender requirements drive the first choice.
- Match additional standards to your biggest business risks.
- Shared structure makes integration practical when you need more than one.
- Always plan against the current edition of the standard.
Sources & further reading
Links open the original publisher's page. Summaries on this page are written by Certsure; for the authoritative text of any standard, refer to the official publication.
