By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - the practical platform helping UK businesses get ISO 9001, ISO 14001, ISO 45001 and ISO 27001 certification through ready-made templates, AI-powered tools and real-world guidance. Russell has supported hundreds of organisations and knows exactly what auditors want - because he’s one of them.
If you’re new to ISO, or just starting to explore certification, you probably have a few key questions that keep coming up.
In fact, I hear the same handful of questions from almost every client I work with - and I’ve answered them so many times in audits and consultations that I thought it was time to put them all in one place.
This isn’t a technical deep dive. It’s a plain-English guide to the things people really want to know: how long it takes, what the difference is between the standards, and how to actually pass the audit.
How do I pass an ISO 27001 audit?
Let’s start with the big one - because ISO 27001 is the most in-depth standard most SMEs will come across. At its heart, it’s about proving that you understand the risks to your information and that you’ve done something sensible to reduce them.
In most audits I’ve carried out, what separates the pass from the panic is simple: the businesses that succeed know how to show what they’re doing - and why.
Passing isn’t about memorising Annex A. It’s about having processes that work in real life, and being able to back them up with evidence. That might be access logs, risk assessments, internal audits, supplier reviews, or incident responses. But more importantly, it’s about your team understanding the system and being able to explain how things are done.
Too many companies try to impress auditors with long policies full of jargon. But most auditors - myself included - are far more interested in clarity and consistency. If your system works and people understand it, you’re 90% of the way there.
What’s the difference between ISO 9001 and ISO 27001?
This one crops up a lot - especially from companies trying to decide which standard to go for first.
ISO 9001 is all about the quality of your products and services. It focuses on customer satisfaction, process control, and continual improvement. If you want to prove that your business is well run, consistent and client-focused, ISO 9001 is the go-to.
ISO 27001, on the other hand, is about information security. It’s about protecting the confidentiality, integrity and availability of your data - whether that’s customer information, internal systems or intellectual property.
They share a common structure, so they’re often implemented together. But their focus is very different: 9001 is about running a good business; 27001 is about protecting what matters. If you work with sensitive data, clients in finance, healthcare or tech, or you’re handling cloud-based services, ISO 27001 is usually the priority.
How long does ISO certification take?
This depends on how ready you are. Some of my clients come to me with systems already in place - they just need polishing. Others are starting from a blank page.
That said, there are some rough timelines. ISO 9001 can usually be achieved in two to four months. ISO 27001, being more detailed, often takes four to six. If you’re working on multiple standards together, it might take a little longer - but the process often overlaps, so the extra time isn’t huge.
One thing I will say from experience: the companies that make progress fastest are the ones that focus. They assign someone to lead the process, they set a clear goal, and they use the right tools from the start. That’s why I built The Compliance Companion - to give people everything they need in one place, without drowning in documents.
What documents do I need?
Here’s where a lot of businesses get overwhelmed - but it doesn’t need to be complicated.
ISO standards aren’t about having 50 policies just for the sake of it. They’re about showing how you operate, what controls you have in place, and how you deal with problems when they arise.
If you’re aiming for ISO 9001, you’ll need things like a Quality Policy, a record of internal audits, and a way of tracking nonconformities. For ISO 27001, you’ll need a Statement of Applicability, risk assessments, and a plan for how you’ll respond to incidents.
What matters most is that these documents reflect what you actually do. Not what a template says you should do. That’s why all the resources in The Compliance Companion are designed to be adapted quickly - so they sound like your business, not mine.
What happens during the audit?
This is another one that causes nerves - but once you know the format, there’s no reason to fear it.
The certification process usually has two stages. First, a Stage 1 audit where the auditor checks your documented system - they’re looking at readiness and making sure nothing critical is missing. Then comes Stage 2, where they look at how the system works in practice: they’ll ask questions, talk to staff, and review evidence like meeting minutes, logs and procedures in action.
In my experience, what impresses auditors isn’t perfection - it’s openness. If you’ve had an issue and fixed it properly, that’s a positive. If your team knows the system and uses it, that’s even better.
Auditors want to see a system that works. That’s it. Not a perfect company. Not a slick show. Just real, working processes.
Do I need a consultant to get certified?
Not always - but the process is definitely easier with guidance.
I’ve worked with plenty of businesses who’ve done it solo. And I’ve worked with plenty who started out solo, then called me when they got stuck. A good consultant won’t just write policies - they’ll help you understand what’s required, tailor it to your business, and avoid wasting time.
That said, not every business wants a consultant. That’s exactly why I created The Compliance Companion - to give companies the templates, tools and support they need to build their own system, their own way.
If you're exploring ISO for the first time, or trying to decide whether now’s the right time, just know this: you don’t need to know everything.
You just need to take the next step. And whether that’s downloading a checklist, booking a readiness call, or diving into a full implementation - we’ve got the tools to help.