Software outsourcing · 12 weeks
ISO 9001 from nothing to certified in 12 weeks
A certified quality management system built from a blank page at a remote-first software company, carried by six people at under a third of their time.
- From blank page to certification
- 12 weeksFrom blank page to certification
- QMS artefacts written and approved
- 37QMS artefacts written and approved
- Peak load per person — no dedicated hire
- 0.3 FTEPeak load per person — no dedicated hire
The problem
A remote-first outsourcing company of around twenty people, building medical and adjacent software for clients in the US and EU, needed ISO 9001 to stay on shortlists. There was nothing to build on: no written development process, no internal audit had ever been run, no training records, and documents scattered across two systems with inconsistent naming. Two earlier attempts had already stalled. Nobody could be taken off client work, so the whole thing had to happen inside the gaps of six people’s weeks.
What I did
I scoped the system to what the standard actually requires and no more — 37 artefacts, sequenced by dependency so nothing waited on a document that did not exist yet. Where a practice already worked it was documented rather than replaced: leadership already met every two months, well inside the standard’s annual minimum, so that became the management review instead of a new ceremony. Two engineers validated the delivery procedures so the written process matched the one people follow. I ran the first internal audit myself, closed the findings, and assembled the certification pack.
How it ran
- 01
Scope and ownership
Certification scope, named process owners, and a master document list — before writing a single procedure. Two legal entities were brought under one combined system rather than two.
- 02
Governance core
Quality policy, measurable objectives, the risk register, and a process map. This is the layer the auditor reads first and the one most projects rush.
- 03
Core procedures
Ten procedures covering contract review through to management review, written around how delivery actually works — including both the fixed-price and time-and-materials change paths, because both were real.
- 04
Templates and registers
The records the system produces day to day: evidence register, CAPA log, training log, supplier register, KPI dashboard.
- 05
Validation and evidence
Engineers checked the delivery procedures against practice, and evidence was collected from live client projects rather than manufactured for the audit.
- 06
Internal audit and readiness
The company’s first ever internal audit, corrective actions closed, management review minuted, and the certification audit passed on the first attempt.
Other work
All case studies →- Professional services
A project office that lives in a git repository
Project knowledge lived in people's heads and chat threads, and AI tools were producing confident documents with no provenance. I made the repository the single source of truth and gave every project management role a written protocol.
- Enterprise software
Data and people existed; the process and the cockpit did not
A delivery assurance function owned everything and controlled nothing. I diagnosed nineteen gaps, designed the target operating model, and put stop conditions in the roadmap so it could not become another initiative nobody uses.
- Finance
Process optimisation in financial services
Compliance reporting and risk operations rebuilt around automation, with the audit trail treated as a requirement.
Something similar on your plate?
Thirty minutes, no deck. I will tell you whether it is worth doing at all.