What ISO 9001 is
ISO 9001 is the international standard that sets the requirements for a quality management system (QMS). It does not tell you how to make your product. It requires the organization to define how it will meet customer and legal requirements, do what it defined, measure results and improve based on evidence.
Two ideas get mixed up in searches. Implementation is building and running the system. Certification is having an independent body audit that system and issue the certificate. You can implement without certifying. You cannot certify without implementing.
The clauses an auditor checks
The standard follows the high-level structure shared by management system standards, with ten clauses. Clauses 1 to 3 are introductory. The auditable requirements are in clauses 4 to 10.
| Clause | Topic | What the organization must show |
|---|---|---|
| 4 | Context of the organization | Interested parties, scope and system processes |
| 5 | Leadership | Quality policy, roles and top management commitment |
| 6 | Planning | Risks and opportunities, measurable objectives |
| 7 | Support | People, competence, resources, documented information |
| 8 | Operation | Control of design, purchasing, production and release |
| 9 | Performance evaluation | Metrics, internal audit, management review |
| 10 | Improvement | Nonconformity handling and corrective action |
The logic behind the structure is the PDCA cycle: plan (4 to 6), do (7 and 8), check (9) and act (10).
Behind the requirements are seven quality management principles from the ISO 9000 family: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making and relationship management. They help you interpret the standard when the wording is unclear.
Example: gap analysis and delivery objective
Illustrative example for a fictional metalworking shop. The first step is to compare what the company already does with each requirement. The gap analysis listed 40 requirements that apply to the scope:
| Status | Requirements | Percent |
|---|---|---|
| Met | 28 | 70.0% |
| Partly met | 8 | 20.0% |
| Missing | 4 | 10.0% |
| Total | 40 | 100.0% |
The 12 partly met or missing requirements (8 + 4) become the action plan, organized by clause:
| Clause | Gap found | Requirements |
|---|---|---|
| 6 | Objectives without a numeric target | 3 |
| 7 | Incomplete competence records | 4 |
| 8 | Supplier evaluation without criteria | 3 |
| 9 | Internal audit never performed | 1 |
| 10 | Corrective action without effectiveness check | 1 |
| Total | 12 |
The sum checks out: 3 + 4 + 3 + 1 + 1 = 12. With the plan in hand, management set a measurable objective under clause 6: deliver 95% of orders on time. In the month measured, 372 of 400 orders shipped on time.
On-time delivery rate = 372 ÷ 400 = 93.0%. The 95% target equals 0.95 × 400 = 380 orders. The shortfall is 8 orders. That number goes to the management review and, if the gap persists, to a corrective action.
How to implement: six phases step by step
Timelines vary widely with company size and maturity. What matters is the order and the exit criterion of each phase.
- Gap analysis and scope (clause 4): list interested parties, define what is in scope and run the gap analysis. A SIPOC diagram helps you see the inputs, outputs and customers of each process.
- Policy and planning (clauses 5 and 6): top management signs the policy, sets measurable objectives and addresses risks. FMEA is not required by the standard, but it fits the process risk requirement well.
- Processes and documentation (clauses 7 and 8): define processes, competence and operational controls. Document what the risk justifies.
- Measure and audit (clause 9): track the metrics and run the internal audit with auditors who are independent of the area audited.
- Management review and improvement (clauses 9 and 10): management reviews results in a recorded meeting and corrective actions are checked for effectiveness.
- Certification: hire the certification body and go through the external audits.
What to document
The standard does not require a quality manual or a fixed list of procedures. It requires documented information at specific points. Among others: the system scope, the quality policy and objectives, evidence of competence, internal audit results, management review results and records of nonconformities and corrective actions.
The rest depends on what the organization needs. Ask of each document: if it did not exist, what risk would appear? If the answer is none, do not write it. Short work instructions at the workstation beat binders of procedures nobody opens.
How certification works
ISO publishes the standard but does not issue certificates. A certification body, an independent company, audits the system. For the certificate to carry weight, the body should be accredited by a national accreditation body, such as ANAB in the United States or UKAS in the United Kingdom. Check this before you sign.
| Step | What happens |
|---|---|
| Proposal and contract | The body defines scope, sites and audit days |
| Stage 1 audit | Checks readiness: documentation, internal audit and management review already done |
| Stage 2 audit | Assesses implementation and effectiveness on site, with interviews and records |
| Handling of findings | The company answers nonconformities with root cause and corrective action |
| Certification decision | Someone who did not take part in the audit reviews the report and decides |
| Three-year cycle | Surveillance audits in years 1 and 2 and recertification in year 3 |
A major nonconformity undermines the system's ability to achieve its intended results and blocks certification until it is addressed. A minor one is an isolated failure that requires an action plan. Each body has its own grading criteria, so ask for its procedure. To address the cause, use the 5 Whys.
How to arrive prepared on audit day
Show the system working, not a binder. Train people to explain what they do and why, without memorized answers. Keep metrics records, the management review minutes and the internal audit report with closed actions at hand. If the auditor asks for a record that does not exist, say so. Inventing evidence costs more than the gap itself.
Internal audit: how to make it more than a formality
The internal audit is the cheapest test before the certification body arrives. It needs three things. First, a program that covers every process and prioritizes critical ones or those with a history of problems. Second, auditors who do not audit their own work. Third, findings handled with root cause and an effectiveness check, not just a fix for the symptom.
Audit at the workstation. Ask the person to show how they do the task and compare it with what the system defines. When practice and paper differ, one of them is wrong. Fix whichever needs fixing.
ISO 9001, lean and other tools
ISO 9001 says what the system must have. Tools such as the 7 basic quality tools and lean say how to improve performance. They complement each other: the standard gives structure and record-keeping discipline, and lean attacks waste inside the processes. The standard is also often compared with Six Sigma. The standard requires improvement but does not impose a method.
When the system is taken seriously, the gains show up as more predictable processes, less rework, suppliers evaluated with criteria and decisions backed by data. When it is treated as a wall trophy, the only result is the annual maintenance cost.
Is certification worth it?
It depends on the reason. If a key customer or a tender requires the certificate, the answer is already given. If the goal is to get the house in order, you can implement the system and postpone certification until it is stable. In that case the internal audit and the management review remain mandatory in practice, because they keep the system alive. Compare the cost of certification and annual audits with the expected commercial benefit before deciding.
Common mistakes
- Handing everything to the quality department while management disappears.
- Writing procedures that do not reflect real work.
- Vague objectives, such as "improve delivery", instead of a number and a date.
- Running the internal audit only to tick a box, without handling the findings.
- Fixing the symptom of a nonconformity without finding the cause.
- Choosing a certification body without checking its accreditation.
Next step
This week, run the gap analysis for your scope. List the requirements in clauses 4 to 10, mark each as met, partly met or missing, and count. Then pick one measurable objective, such as on-time delivery, and measure the current value. With those two numbers you have a starting point and an action plan for the next phases.
- Name an owner for each process, with management as sponsor.
- Close the missing items before the partly met ones.
- Schedule the internal audit before you contact a certification body.
- Request proposals from more than one accredited body and compare scope and audit days.
Frequently asked questions
What is ISO 9001?
It is the international standard of requirements for a quality management system. It defines what an organization must have, not how to make the product.
Is ISO 9001 mandatory?
The standard itself is voluntary. Many customers and tenders require it, which makes it a commercial requirement.
What are the auditable clauses of ISO 9001?
Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement.
How long does ISO 9001 implementation take?
It depends on company size, maturity and scope. The pace is set by meeting the exit criterion of each phase.
What is the difference between implementation and certification?
Implementation is building and running the system. Certification is being audited by an independent body that issues the certificate.
Who issues the ISO 9001 certificate?
A certification body, not ISO. It should be accredited by a national accreditation body.
What is the difference between stage 1 and stage 2 audits?
Stage 1 checks whether the system is ready. Stage 2 assesses implementation and effectiveness in real operation.
How long is the certificate valid?
Three years, with surveillance audits in years 1 and 2 and recertification in year 3.
Sources
- ISO 9001. Quality management systems: Requirements. Geneva: International Organization for Standardization.
- ISO 19011. Guidelines for auditing management systems. Geneva: International Organization for Standardization.
- JURAN, J. M.; DE FEO, J. A. Juran's Quality Handbook. New York: McGraw-Hill.
- EVANS, J. R.; LINDSAY, W. M. Managing for Quality and Performance Excellence. Boston: Cengage.
Want the tools ready to use?
Download the free "Problem Solving Kit" e-book, with PDCA, A3, 5 Whys and Ishikawa.
Download the e-book
About the author
Lean Manufacturing & Behavioral Management Specialist
Over 20 years in the automotive and metalworking industries (GM and Dana), Lean Manufacturing practitioner since 2006. SENAI instructor and mentor in Brazil’s Brasil Mais Produtivo program, delivering consulting, training and audits for 50+ companies, combining quality, productivity and people development.