If anyone proposes forty documents for an SME, ask them which forty your people will genuinely keep up. This is the short list that survives contact with a real working week — and the one register nobody remembers to update, which is where most first audits find their first finding.
What a typical one-standard SME ends up with. Four things, plus the records the work already makes.
| Document | In plain words | Who owns it | How often it changes |
|---|---|---|---|
| Policy | One page: what we promise about quality, safety or environment | Managing director | Reviewed yearly, signed once |
| Scope statement | One sentence: what this certificate covers, and from where | Managing director | Almost never — only when the business changes shape |
| Procedures | How each key job is done, and who is responsible — short, not a manual | Process owner | When the way you work changes |
| Registers | The lists: legal rules, environmental aspects, hazards, equipment, training, contractors | Named individual per register | Continuously — this is the living part |
| Records | What the work already produces: checklists, logs, certificates, service reports | Whoever does the work | Every day |
Which rules apply to you, and who watches each one. Out-of-date legal registers are the easiest finding for an auditor to make.
Everything the work uses, produces or emits — with the important ones marked and controlled.
One per activity, current, with the controls that are actually in place rather than the controls you wish were in place.
Who has been trained for what, when, and the certificate to prove it — including new staff, who are the most common gap.
You do not create this evidence. You stop throwing it away.
| We write and set up | You keep current afterwards |
|---|---|
| Policy, scope statement, procedures, all registers | Registers: updating them as the business changes |
| The training matrix and the retention rule | Records: keeping what the work produces |
| The internal audit plan and the first internal audit | The yearly internal audit and the management review |
| The calendar with every date in it | Opening the calendar and acting a month before each date |
One policy, six to ten short procedures and the registers. If a proposal runs past twenty documents for a single-site SME, ask what each one is for and who will keep it up. Documents nobody reads are liabilities.
No. Spreadsheets and folders work, and most of our clients stay on them. Software helps when several sites genuinely need the same document at the same time — that is a scale decision, not a certification one.
Then change it. The system expects it. What fails an audit is a procedure that is wrong and still being followed silently.
Yes, if someone has the time and the appetite for the standard's language. Many companies write the first draft and pay us to review it — that is a smaller, cheaper engagement and we are happy to do it.
You do, and you keep them if we part ways. We retain ownership of our own templates and methods, which is clause 12 of our terms.
Tell us your trade and roughly how many people and processes are involved. We will send a plain-English contents list before you commit to anything.