A ten-person joinery workshop, a small warehousing firm and a family-run catering business all called their local ISO consultant last year. Each asked the same question. Which certification should we get first? Most small businesses assume there is one obvious answer. There is not. ISO 9001, ISO 45001 and ISO 14001 solve different problems. The right starting point depends on who your customers are and where your actual risk sits.
Trying to pursue all three at once, with a small team and a limited budget, usually means none of them get done properly. Picking the right first standard is a strategic decision, not a coin flip.
Getting the order wrong is not fatal, but it is expensive. A business that spends a year building a quality manual while its highest real risk sits on the factory floor has certified the wrong problem first. The safety incident, or the lost tender that actually needed a different standard, still happens in the meantime.
What each standard actually covers
ISO 9001 is a quality management standard. It sets out how you control your processes, so that what you deliver consistently meets what the customer asked for. That could be a product, a service or a completed job. It covers things like document control, supplier evaluation and handling customer complaints.
ISO 45001 is an occupational health and safety standard. It is built around identifying hazards, controlling risk and preventing workplace injuries before they happen. It matters most wherever people face physical danger on the job. That might be a construction site, a factory floor or a delivery fleet.
ISO 14001 is an environmental management standard. It covers how a business identifies and controls its environmental impact: waste, emissions, energy use and resource consumption. It matters most to businesses whose operations have a visible environmental footprint, or whose customers care about that footprint.
All three share the same underlying structure, a common framework called Annex SL. That shared structure matters later. It is why combining two standards down the line is far more straightforward than most owners expect.
Why ISO 9001 is usually the starting point
For most small businesses, ISO 9001 is the standard to pursue first. It is the most commonly requested certification in tenders and procurement processes. That holds true across almost every sector, from construction to professional services. Many buyers treat it as a baseline signal that a supplier is properly run and will not disappear halfway through a contract.
That baseline status has a real consequence. If a certification is listed as mandatory in a tender and you do not hold it, your submission often gets rejected before an evaluator even reads it. For a business chasing corporate or government contracts, ISO 9001 tends to open more doors than either of the other two standards on its own.
There are exceptions, and they matter. If your highest risk is not quality but physical safety or environmental impact, starting with ISO 9001 alone can leave the more urgent problem unaddressed for another year.
When ISO 45001 jumps the queue
Some sectors carry enough physical risk that health and safety certification should come first, or run alongside ISO 9001 from day one. Construction is the clearest example. Site-based hazards range from working at height to heavy plant movement. Manufacturing follows closely behind, where machinery, chemical exposure and manual handling create daily risk on the factory floor.
Logistics and warehousing carry their own version of the same problem. Vehicle movement, forklift operation and manual handling all create injury risk that a quality standard alone does nothing to manage. Mining sits at the extreme end. Geotechnical, mechanical and chemical hazards there demand structured risk management, not ad hoc safety rules.
In any of these sectors, clients and principal contractors increasingly require ISO 45001 as a condition of working together, not as a nice-to-have. If your business sits in one of them, treat ISO 45001 as equal in priority to ISO 9001. Do not push it to next year.
When ISO 14001 gives way to ISO 22000
Environmental management matters to most businesses. For food processing and catering companies specifically, it is rarely the most urgent certification. Food safety takes priority, and the relevant standard is ISO 22000, not ISO 14001.
ISO 22000 governs food safety management directly. It covers hazard analysis, critical control points and the prerequisite programmes that keep contamination out of your product. For large institutional contracts, ISO 22000 is often a hard requirement in a way ISO 14001 rarely is. A catering business that certifies to ISO 14001 first, while leaving food safety undocumented, has usually solved the wrong problem.
Environmental management still has a place in food and catering businesses, particularly around waste and energy use. It typically belongs in year two, once food safety is locked down.
When it makes sense to combine standards from day one
Sometimes the honest answer is not “pick one” but “pursue two together.” ISO 9001, ISO 45001 and ISO 14001 share the same Annex SL structure. That makes running two certification projects at once far less duplicative than it sounds. A combined audit for ISO 9001 and ISO 14001 can run in roughly three days, instead of the four or more that two separate audits would need.
This route makes the most sense for businesses in genuinely high-risk sectors, where a single standard clearly will not cover the real exposure. Take a construction company facing both tender requirements and serious site safety risk. That business is a natural fit for a combined ISO 9001 and ISO 45001 approach from the outset, built as one Integrated Management System rather than two parallel ones.
It rarely makes sense for a very small team to start three standards at once. Even with shared documentation and combined audits, someone still has to build and embed three sets of procedures simultaneously. A five-to-ten person business usually does not have the spare capacity for that.
A simple decision matrix
A few scenarios cover most small businesses trying to make this call.
If your clients are mainly in construction, manufacturing, logistics or mining, and your highest risk is physical injury on site, start with ISO 45001. Add ISO 9001 alongside it if tendering also matters to you.
If your clients are mostly corporate or public sector buyers issuing formal tenders, and your operational risk is moderate, start with ISO 9001 on its own.
If you process, prepare or serve food, start with ISO 22000 rather than ISO 14001. This holds regardless of how tender requirements look.
If your business has a genuine environmental footprint, heavy resource use, waste generation or regulated emissions, and clients or regulators are actively asking about it, ISO 14001 can reasonably move up the list. It still rarely displaces ISO 9001 as the very first certification for a small business.
What this looks like for two businesses
Take a fifteen-person scaffolding contractor bidding for construction framework contracts. Their biggest risk is a fall from height, not a quality complaint. ISO 45001 comes first, with ISO 9001 following within the same year once the safety system is bedded in, since most of their tenders ask for both eventually.
Compare that with an eight-person software support company bidding for public sector service contracts. Their physical risk is minimal, and their buyers care about reliability and process control. ISO 9001 alone, with no rush toward 45001 or 14001, is the right call for at least the first two years.
What to do in year two
Once your first certification is running properly, not just documented but genuinely embedded in daily work, adding a second standard becomes considerably easier. The Annex SL structure means much of the groundwork, document control, internal audit processes, management review, already exists. It simply needs extending to cover the new standard’s specific requirements.
The mistake to avoid is treating the second standard as a fresh project, built in parallel to the first. Guidance on integrated management systems consistently points the same way: align the new requirements with what you already have, rather than building a second system that duplicates work your team is already doing. A business that added ISO 9001 in year one and ISO 45001 in year two, built as one integrated system, typically spends far less effort than one that ran them as two disconnected projects from the start.
There is also a cost argument for waiting a year rather than rushing. Certification bodies can often combine surveillance audits for two standards into a single site visit once both are integrated, which cuts ongoing audit costs compared with running them on separate schedules. That saving only shows up if the second standard is planned properly, not bolted on in a hurry.
Choosing with your eyes open
There is no universally correct first standard. There is only the standard that matches where your actual risk and your customers’ actual requirements sit right now. Get that judgement right, and every certification after the first gets faster, because you are extending one system rather than starting again from nothing.
QHSSE Vault’s document packs are built for each of these standards individually, and in combined IMS format for businesses ready to pursue two at once. Each is structured around the specific risks of your industry, not a generic starting point.