In recent days, I’ve been approached by a growing number of small companies seeking the lowest-cost options for implementing a quality system compliant to ISO 9001 or AS9100. These are typically companies seeking to implement the standards for the first time, and not upgrades from prior editions (which can be done fairly cheaply already.)

By small, I mean tiny — anywhere from 1 to 10 employees — and these represent a sector where ISO 9001 is growing in consideration. As ISO 9001 became popular in the early 1990’s, all the “big” companies who intended to implement ISO 9001 have achieved it, and since the 2000’s it’s been largely a market comprised of the remaining medium-sized organizations. In the past few years, however, large customers and government agencies have been more aggressive on flowing down ISO or AS as a requirement, even to tiny suppliers comprised of only a few employees. Oxebridge estimates that since 2009, about 75% of all ISO 9001 implementations in the United States are now driven by customer or government demand, as the impetus to implement the standards purely for improvement’s sake has waned in the face of ISO criticism.

The problem facing tiny organizations is that there’s a bottom to how low a traditional ISO 9001 or AS9100 implementation can go: typically, companies will find they spend about the same amount whether they have 75 employees, or only 1. Above 75, things can start to scale accordingly, but below that, there’s just a minimum amount of work — and thus cost — that impacts on any company, no matter the size. For tiny companies with nearly zero budget to allot for ISO, this is a huge problem.

Let’s look at the choices, however, and tiny companies may find they have a few more options than they thought. Working from the most expensive option downward, these are as follows. (Keep in mind, these costs only refer to the consulting services, and would not include the costs for your third party registration audit.)

$25K: Bells and Whistles

A full “from scratch” implementation of ISO 9001 or AS9100 traditionally includes the following services:

  • Development of all QMS top level documents (manual, procedures, forms); it typically doesn’t include machine-level work instructions, but there are workarounds on that anyway (which is out of the scope of this article.)
  • Consulting and implementation of key “ISO-y features” like corrective action, risk/opportunity activities, management review, internal audit program, process approach, etc.
  • Training of all employees, with special training for management
  • Development of custom internal audit methods, training and checklists
  • Development of process metrics, KPI’s, etc. (if not already done)
  • One full QMS internal audit
  • One full management review

Under an Oxebridge ISO 9001 or AS9100 implementation program, for a company of 25 employees or less, the costs will run about $23,000 – $25,000 which includes all expenses (airfare, hotel, rental cars.) I can’t speak for all competitors, but I’ve seen quotes for as high as $60,000 for these same services, even for tiny organizations. If you’re getting prices like that thrown at you, just ignore them out of hand and keep looking.

That “bells and whistles” implementation includes the work being done on-site, at your location, with a suitable amount off off-site, remote support as needed. The downside of such a program is the cost, of course; the upsides are many, however, in that it reduces the amount of typing and labor to be done by your staff, and ensures the resulting QMS is customized fully to match your actual practices, all under the eye of a consultant who can make sure it’s not customized to the point of no longer complying with ISO 9001 or AS100.

$12K: Bells and Whistles – With Grants

The next cheapest option — for US companies anyway — is to pursue the full implementation above, but seek a grant under the Workforce Improvement and Opportunity Act (WIOA) program. WIOA is a Federal program, but the funds are sent to each individual state, and are then often administered at your county level. The grants may operate under a variety of state-branded names, but typically are called “incumbent worker training” (IWT) grants, since they aim to avoid layoffs by ensuring current workers (incumbents) stay employed, and don’t get dumped to the rolls of the unemployed. These IWT grants typically reimburse 50% of the cost of ISO 9001 or AS9100 implementation, meaning an Oxebridge “bells and whistles” contract would reduce your overall cost by about half (the grants don’t cover expenses, so the exact amount has to be individually calculated for each client.)

Previously, states operated grants under WIOA’s predecessor, WIA, but that program was replaced in recent years. Under WIOA, however, many states dropped the incumbent worker training grants entirely, or changed the programs to emphasize attracting new employees to the states rather than retaining current ones, so the likelihood of such a program operating in your state is now far less than it was 10 years ago. Some states, including Florida, still have amazing IWT programs, some of which reimburse even higher amounts of 75% or — rarely — 100%.

All of these programs are reimbursement grants, however, so you have to spend the money first, submit a copy of the paid invoice to your grant administrator, and then wait for a check. Typically, however, you’re paid back within a month or so, so it’s not a huge hit.

~$10K: Limited Scope Implementation

The next option is to highly customize the implementation to offload some of the work traditionally done by the consultant back onto your staff; the less the consultant has to do, the less money it costs you. Some consultants will recoil at this, if they operate from a strict package or rely on roping you into their subscription-based QMS software package, which limits their ability to get creative. But with a good consultant, you can pick and choose which activities (perhaps from the list above) you’d want to do yourself, and then develop a program based on what’s left over. For example, perhaps you only need the documentation portion, and can handle the rest yourself; perhaps you’ve already completed the documentation, and just need support for internal audits and management review. The permutations are endless.

This can reduce your implementation costs by half or more. A grant can also be used for such tailored implementations, too, so there’s more savings to be had if you’re lucky enough to have a grant program in your area.

<$10K??: Do It All Yourself

The obvious way to save money is to avoid the consultant entirely, and do the entire implementation yourself. this is a highly recommended approach, since the end result will be more “organic” to your company, but it does come with some pitfalls. The biggest risk is that you may implement a system that you really like, but which doesn’t survive a third party audit later, because you didn’t fully understand ISO 9001 or AS9100 to identify when you implemented yourself out of compliance.

You’ll notice this isn’t the cheapest alternative, however, which may seem counter-intuitive. That’s because the time it will take you to implement a QMS on your own will be longer, and comes out of your pocket through the hours spent on the project, any books or training you may purchase, etc. Those working on the project have to dedicate their time to doing the work, which means they are not doing any work associated with their normal job during that period. This means the ISO implementation will be done in one’s “free time,” greatly expanding the overall time required; even for a tiny shop, self-implementing over a period of 1-3 years is common; I’m not kidding. I’ve gone into shops like this that had been working on implementation for 10 years, and simply never got across the finish line because they were too busy with their regular work.

$200 – $5000: Buy a Template Kit

There are a never-ending number of private consultants selling QMS template kits and software packages that will cost less than an on-site consultant, and should be considered as an option. Prices are all over the place, with the ISO 9001 Store charging up to $1,500 for a template kit, its sister company AS9100 Store charging about $400 for its kit (yeah, I don’t know why AS9100 is cheaper than ISO 9001 either), Core Business Solutions previously charging about $4,000 – 5,000 (their latest website doesn’t have pricing for kits anymore, and I believe that price requires enrollment in their subscription based QMS software) and Advisera — yes, they literally named their company to sound like your “adversary” — charging about $1,000. Some run-of-the-mill consultants have tried to charge $10,000 or more for kits, but they usually go out of business fast.

So you could expect to pay a few thousand dollars for such a kit, and then pay extra for the support needed afterward. The problem with kits, as I have ranted for decades, is that they present a huge risk. You are essentially copying-and-pasting your name into someone else’s QMS documents, and that rarely works out well. You also have to carefully watch what you are getting, and be sure it matches the samples presented on the website; in one case, we uncovered a consultant offering a package that didn’t resemble at all the screenshots on the page, and you’d only notice this after you spent the money.

The template kits cut down your workload, but don’t eliminate it; you still have to dedicate the time and effort into customizing the documents, so factor in your own internal costs related to time and labor.

$500 – $2000 Pay Off a Certificate Mill

We’re discussing all your options, so let’s just get this one out of the way. The number of “certificate mills” offering self-accredited, or wholly unaccredited, ISO 9001 and AS9100 certificates is growing. These companies sell certificates over the internet, and may or may not even conduct an audit of your facility. We call them “certificate mills” because they are the functional equivalent of “diploma mills” that sell university degrees over the internet, but which are not accredited by the appropriate national educational accreditors.

American Global Systems, run by Steven Kenneally, is the most famous of the US-based certificate mills, and claims “accreditation” by a group also operated by Kenneally, making AGS “self-accredited.” The beleaguered Daryl Guberman and Don LaBelle operate G-PMC Registrars LLC, which then claims accreditation by ABAC, which appears to be nothing more than a website and a logo, also created by Guberman and LaBelle. Internationally, the well-known organization International Management System Marketing (IMSM) conducts consulting, which is then “audited” by another group QAS which shares some management (if not outright ownership); it’s common for an IMSM consultant to literally be the same person who then audits you under QAS and certifies his/her own work.

Even those with traumatic brain injury know you can’t accredit yourself while retaining any sense of ethical legitimacy, and that such self-accreditation violates ISO 17021 and ISO 17011. But these certificate mills throw a massive amount of confusing arguments, nationalistic logos and pseudo-babble to confuse just enough people so that they can stay in business, year after year. They often claim “approval,” “membership” or even “accreditation” by weirdo organizations you never heard of, and which may not even exist. Their “referrals” or “clients” often reside in countries such as Pakistan or India, and are impossible for US companies to verify.

But buying a cert mill certificate is not illegal. It just means you are totally OK with sacrificing your ethics and morals in exchange for that big contract that requires you to submit an ISO 9001 or AS9100 certificate as part of the bidding process. It probably means you’re kind of a douchebag, but hey, the world is filled with them, so go for it. Alternatively, if you bought one by accident, because they never told you the truth, then you’re not a DB, and just got duped by their aggressive marketing, and it’s probably time to get out of that mess as soon as possible.

The risks associated with using a cert mill are real, however. First, nearly all of them have, at one time or another, illegally used an official logo — say of ISO, ANAB, IAF or someone — to sell their certs. If your cert has one of these logos on it, then you may get into some trademark problems yourself, or be dragged into court as a witness when they get sued.

Next, your customers will probably notice you didn’t get a “proper” cert, and bought one online. Major companies such as Boeing, GM, etc. prohibit submitting a cert mill certificate, and won’t recognize it; if you get a contract on the basis of the cert mill certificate, and they find out later, you can find your contract pulled entirely, and be subject to company-destroying liquidated damages. In the case of US Federal government contracts, you may find yourself facing Federal charges for attempting to “defraud the government of the United States”; this is because most government contracts specify your ISO or AS cert must be issued by a properly recognized certification body, and not a mill.

But many companies still opt for this choice, since a mill cert typically runs anywhere from a few hundred dollars, to a few thousand. And you don’t need to do any QMS implementation at all, since they’ll just give you the cert anyway.

While you’re at it, you may want to ask them about a bulk deal where they throw in a Harvard law degree, a few MD degrees, and maybe a statement saying you don’t have to pay taxes because the IRS is illegal. What could go wrong?

$0 – ??: Get A Free Template Kit, Dammit

To offset the growing problem of the template kit sellers, and because nothing we did seemed to stop people from wanting to buy them, Oxebridge finally released an entire set of ISO 9001 QMS templates on the web, for free. We followed that up a year later with an AS9100 kit, also totally free. There are no gimmicks, no tricks, you just click and download; you don’t even need to enter an email address and risk being spammed.

We did it under the motto “template kits suck, but free template kits suck less.” Our kit, which is updated regularly, prompts for significant customization, so you can’t just swap in your logo and company name and call it a day. As a result, we can’t say it will be fully “free” to you, since you’ll have to put in the time needed to customize it. That level of effort is entirely up to you, and therefore we can’t estimate your final overall expenditure on it. But at least the kit itself doesn’t cost a dime, before asking you to spend time on it.

The good news — or weird news, if you’re like me — is that clients are claiming they are passing audits with the kits. That’s either a testament to how amazing the kit is (yay!) or how lousy the ISO and AS auditors have become (boo!) You pick.

Still, it’s a great first option for companies looking to spend absolutely nothing to get started on ISO 9001 or AS9100. Grab them from the following links:

Oxebridge also offers free support for the kit on our O-Forum discussion board, so there’s no after-download upselling. It can’t replace on-site, personal consulting, but the price is certainly right.

$0 – Break Out Photoshop

Finally, the most free option is also the easiest, but simultaneously ensures your soul will be sucked to Hell after you die, and you will be subject to eternal flames for all of eternity (I’m told that’s how long “eternal flames” last.)

To do this, you open up Photoshop, and totally make your own ISO 9001 or AS9100 certificate. It’s probably illegal, will probably get you arrested if you get caught, will get you sued for using someone else’s logos, and (as I said) will ensure you eternal damnation. But people do it. People also murder, so you can try that as a legal defense (“hey, at least no one got beheaded with a chainsaw!”) If you do it, screw you and I hope you rot.

Otherwise, you can use our online cert to create a certificate for anything; it has over a dozen fake accreditation marks, including one featuring strippers and another that says “Hail Hydra,” so you know it’s legit. It’s also got the name Accredited Registrars Certification Accreditation Board and a picture of a globe on the top, which has to mean something, and it’s been blessed (cursed?) by Cthulhu himself. Click the image below to get started.


About Christopher Paris

Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years' experience implementing ISO 9001 and AS9100 systems, and is a vocal advocate for the development and use of standards from the point of view of actual users. He is the author of Surviving ISO 9001:2015. He reviews wines for the irreverent wine blog, Winepisser.