“Why should I care about ISO standards if my entrepreneurial company isn’t a manufacturer?” This is a great question and illustrates the common belief that ISO is only for manufacturers, or huge conglomerates, or global enterprises. As an entrepreneur who founded several companies (Leo) and a quality-management specialist (Ralph), we have experienced how ISO standards have helped our various companies and benefited our clients.

Reasons to Use ISO Standards

• Reduces risk: The underlying reason for ISO compliance is that entrepreneurial companies are at a greater risk than established organizations – and thus have a more compelling case for minimizing risk. If a young company doesn’t have policies, processes and procedures that are standardized, it risks wasting its precious resources. And that doesn’t result in just missing the numbers – it can mean going out of business.
• Builds in consistency: It isn’t enough for fledglings to operate with a “general knowledge” of the details involved in turning out first-rate products or services. Typically the founders and a few employees have the needed knowledge but it is not communicated consistently across the organization. ISO standards, by contrast, put policies, processes and procedures in writing so that everyone is aware and able to work within common directives.
• Measures ROI: In addition, ISO standards serve as a checklist against which a young company, whose financial talent and systems might not yet be up to par, can measure critical entrepreneurial objectives, namely return on investment, or ROI.
• Builds credibility: Finally, standards function as an imprimatur, convincing partners to engage with, and customers to buy from, an untested entity.

About ISO

ISO derives from the Greek root, “iso,” meaning equal. In 1947, when groups that set quality standards in individual countries first got together and proposed formulating standards that would be recognized globally, they targeted major manufacturers. Today, however, the International Organization for Standardization, a non-governmental group with 140 member bodies from as many countries, targets all businesses.

De-Mystifying ISO

Some entrepreneurs believe that ISO standards would force their products or services into a preset mold that isn’t practical, natural, or achievable. However, nothing could be further from the truth. ISO standards aren’t rigid dicta, but rather guidelines into which each business inserts its particulars.

An analogy would be a road map, say, from Ralph’s home in Holland, Michigan, to Florida. The road map would direct the traveler to take I-75, the quickest and most efficient route. In this case, Ralph would need to amend the road map to include the state highway connecting Holland to the interstate. If he were traveling for pleasure, he might further tinker with the document to include forays on scenic highways paralleling I-75.

ISO standards are analogous to the road map; how the road map is applied is up to the individual company. Consider the case of an entrepreneurial enterprise that provides valet parking services at airports. ISO standards stipulate that companies have a written job description for each position. However, this company, whose valets meet customers at the curb and take the cars to be parked (as well as provide services, such as oil and filter changes, while customers are traveling), would tailor its job description for the valet according to its requirements.

In this case, the valet company sought ISO certification to secure bank financing. In another, a three-person design firm wanted to get a grip on the business side of its endeavor. One ISO standard calls for polling customers for feedback on invoices. In doing so, the design company found that its clients wanted a more detailed description of the time spent on each task, as well as a listing of the charges for materials. When the firm complied, it discovered that it got paid faster and with less hassles, and was attracting more repeat business.

Steps to Standardization

Achieving compliance with ISO standards isn’t easy or inexpensive. The first step is becoming familiar with the lingo. The most important buzzword is ISO 9000, the benchmark that has for years applied to most companies. In November 2000, it was updated and renamed ISO 9001:2000 to align more effectively with the needs of process and service companies, and with another guideline that governs environmental issues.

Next, entrepreneurs need to make time for the process, which usually takes 18 months. Sometimes companies hire a third party, such as our consulting firm, but that route is expensive. A company would spend $10,000 or more depending upon its size and complexity.

In either case, whoever is designated to lead the initiative must follow a proscribed set of 13 steps outlined by the Organization for Standardization. These include identifying the goals the company wants to achieve, such as improving profitability or market share; obtaining information about the ISO standard for each; determining whether the company meets the standard, and, if not, how to bring it into compliance. (A full list of the guidelines appears on the ISO Web site).

To Certify or Not to Certify

Once in compliance, a company must then determine whether or not to go for certification, which means being approved by an independent accredited registration or certification entity, apart from the International Organization for Standardization (which doesn’t handle the job of certifying.)

Many foreign countries require businesses to be certified. In the United States, however, this step is optional, and companies could instead simply align their processes and procedures to ISO standards and declare themselves in compliance.

In our opinion, even companies in the United States should pursue certification. Taking that step, after all, would make the best use of the resources it has expended to undergo the process. In addition, certification signals forthrightly that the company cares about adhering to a level of quality that is unsurpassed in the world.

In sum, the rewards of being in sync with an internationally recognized quality standard is more than worth the exacting journey to get to that point. A benchmark against which a company can measure progress, a credential on the calling card: these are reasons enough for founders to pursue the ISO compliance and certification. The case is airtight — ISO amounts to an entrepreneurial statement.

The development of a business model and the achievement of the business objectives necessary to enable that model to be effective means that an advisory team must be put into place to help the entrepreneur keep plans on track. These outside advisors should perform periodic reality checks to test and adjust the validity of the business model. As a corporate lawyer, I am aware that these “business model reality tests” typically take the form of a legal audit.

In a legal audit, the company’s management team meets with corporate counsel in order to discuss strategic plans and objectives, review key documents and records, and analyze and identify current and projected legal needs of the company. The legal audit also lays the groundwork for the establishment of an ongoing legal compliance and prevention program in order to ensure that the company’s goals, structure and ongoing operations are consistent with the latest developments in business and corporate law. Finally, the legal audit helps managers identify the legal issues triggered by changes in strategies, goals or objectives and allows planning for the legal tasks that must be accomplished as a result of the issues identified.

Issues in a Legal Audit

A comprehensive legal audit will examine a wide range of issues which may be as mundane as whether or not the company is qualified to do business in foreign jurisdictions or as complex as an analysis of the company’s executive compensation and retirement plans in order to ensure consistency with current tax and employment law regulations. The topics that must be addressed include: choice and structure of the entity; recent acts of the board of directors and documentation (or lack thereof) relating to those decisions; protection of intellectual property; forms and methods of distribution and marketing; pending and threatened litigation; estate planning; insurance coverage; hiring and firing practices; employment agreements; securities law compliance; antitrust and related trade regulations; product liability and environmental law; and a review of sales and collection practices. Naturally, the extent and complexity of the legal audit will vary depending on the size and stage of growth of the company, the type of business (such as service vs. manufacturing), the number of shareholders and employees, the extent to which the company does business in a “regulated industry,” and a host of other factors.

A legal audit may be performed on a periodic basis as part of an ongoing compliance program or may be performed in connection with a specific event, such as a financial audit, or in connection with a specific transaction, such as an acquisition or securities offering. There are also specialized legal audits in specific areas, such as tax; labor and employment; estate planning/asset protection; government contracts; franchising compliance; and environmental law. The mechanics of the legal audit and a sample questionnaire are listed below.

Mechanics of a Legal Audit

• The Preliminary Questionnaire. The legal audit should begin with a comprehensive questionnaire for the company’s management team to review and address prior to the arrival of the team of attorneys who are to conduct the legal audit. In the case of smaller companies, a simple checklist of issues or a formal agenda will be more than sufficient to prepare for the initial conference.
• The Initial Conference. Once the documents and related materials requested in the questionnaire have been assembled and problem areas preliminarily identified, a meeting should be scheduled between audit counsel and the designated officers of the company who are well-versed in the various aspects of its operations. Related members of the management team, such as the outside accountant and other professionals who play key advisory roles, should be present during at least the portion of the audit that relates to their area of expertise. This initial series of conferences is an information-gathering exercise designed to familiarize the legal auditor with the most current information about all aspects of the company. In addition to these conferences with key personnel, the audit team should perform some on-site observations of the day-to-day operations of the company. The legal audit team should also review the current financial statements of the company and spend some time with the company’s accounting firm.
• Implementation of the Post-Audit Recommendations. Once the legal audit team has issued its post-audit evaluation to the management team, the entrepreneur can implement the recommendations of the report. What he or she does will vary, depending on the growth planned by the company, as well as the specific findings of the report. At a minimum, the entrepreneur should schedule meetings with key personnel to review and discuss the post-audit recommendations; prepare internal memos to educate the “rank-and-file” employees; conduct employee seminars to educate employees about proper procedures and compliance; and in certain cases, develop handbooks and operations manuals for continued and readily available guidance for the company’s staff. If significant problems are discovered during the audit, counsel should be careful about what is included in the final written report in order to avoid potential adverse consequences down the road under the federal or state rules of evidence. In addition, the company can establish a “tickler system” for periodic reporting and key dates/deadlines, as well as a time set for the next legal audit.

Risks of Not Complying

The failure to have an independent legal audit performed by qualified legal counsel can have a significant adverse impact on the company and its founders. The risks of non-compliance with these many laws and regulations include:

• Failure to keep proper books and records or mixing personal assets with business assets could lead to the ability by third parties to “pierce the corporate veil,” thereby removing the limited liability protection of a corporation or LLC, or even to litigation among co-owners.
• Failure to obtain all proper permits and licenses could lead to fines, penalties, and, in some cases, even closure of the business by governmental agencies.
• Failure to comply with certain laws and regulations may lead to problems under federal law with agencies such as the IRS, the EEOC, the EPA, and even the SEC.
• Failure to have employment applications, personnel handbooks and general employment policies reviewed periodically could give rise to governmental and civil liability.
• Failure by the directors of the company to keep accurate records and minutes of its decision-making procedures, such as proving that directors are exercising informed judgment, could subject the company and its board to liability to its shareholders and investors.
• Failure to monitor the company’s reporting requirements may put the company into default with lenders or investors.

The process of going through a legal audit isn’t easy, but the risks associated with avoiding the issue are too high for any company to bear. Doing so is not only necessary, but beneficial. It is the entrepreneurial company’s reality check.