ISO certifications
tailored to SMEs.
From quality to cybersecurity, from the environment to occupational health and safety: ISO 9001, 14001, 27001, 45001, and many others, all manageable through a single process with a single partner.
our team
We've done thousand of audits.
Enough to know what your company truly needs. That is why every process is guided by a dedicated Lead Auditor based on your industry and the specific standards you require, who remains with you until certification.
Catalog
Looking for ISO certification?You’ll find it here.
WHY IT WORKS
We guide companies toward standards using a non-standard approach.
Orientation
Don't know which ISO you need? Start here.
Start with the goal, not the standard. Tell us what you want to achieve, and together we’ll find the right certification.
VERIFIED REVIEWS
They aren't just certifications.
They are stories.
Stories of Italian SMEs that obtained the certification their market required and of what changed afterwards: contracts won, new clients, and opportunities that were previously out of reach.
GLOSSARY
ISO terms in plain language.
Here you will find the acronyms and technical terms you’ll encounter along the wa, explained clearly, once and for all.
ISMS
Information Security Management System
The information security management system
A structured set of policies, procedures, roles and controls for managing information security. Being certified means having a working ISMS, not just documents.
SoA
Statement of Applicability
Document declaring which ISO 27001 controls apply
The central ISMS document listing all 93 Annex A 2022 controls, justifying the inclusion or exclusion of each. The first document requested at Stage 1.
CAPA
Corrective and Preventive Action
Corrective and preventive actions for handling nonconformities
A process required by practically every ISO standard. It analyses the root cause and prevents the problem recurring.
DVR
Italian Risk Assessment Document
Mandatory Italian document for occupational health and safety
An Italian legal obligation, separate from ISO 45001 but able to be integrated with it. It remains mandatory even with 45001 certification.
RoPA
Record of Processing Activities
Register of personal data processing required by the GDPR
Article 30 of the GDPR requires almost every organisation to keep a register of all processing activities, with purposes, legal bases, recipients and retention periods.
Stage 1
The first audit visit: documentation and readiness review
The certification body checks that documentation exists, that the system is running and that there is enough evidence to schedule Stage 2. It usually lasts half a day or a day.
Stage 2
The certification audit proper
The auditor verifies on site how the system works through interviews, operational evidence and inspections. It ends with a report and any nonconformities to close before the certificate is issued.
Surveillance audit
Annual audits between certification and the three-year renewal
After initial certification the body returns each year to verify the system is maintained. Every three years there is a full renewal audit. These are critical moments if the system has not been kept up.
Nonconformity
NC
A gap between what the standard requires and what is actually done
Nonconformities can be minor (resolved with one action) or major (blocking the certificate). The aim is to handle them in a structured way.
Annex A
The list of 93 ISO 27001:2022 security controls
It lists 93 controls (down from 114 in the 2013 version) across four themes: organisational, people, physical and technological. The SoA maps them one by one.
Frequently Asked Questions
Frequently asked questions about ISO certifications.
What is the difference between the various ISO certifications?
Each standard covers a specific area: ISO 9001 addresses quality, ISO 14001 the environment, ISO 27001 information security, and so on. Many companies obtain more than one, as they share much of the same structure and can be integrated into a single management system.
How do I figure out which certification I need?
It depends on your industry, client requirements, and growth objectives—such as access to tenders, regulated markets, or enterprise client trust. A Lead Auditor analyzes your situation during an initial call and identifies the most suitable standard, or the most efficient combination if you require more than one.
Can I obtain multiple certifications at the same time?
Yes. Standards such as ISO 9001, 14001, and 45001 share much of their structure (the High-Level Structure), so implementing them together within the same system takes less time than doing so separately, one after the other.
How long does it take to obtain a certification?
It varies depending on the standard and your company's starting point. In general, Complaion significantly reduces the time required compared to a traditional consulting process, because the Lead Auditor manages the critical stages and the platform automates the documentation.
How much does a certification with Complaion cost?
It depends on the standard, the size of your company, and the complexity of the processes to be certified. Request information for a tailored quote.
Does Complaion also handle certification renewals?
Yes, we handle the renewal: the platform monitors expiration dates, and your Lead Auditor takes care of the renewal audit when the time comes.
Does Complaion deal only with ISO certifications?
No. In addition to ISO certifications, we also support compliance with mandatory laws and regulations such as NIS2, GDPR, and DORA. The difference is that these are not "certified" by an accredited body—unlike ISO standards—but they still require a process of analysis, documentation, and ongoing maintenance, which we manage using the same approach: a dedicated Lead Auditor and a platform that monitors everything.
RESOURCES AND GUIDES
Let's try to explain compliance clearly.
Guides written and updated by us, always aligned with current regulations.
