ISO 9001 (quality management) and ISO 14001 (environmental management) are the two ISOs UK public-sector FM buyers ask for most often. Most council and NHS soft FM tenders above £100,000 specify both. Cost is roughly £3,000-£8,000 each in year one for a small or mid-sized FM business, with annual surveillance audits at £1,500-£3,500 per certification. Buyers verify the certificate is UKAS-accredited (not a non-accredited "certificate of compliance" sold cheaper). Get a non-UKAS one and your bid is auto-failed at SQ.
If you can only do one first: cleaning, catering, and security firms typically lead with ISO 9001 because quality scoring criteria show up first on those tenders. Waste and grounds firms lead with ISO 14001 because environmental scoring is heavier in their categories. Above £100k contracts you need both. Below £30k contracts often accept neither.
- ISO 9001 (quality) and ISO 14001 (environmental) are the two most-asked ISOs on UK public-sector soft FM tenders.
- UKAS-accredited certificates only. Non-accredited certificates are auto-failed at SQ. Verify on the UKAS register before submission.
- Cost: £3,000-£8,000 each first year for a small/mid-sized FM SME. £1,500-£3,500 per certification for years 2+ surveillance audits.
- Cleaning, catering, security: ISO 9001 first. Waste, grounds: ISO 14001 first. Above £100k contracts: need both.
- ISO 45001 (occupational health and safety) is the third ISO buyers increasingly ask for, especially on hazardous waste, security, and high-risk cleaning environments. Similar cost to 9001 / 14001.
- Application takes 6-12 months from initial gap analysis to certificate issue. Plan ahead, do not start the application 8 weeks before a target tender.
- Combined integrated certifications (ISO 9001 + 14001 + 45001 in one audit) are usually cheaper than three separate audits.
Where contracting authorities require an ISO certificate, that certificate must be issued by a Certification Body accredited by the United Kingdom Accreditation Service (UKAS), or by an equivalent accreditation body recognised under International Accreditation Forum (IAF) Multilateral Recognition.
PPN 03/24 SQ guidance, restated in most UK public-sector tender packs
What's in this guide¶
- What each ISO actually audits
- Which ISO is asked for by sector
- Which to chase first (by sector)
- Cost-by-volume comparison: 1 vs 2 vs 3 ISOs
- UKAS accreditation rule (and how to verify a certificate)
- Common gaps that delay first-time certification
- Annual surveillance audit cycle
What each ISO actually audits¶
| Standard | Topic | What the auditor checks |
|---|---|---|
| ISO 9001:2015 | Quality management | Documented quality policy, customer requirements management, process consistency, document control, internal audits, customer feedback handling, corrective action, management review |
| ISO 14001:2015 | Environmental management | Environmental policy, aspect identification (waste, energy, water, chemicals, noise, transport), legal compliance register, objectives and KPIs, operational controls, emergency preparedness, internal audits, management review |
| ISO 45001:2018 | Occupational health and safety | OH&S policy, hazard identification and risk assessment, worker consultation, legal compliance, operational controls, emergency preparedness, incident investigation, internal audits, management review |
ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018: what each audit covers.
All three follow the same Annex SL high-level structure (10 clauses). That is why combined / integrated certifications are usually cheaper. The auditor goes through the same management-system clauses once, applying the topic-targeted requirements per standard.
Which ISO is asked for by sector¶
| Sector | Below £30k | £30k-£100k | Above £100k |
|---|---|---|---|
| Cleaning | Optional, sometimes neither | ISO 9001 commonly required | ISO 9001 + ISO 14001 (most NHS contracts add ISO 45001) |
| Catering | Optional, plus FHRS rating | ISO 9001 commonly required, plus FHRS 5 | ISO 9001 + ISO 14001 + ISO 22000 (food safety) on larger NHS/MoD |
| Security | SIA Operative Licences mandatory; ISO sometimes | ACS commonly, ISO 9001 sometimes | ACS + ISO 9001 + ISO 14001 + ISO 45001 typical on CCS/NHS lots |
| Grounds maintenance | Optional | ISO 14001 leading on environmental scoring | ISO 14001 + ISO 9001 (often ISO 45001 on tree-surgery-heavy contracts) |
| Waste management | Often required at any scale due to environmental risk | ISO 14001 mandatory on most council waste contracts | ISO 14001 + ISO 9001 + ISO 45001 (especially hazardous and clinical waste) |
Typical UK public-sector ISO requirements by soft FM sector and contract value (2026).
Cost: 1 vs 2 vs 3 ISOs (year 1 + ongoing)¶
| Certification combo | First year | Year 2 surveillance | Year 3 recertification |
|---|---|---|---|
| ISO 9001 only | £3,000-£6,000 | £1,500-£2,500 | £2,000-£3,500 |
| ISO 14001 only | £3,000-£7,000 | £1,500-£3,000 | £2,000-£4,000 |
| ISO 45001 only | £3,500-£7,500 | £1,500-£3,000 | £2,000-£4,000 |
| Integrated 9001 + 14001 (one audit) | £5,000-£10,000 | £2,500-£4,500 | £3,500-£6,000 |
| Integrated 9001 + 14001 + 45001 (one audit) | £7,000-£14,000 | £3,500-£6,500 | £5,000-£9,000 |
| Three separate single-standard audits | £9,500-£20,500 | £4,500-£8,500 | £6,000-£11,500 |
Approximate UK 2026 first-year and ongoing surveillance cost for different ISO certification combinations. Prices vary by company size and Certification Body.
Integrated audits beat separate ones from year one. If you know you need two or three, ask the Certification Body to quote integrated. Most UKAS-accredited bodies do this as standard. Some do not, in which case go elsewhere.
UKAS accreditation: the rule UK buyers actually check¶
Any ISO certificate on a UK public-sector tender must come from a Certification Body that is UKAS-accredited (or an equivalent body under the International Accreditation Forum's Multilateral Recognition arrangement). Non-UKAS "certificates of compliance" exist; they are cheaper, look almost identical, and they are auto-failed at SQ.
How buyers verify on submission: they look up your Certification Body on the UKAS register at ukas.com and confirm your certificate scope and expiry. They do not just trust the PDF you uploaded.
How to pick a UKAS-accredited Certification Body: NQA, BSI, LRQA, BV, SGS, NSAI, URS, and ISOQAR are all UKAS-accredited and active in the UK FM market. Get quotes from two and compare cost, audit-day rate, and turnaround. Avoid any provider whose website does not display the UKAS accreditation logo with their accreditation number; if in doubt, check ukas.com directly.
Common gaps that delay first-time certification¶
- Documented management system. Most SMEs run informally. The auditor wants written policies, procedures, and records. The pre-audit gap analysis usually finds this is the biggest hole.
- Internal audit programme. ISO requires you to audit yourself before the external auditor turns up. Many SMEs skip this and lose certification time. Build a 12-month internal audit calendar before applying.
- Management review records. Senior leadership must review the management system at planned intervals. This needs minutes, attendance, and action items. Often not documented in SMEs.
- Legal compliance register. ISO 14001 and ISO 45001 require you to identify and track applicable laws and regulations. Most SMEs do not maintain this systematically. A simple register with regulation, applicability, and review date is enough.
- Continual improvement evidence. ISO standards require objective evidence that the management system has improved over time. KPI trends, audit findings closed, customer feedback acted on. Build this evidence pack during pre-audit, not in the audit room.
Annual surveillance: keeping the certificate live¶
ISO certificates run on a 3-year cycle. Year 1: initial certification audit (Stage 1 documentation review + Stage 2 implementation audit). Years 2 and 3: surveillance audits, narrower scope, lower cost. Year 4: full recertification audit, scope similar to year 1. Maintain the management system across the cycle, not just before audits.
Common reason for losing certification mid-cycle: failing a surveillance audit on a major non-conformity (e.g. no internal audit programme operating, no management review meetings held, legal compliance register out of date by 12+ months). Buyers check certificate status on the UKAS register; a suspended or withdrawn certificate is the same as not holding one for SQ purposes.
If you are a UK FM SME deciding whether the wider compliance stack (SSIP / CHAS / SafeContractor + ISOs) is worth the spend, the SSIP scheme comparison for small businesses covers the cheapest entry point on the health and safety side. ISO 9001 + 14001 + a basic SSIP scheme is the usual three-piece compliance stack for soft FM SMEs bidding council and NHS work.
What to do this week¶
- Pull your last five lost public-sector tender SQs. Note which ISOs were asked for. The pattern tells you which to chase first.
- Run a gap analysis against ISO 9001 (or 14001 if you're waste / grounds). Either self-assessed using the Annex SL clauses or via a £600-£1,500 consultant-led pre-audit.
- Get quotes from two UKAS-accredited Certification Bodies. NQA, BSI, LRQA, BV, SGS, ISOQAR are common. Ask for integrated 9001 + 14001 quotes if both are on your roadmap.
- Build an internal audit calendar before applying. ISO requires you audit yourself; the external auditor wants to see the audit reports.
- Plan 6-12 months from gap analysis to certificate issue. Do not start an application 8 weeks before a target tender.
Sources
- ISO 9001:2015 (BSI) · Quality management standard, commonly required on UK public-sector FM tenders above £100k
- ISO 14001:2015 (BSI) · Environmental management standard, hard SQ gate on most council and NHS waste / grounds contracts
- ISO 45001:2018 (BSI) · Occupational health and safety management standard, asked for on hazardous waste, security, and high-risk cleaning
- United Kingdom Accreditation Service (UKAS) · UK national accreditation body. Public register lets buyers verify certificate scope and validity.
- International Accreditation Forum (IAF) · Multilateral Recognition arrangement under which non-UKAS but IAF-recognised bodies are accepted as equivalent
- PPN 03/24: Standard Selection Questionnaire (Cabinet Office) · Reference for ISO certification rules in UK public-sector pre-qualification
FAQs
Frequently asked questions
- It depends on contract value and sector. Below £30,000 council contracts often accept neither. Between £30,000 and £100,000 you usually need ISO 9001 (quality) at minimum. Above £100,000 most council and NHS soft FM tenders specify both ISO 9001 and ISO 14001. Sector matters too: cleaning, catering, and security tenders lead with ISO 9001; waste and grounds maintenance lead with ISO 14001. ISO 45001 (occupational health and safety) is increasingly required on hazardous waste, security, and high-risk cleaning environments. All certificates must be UKAS-accredited (or IAF-recognised equivalent) to clear the SQ.
- First-year cost is approximately £3,000-£6,000 for a small or mid-sized FM business. This covers the Stage 1 documentation review and Stage 2 implementation audit by a UKAS-accredited Certification Body. Year 2 and Year 3 surveillance audits run £1,500-£2,500 each. Year 4 recertification (a full audit again) is £2,000-£3,500. Add internal cost of preparing the management system: documented policies, internal audit programme, management review records, legal compliance register. Many SMEs spend a further £600-£1,500 on a consultant-led gap analysis before the formal application. Integrated audits (ISO 9001 + 14001 in one audit) are cheaper than two separate audits and standard practice with most UKAS-accredited bodies.
- UKAS (United Kingdom Accreditation Service) is the UK national accreditation body that audits Certification Bodies that issue ISO certificates. A UKAS-accredited certificate has been issued by a Certification Body whose competence to certify against the ISO standard has itself been audited. Non-UKAS "certificates of compliance" exist, are cheaper, look almost identical, and are auto-failed at SQ on UK public-sector tenders. PPN 03/24 and most council tender packs explicitly require UKAS-accredited certificates (or equivalent under the International Accreditation Forum's Multilateral Recognition arrangement). Buyers verify on the UKAS register at ukas.com on submission. They do not just trust the PDF.
- Sector-driven choice. Cleaning, catering, and security firms lead with ISO 9001 because quality scoring criteria show up first on those tender categories. Waste and grounds maintenance firms lead with ISO 14001 because environmental scoring is heavier in their categories. If you bid contracts above £100,000 you will need both within 12-18 months. Best path for most soft FM SMEs: start with the gap analysis covering both, get the first certification within 6-9 months, add the second 6-12 months later via an integrated audit (cheaper than two separate). Plan the timeline against your target tender pipeline, not the other way around.
- 6-12 months for a first-time application by an SME. Breakdown: 1-3 months gap analysis and management system implementation, 1-2 months Stage 1 documentation review by the Certification Body, 1-2 months corrective actions on Stage 1 findings, 1-2 months Stage 2 on-site audit and certificate issue. Pre-audit consultancy can shorten the gap analysis but does not shorten the audit cycle. Plan ahead: do not start an ISO application 8 weeks before a target tender deadline. The right approach is to know which ISOs your target market requires 12 months out, gap-analyse early, and aim for the certificate issued at least 90 days before the deadline of the first tender that asks for it.