Four standards, one way of working: what our ISO certifications mean for you
Integritis is now certified to ISO 9001, ISO 14001, ISO/IEC 27001 and ISO/IEC 42001. Here's what each one covers, why we took on all four together, and what it means for the businesses we work with.
Once a business starts to grow, a certain kind of question starts arriving. It might come in a supplier questionnaire, a tender, or a polite email from a new client's procurement team. How do you protect our data? How do you manage quality? What's your environmental policy? And more and more often: how are you using AI?
Most small businesses answer with good intentions and a policy document updated in a hurry. We wanted to answer with evidence.
Integritis is now certified to four international standards, following independent audit by Citation ISO Certification. We built them as integrated management systems, not four separate rulebooks. That's the part we're most pleased with.
Why all four, and why now
Integritis runs the engine room for other businesses: finance, compliance, HR, IT, risk and supplier management. Clients hand us the processes they can't afford to get wrong. That's a lot of trust to ask for on the strength of a conversation.
Each of these standards answers a question clients are entitled to ask. Taking them on together meant building one joined-up way of working rather than adding layers one at a time. We think in systems, not services, so approaching it any other way would have been odd.
What each standard covers
ISO 9001: quality management. This standard asks whether you do what you say you do, consistently, and whether you get better at it over time. For clients, it means the way we deliver doesn't depend on who happens to pick up the work that day.
ISO 14001: environmental management. This means understanding the environmental impact of how we operate and managing it with the same discipline as everything else. We're a small, largely cloud-based team, so this isn't about smokestacks. It's about suppliers, travel, energy and the everyday decisions that quietly add up. As a social enterprise, how we operate matters as much as what we deliver.
ISO/IEC 27001: information security. This is the international benchmark for how an organisation identifies information risk, controls access, protects data and responds when something goes wrong. Payroll, contracts, HR records and subject access requests all cross our desks, so for many clients this is the one that matters first.
ISO/IEC 42001: AI management. The newest of the four, and the first international standard for managing AI responsibly. It asks what AI you use, what risks it carries, who oversees it, and how you know it's doing what you think it's doing. We use AI in our own operations, and we wanted that use to hold up under scrutiny rather than just sit in a policy.
What it took
From the outside, certification looks tidy. On the inside, it meant writing down what we do, proving we actually do it, and fixing the bits that only lived in someone's head. Every founder knows those bits exist.
It doesn't stop here, either. Each standard comes with annual surveillance audits, so keeping it is ongoing work. That's the point. A certificate is a snapshot, and the management system behind it is what clients actually benefit from.
What it means if you work with us
- Your data is handled within an independently audited information security framework.
- Our delivery runs on documented, consistent processes that are reviewed and improved.
- Our use of AI is governed, risk-assessed and accountable.
- When your own customers ask about your suppliers' standards, we're one less question mark.
If certification is on your own list
We've been through it ourselves, so we know the route from the inside, including the parts the brochures leave out. Integritis can help you understand where you stand against any of these standards, close the gaps, and build a management system that suits a business your size instead of burying you in paperwork.
We don't issue certificates. That's the job of an accredited certification body. What we can do is get you ready for the audit and help you keep what you earn.
That might be because ISO 27001 has just appeared in a tender, because your team has taken up AI faster than your governance can keep up, or because you're tired of answering the same supplier questionnaire from scratch. Whichever it is, talk to us.
Four certificates are good to have. A business that runs the way it says it does is the point.