ISO tenders: what is actually asked for

Because it is the cheapest way for a buyer to transfer a question they cannot answer themselves. A contracting authority cannot audit every bidder's processes, so it asks for evidence that somebody accredited has. ISO 9001 certifies that you run a documented, audited quality management system with defined responsibilities, records and corrective action — not that your product is good. That distinction matters when you answer: evidence the system, not the outcome. It is also frequently copied forward from an earlier specification rather than chosen deliberately for this contract, which is why it appears in notices where nothing about the work obviously calls for it.

Not generally. There is no rule requiring ISO 9001 for UK government work, and on our own corpus it is named in a small fraction of notices — a floor, since we read the notice text and not the tender pack. Where it does appear it is more often a hard requirement than a preference, so the honest answer is “rarely asked for, but usually binding when it is”. A specific buyer can require any proportionate certification in a specific procurement; under the Procurement Act 2023 that proportionality is a legal test, not a courtesy. Check the conditions of participation in the pack rather than inferring from the notice.

For most UK public work, none. If you are in technology or handle buyer data, Cyber Essentials first and ISO 27001 if the contracts justify it — Cyber Essentials appears in more notices and costs a fraction as much. If you are in construction, facilities or manufacturing, the integrated trio of ISO 9001, ISO 14001 and ISO 45001 is the usual package, and certifying them together against one process set is cheaper than three separate projects. If you run a laboratory or make medical devices, the sector standards are gates rather than differentiators and you will already know. Beyond that, buy certification because a specific pipeline of contracts demands it, not speculatively.

They help you be eligible, which is a different and more defensible claim than helping you win. Where a certification is a condition of participation, holding it is the difference between a bid and no bid; where it is a scored criterion it earns points against a published weighting you can read in the pack. We do not publish a win-rate uplift for certification and we would be sceptical of anyone who does, because the counterfactual — the same bid without the certificate — is not observable. What is observable is how often each standard is named and how often that naming is an obligation, and both of those are on this page.

It happens more than you would expect — OHSAS 18001 was withdrawn in 2021 and is still named in UK notices years later, at the highest obligation rate of any credential we measure. Answer with the current standard and make the succession explicit: state that the requested standard was withdrawn, name the date, state that you hold the successor and that it is the successor. Do not silently tick the box, because a scoring panel working from a checklist may record a mismatch. If the requirement is a condition of participation rather than a scored criterion, raise a clarification question — the answer is published to all bidders and it protects your bid.

Three things make a certificate checkable, and a good evaluator asks for all three: the certification body, the accreditation behind it, and the scope statement. The accreditation matters most — a certificate from a body with no accreditation for that scheme has not been assessed against the relevant requirements at all, and in the UK, UKAS publishes each accredited body's schedule showing exactly which schemes and scopes it holds. The scope statement matters second, because a management-system certificate covers named activities and sites, and not necessarily the part of your business delivering this contract.