ISO Management Software: Scope and Evidence Guide

Identify the management-system scope

List the standards and editions your organisation uses, the sites and processes included, and the people responsible for interpreting requirements. Translate them into specific records and decisions before choosing applications. A document repository, audit tool or QHSE suite may cover different parts of that scope.

Separate software claims from certification

ISO explains that independent certification bodies perform certification and that ISO itself does not issue certificates. A software template, logo or feature description does not establish certification of your management system. Ask what the application helps you record and review, and keep certification decisions with the relevant parties.

ISO: Certification. Explains certification and ISO’s role; no product endorsement or guarantee that a software deployment meets a standard. Checked 20 September 2026.

Demonstrate the record lifecycle

Take a procedure from draft through approval and distribution, then replace it with a revised version. Verify access to current and previous versions. Link an audit finding to its action and supporting evidence. Ask the reviewer to reject insufficient evidence and document the eventual closure decision.

Check cross-site review and exports

Test what information is shared across sites and which local responsibilities remain distinct. Demonstrate reviewer permissions, attachments and history in an export. If certification-body access or a portal connection is proposed, confirm the supported workflow, entitlement and support owner.

Read market context with the right denominator

The ISO Survey describes certificates to management-system standards. That differs from the number of organisations buying software or using a particular application. This guide does not infer software adoption, market share or audit-time savings from certificate counts.

ISO: The ISO Survey. Describes certification data and survey access; not a software-usage dataset. Checked 20 September 2026.

Prepare the evidence list before the demonstration

Before any vendor session, write down the records an internal auditor or a certification body would ask to see for each process in scope: the approved procedure, the training or acknowledgement record, the last review date, the open actions and the person who accepted closure. Give that list to the vendor in advance and ask to see each item produced from the system rather than described. This keeps the session on your records and prevents a sample library from standing in for your own structure.

Questions that expose a flattering demonstration

A demonstration library usually has one site, one language and a tidy approval path. Ask what happens when a revision is approved but not yet released, when two people edit the same draft, when a superseded version is still referenced by an audit finding, and when a user leaves the organisation while owning open actions. Ask whether the person who raised a finding can also close it, how obsolete copies are withheld from workers, and how retention periods are set per record type. Record the answers as demonstrated, described or not available, and treat described answers as unverified until you see them work.

Decide who maintains the system after go-live

A management-system tool needs an owner for its structure, not only for its content. Name who maintains the document hierarchy, the list of record types, user roles and the templates for audits and actions, and who covers that role when the person is away. Ask what the vendor expects the customer to administer and what requires a support request, then check that the quoted support level matches the speed at which you expect to change procedures.

Check each edition's status before comparing templates

ISO's page on management system standards lists current and withdrawn editions side by side. When we opened it, ISO 9001:2015 was marked as withdrawn, ISO 14001:2026 and ISO/IEC 27001:2022 appeared as current. A demonstration library that follows an old edition will still look tidy. Ask the vendor which edition each template and clause reference follows, and the date it was last revised.

ISO: management system standards. ISO's overview page. Editions change; confirm the current status on ISO's own page before relying on this summary. Checked 3 October 2026.

Plan for a standard's update cycle

ISO describes the fourth edition of ISO 14001, published in April 2026, as building on nearly 30 years of use, and says certified organisations usually undergo surveillance audits annually and a recertification audit every three years. If you hold such a certificate, ask the vendor how a new edition reaches its templates, whether a transition costs extra and how a record created under the old structure is mapped. Ask also for the customer's own role, because a template update does not change the procedures your people follow.

ISO: ISO 14001:2026. ISO's product page for the standard. It does not describe software or list certified organisations. Checked 3 October 2026.

Read a vendor's own certificate for its scope

ISO describes ISO/IEC 27001 as the standard for information security management systems. A vendor that offers a certificate against it can be asked for the issuing body, edition, services and sites in scope. A scope that names a hosting arrangement or an office does not show that the module you plan to use is covered. Keep the scope statement in the shortlist record next to the demonstration results.

ISO: ISO/IEC 27001:2022. ISO's page for the standard. It does not list certified companies. Checked 3 October 2026.

Send a three-line scope statement with the invitation

Before the first demonstration, write three lines: the standards and editions in scope, the sites and processes covered, and the records an external auditor would ask to see. Send them with the invitation. If a vendor cannot match each line to a screen in its demonstration environment, record the gap as an open item on the shortlist instead of assuming it will be configured later.