A proposal that promises automated approvals, guarantees certification, or quotes a fixed price before seeing your SOP is a proposal worth questioning before you sign. These are the ISO consultant red flags that show up most often in ISO 9001 document-control proposals in Thailand, and what each one actually tells you about the vendor behind it.
None of these signs alone means a vendor is dishonest. Some are just imprecise language from a proposal template. But they are worth raising directly in your next conversation, because how a vendor responds to being asked tells you more than the original proposal did.
Red flag: the proposal claims the system "approves" or "reviews" documents
ISO 9001 clause 7.5 requires competent human review of document adequacy. A system that claims to review or approve document content — rather than execute the clerical steps after a human has already decided — is describing something that is not compliant, whatever the marketing language says.
What to ask instead: which specific review and approval steps in our process stay with a named human, and what does the system do only after that decision is recorded? A vendor building something legitimate can answer this in one sentence. A vendor blurring the line usually cannot, or answers with more marketing language.
Red flag: certification is guaranteed
No consultancy, software vendor, or systems builder can guarantee you will pass a certification audit, because the audit is conducted independently by a certification body the vendor does not control. A guarantee here is either a misunderstanding of how certification works, or a sales tactic aimed at buyers who do not yet know the CB is a separate, independent party. The distinction between certification bodies, consultancies, and software vendors matters here — only the CB can issue or withhold certification, and reputable CBs are barred from consulting for the organizations they might audit.
Red flag: fixed pricing before anyone has seen your SOP
A meaningful price for document control automation, software configuration, or consultancy work depends on the complexity of your actual process — how many document types, how many approval stages, how many departments in your distribution matrix. A number quoted before a scoping conversation is either a rough placeholder that will grow once the real scope appears, or a generic package that will be configured around your process whether it fits or not.
This does not mean every upfront number is dishonest — some vendors sell fixed-scope packages deliberately. The red flag is a fixed number for custom work, presented as final before anyone has asked what your process actually looks like.
Red flag: no deliverable named specifically
"We will help you get compliant" is not a deliverable. A legitimate proposal names what you will actually receive: a set of written procedures, a configured software platform, a custom-built automated workflow, or some combination — stated specifically enough that you could describe it back to someone else accurately. If the proposal only describes outcomes ("smoother audits," "less manual work") without naming the artifact that produces them, ask directly what you will be handed at the end.
Red flag: heavy AI language, no explanation of what stays human
"AI-powered ISO compliance" is a phrase that sells well and explains nothing. Ask what the AI component actually does, specifically. If the honest answer is "summarizes documents" or "flags formatting issues," that is a reasonable, bounded claim. If the honest answer edges toward "decides whether a document is ready," that is the compliance line being crossed, dressed up in newer language than "approves" but meaning the same thing.
Red flag: no mention of what happens to your existing systems
If a vendor is proposing to automate part of your document control process, ask what happens to everything around it — your other spreadsheets, other automated workflows, other departments' processes that might share infrastructure. A serious vendor should be able to tell you how they will verify that nothing outside the agreed scope gets touched. A proposal that never raises this, and a vendor who seems surprised when you ask, suggests the testing discipline to make that guarantee does not exist yet.
Red flag: vague or absent exit terms
Ask what happens if you want to stop working with this vendor in a year — does the system you paid for keep running, do you own the underlying logic and data, or does everything stop the moment the relationship ends? Proposals that do not address this at all are proposals where the answer, by default, favors the vendor.
ISO consultant red flags: quick reference
| Red flag in the proposal | What a sound proposal says instead |
|---|---|
| "Our system reviews and approves your documents" | "The system executes clerical steps only after your reviewer and approver have signed off" |
| "Certification guaranteed" | "We prepare your documentation and process for an independent CB audit; the CB makes the certification decision" |
| Fixed price before any scoping conversation | "Price is scoped after we see your current SOP and document types" |
| No named deliverable | "You will receive [specific system / procedures / platform], defined in the contract" |
| "AI-powered ISO" with no detail | A specific, bounded description of what any automated or AI component actually does |
| No mention of your existing systems | A stated plan for verifying nothing outside scope is touched |
| No exit terms | Written terms on ownership and what happens if the engagement ends |
What to do when you spot one
Do not treat a single red flag as automatic disqualification — raise it directly and watch the response. A vendor who clarifies specifically, adjusts the language, or explains a genuine edge case is behaving reasonably. A vendor who gets defensive, repeats the same vague claim, or pivots to a different sales pitch is telling you something more useful than the original proposal did.
If you are comparing more than one vendor, it also helps to know what is actually different between a certification body, an implementation consultancy, and a software vendor before you evaluate any single proposal, since some red flags are really just a vendor promising something outside their category entirely. And if the proposal is software-shaped, comparing what different QMS software types actually solve will tell you whether the pitch matches the product. It also helps to know which path you are actually shopping for before you read any proposal at all — build it yourself, buy an off-the-shelf platform, or commission a custom build compares the three, because a red flag for one path can be entirely reasonable for another.
FAQ
Is it a red flag if a vendor will not guarantee certification?
No — the opposite. A vendor who is honest that certification is the CB's independent decision, not theirs to guarantee, is describing how ISO 9001 certification actually works.
What if a proposal uses "AI" but cannot explain what it does specifically?
Ask again, more narrowly: does it touch document content adequacy at all? If the vendor cannot or will not answer plainly, treat that as a serious signal, not a communication gap.
Are all fixed-price proposals a red flag?
No. Some vendors sell genuinely fixed-scope packages. The concern is a fixed number quoted for custom document control work before your process has been scoped at all.
Should I ask for red-flag answers in writing?
Yes. A verbal clarification that never makes it into the contract protects the vendor, not you. If an answer matters, it belongs in the signed document.
What is the biggest red flag on this list?
Any claim, in any language, that the system reviews or approves document content on its own. That is the one place ISO 9001 draws a hard line, and it is the one most proposals blur without meaning to.
If a proposal you are evaluating raises any of these flags and you want a second read on it, book a free consultation with 1% EVO. We will tell you plainly where it stands, with a live demo of what a compliant system actually looks like.