Can a One-Person Company Get ISO Certified?
ISO certification is often associated with larger organisations.
People picture departments, management teams, internal auditors and dozens of employees following documented procedures.
So when a director runs a consultancy, technology company or specialist service business largely on their own, an obvious question arises:
Can a one-person company actually get ISO certified?
The answer is yes.
There is no requirement for an organisation to have a large workforce before standards such as ISO 9001 or ISO 27001 become relevant. What matters is whether the business has a management system appropriate to its size, activities and risks.
For a one-person or very small company, that system should look very different from one designed for a 500-person organisation.
And that is exactly how it should be.
The short answer
A one-person limited company can achieve ISO certification.
So can a business with only a handful of employees.
ISO management systems are intended to be proportionate. A very small organisation does not need layers of management, complex approval processes or dozens of procedures simply to satisfy an auditor.
What it does need is evidence that the important parts of the business are being controlled consistently.
That distinction matters.
Small does not mean exempt from the requirements.
But it should mean simple.
Why would a one-person business want ISO certification?
For many micro-businesses, the reason is commercial rather than operational.
The business may already work effectively.
The owner knows every customer, controls every project and understands every supplier relationship personally.
But then a larger customer asks:
“Are you ISO 9001 certified?”
Or a security questionnaire asks:
“Do you hold ISO 27001?”
Suddenly the size of the business is irrelevant.
The customer wants independent assurance.
This is particularly common when smaller specialist businesses sell into:
large corporate supply chains
public sector organisations
regulated industries
technology companies
major contractors
enterprise customers
A three-person consultancy can still handle highly sensitive information or deliver a commercially critical service.
From the customer's perspective, that risk still needs managing.
But how can you have management responsibilities when there is only one person?
This is where ISO can sometimes sound more complicated than it really is.
A standard may refer to top management, process owners and assigned responsibilities.
In a one-person company, several of those roles may legitimately sit with the same individual.
The director might be responsible for:
customer relationships
service delivery
supplier approval
risk management
quality
information security
That is perfectly possible.
The important point is that responsibilities are understood and the necessary activities actually happen.
ISO does not require you to invent additional employees just to fill boxes on an organisation chart.
Your system should reflect the business you actually have
One of the worst things a very small company can do is copy a management system designed for a much larger organisation.
You end up with procedures referring to:
“department managers”
“quality teams”
“HR departments”
“procurement committees”
when none of those things exist.
That immediately makes the system feel artificial.
If one director approves suppliers, say so.
If customer feedback is reviewed directly by the business owner, document the process that genuinely happens.
If policies are controlled through one cloud folder rather than a sophisticated document-management platform, that may be perfectly adequate.
The management system should describe reality.
What does ISO 9001 look like in a one-person business?
For a small consultancy or professional-services company, ISO 9001 may be relatively straightforward.
The business might need to demonstrate how it:
agrees customer requirements
controls project delivery
manages changes
selects external suppliers
monitors customer satisfaction
deals with problems
reviews performance
Imagine an independent consultant delivering projects for several major clients.
The consultant may already have a structured approach to proposals, contracts, project plans, deliverables and client reviews.
ISO 9001 may involve formalising some of those controls and making sure there is evidence that they are consistently applied.
The objective is not to create administration for its own sake.
It is to demonstrate that the business can reliably deliver what it has promised.
ISO 27001 can be highly relevant even with no employees
A one-person technology or consultancy business may also assume that ISO 27001 is excessive.
But company size does not necessarily reflect information-security risk.
A solo consultant could still have access to:
customer systems
commercially sensitive documents
personal information
cloud platforms
intellectual property
passwords and credentials
A security incident affecting that one-person company could still have significant consequences for the customer.
ISO 27001 therefore remains relevant where information risk justifies it.
The system might be simpler than one used by a large enterprise, but areas such as access control, risk management, backups, suppliers and incident response still need proper consideration.
What about internal audits?
This is where very small businesses can face a practical challenge.
Internal auditing requires a degree of objectivity and impartiality.
If one person created, operates and manages the entire system, simply auditing their own work without any independent perspective may not provide much assurance.
A very small organisation may therefore choose to obtain external assistance with its internal audit.
That does not mean outsourcing the whole management system.
It simply provides an independent review of whether the arrangements are working as intended.
For many one-person businesses, this is one of the few areas where some outside support makes practical sense.
What does management review look like?
Management review can also sound slightly strange when the management team consists of one person.
But the purpose of management review is not to organise a formal board meeting for the sake of ISO.
It is to periodically step back from day-to-day work and consider whether the management system remains effective.
A one-person company can still review:
customer feedback
business objectives
risks
supplier performance
audit results
problems and corrective actions
changes affecting the business
The record may be relatively concise.
What matters is that the review leads to meaningful decisions where necessary.
Will an auditor expect lots of records?
Not simply because you are seeking certification.
The amount of evidence should reflect the amount of activity within the business.
A company with five customers will naturally have fewer customer records than one with 5,000.
A business using three suppliers will not need the same supplier-management infrastructure as a large manufacturer with hundreds.
The auditor should be looking for evidence appropriate to your organisation.
That could mean reviewing a selection of:
client contracts
project records
risk assessments
supplier evaluations
training or competence evidence
customer feedback
The question is whether the system is being used consistently, not whether you can produce huge quantities of paperwork.
Can certification still be credible for such a small business?
Yes.
Certification is not an award for being large.
It is independent confirmation that the organisation's management system meets the requirements of the relevant standard within the defined scope.
For a customer, this can actually be valuable when dealing with a small supplier.
A larger customer may have less visibility of the internal controls within a small specialist business than it does with an established multinational supplier.
Certification can provide additional reassurance that the smaller supplier has structured arrangements behind the expertise it is selling.
Is ISO worthwhile for every one-person company?
No.
A sole director providing services to a small number of private customers who never ask about ISO may gain relatively little commercial benefit from certification.
The decision should still be linked to a business need.
ISO becomes much more compelling when:
customers repeatedly request certification
tender opportunities require it
enterprise customers are difficult to onboard without it
the business wants to move into larger supply chains
security or quality assurance is becoming part of the sales process
If none of those things are happening, certification may not yet be a priority.
The cost needs to make commercial sense
For a micro-business, certification cost naturally matters.
The useful question is not simply:
“How much will ISO cost?”
It is:
“What opportunities will it allow us to pursue?”
If certification costs several thousand pounds over its lifecycle but helps the business access contracts worth considerably more, the commercial case may be straightforward.
If there is no customer demand and no clear growth opportunity attached to it, the case may be much weaker.
ISO should support the business strategy rather than becoming a badge collected for its own sake.
The biggest mistake: overengineering the system
Small businesses are particularly vulnerable to overcomplication.
They download a template pack written for a much larger organisation and suddenly find themselves trying to maintain dozens of procedures, registers and forms they do not need.
The system becomes harder to operate than the business itself.
That is exactly the opposite of what you want.
A small organisation's management system should be lean enough that it can genuinely be maintained during normal working life.
If you need an entire day every week just to keep the ISO paperwork alive, something has probably gone wrong.
Another mistake: keeping everything in your head
The opposite problem also exists.
A one-person business can become completely dependent on the owner remembering everything.
Customers, supplier decisions, risks, passwords, project requirements and improvement actions may all exist largely in one person's head.
That may work while the business remains tiny.
But it creates obvious problems if:
workload increases
contractors are introduced
the business starts employing people
the owner becomes unavailable
customers demand stronger assurance
A simple ISO management system can help move important knowledge out of one person's memory and into repeatable business processes.
That can be useful even before the company grows.
What happens when you start employing people?
This is actually one of the advantages of implementing a proportionate system early.
If the business later grows from one person to five, ten or twenty, you already have a foundation.
Responsibilities can be distributed.
Processes can be expanded.
Controls can become more formal where the increased complexity requires it.
The management system grows with the business instead of being introduced after problems have already appeared.
So, can a one-person company get ISO certified?
Yes.
The question is not whether you have enough employees.
It is whether you have enough of a real, functioning business for the management system to be assessed.
If you can demonstrate genuine processes, records, risks, controls and management activity, the size of the organisation is not the barrier many people assume it is.
Not sure whether ISO makes sense for your business?
If customers are beginning to ask about ISO certification but you are unsure whether your organisation is too small, the best starting point is to understand what would actually be required.
Our free ISO readiness check can help you understand:
which standards are relevant to your business
how closely your current arrangements align with ISO requirements
where likely gaps exist
whether certification makes sense as your next step
👉 Take the free ISO readiness check here: https://www.aaa-cert.co.uk/get-certified-the-quick-and-easy-way
Final thought
ISO certification does not require a large office, a compliance department or layers of management.
A one-person company can still have customers, risks, suppliers, important information and contractual responsibilities.
Those things still need to be controlled.
For a very small business, the best ISO management system is not the one with the most documentation.
It is the one that provides enough structure to give customers confidence while remaining simple enough that the business can actually use it.
Comments