ISO 9001 is one of the best-known international standards in the world. It sets out the requirements of a quality management system that helps an organization consistently deliver products and services that meet customer requirements, and improve its performance continually.
Its requirements are written generically, so they can be applied by any organization, whatever its type, size or the nature of its products and services: a manufacturer, a hospital, a public administration or a training centre. The explanations below are based on the ISO 9001:2015 edition; since international standards are revised periodically, it is always advisable to check which edition is in force.
What does the standard require?
ISO 9001 does not impose a single way of working; it specifies what the system must include: understanding the organization’s context, leadership commitment, planning — including addressing risks and opportunities —, resources and competence, operational control, performance evaluation and improvement. It rests on the quality management principles, such as customer focus, the process approach and continual improvement, and leaves the organization free to choose how it meets these requirements.
The structure of the standard: clauses 4 to 10
The first three clauses cover scope, normative references, and terms and definitions; the requirements themselves sit in seven clauses:
- Clause 4, context of the organization: internal and external issues, interested parties and their expectations, the scope of the system and its processes.
- Clause 5, leadership: top management commitment, customer focus, the quality policy, roles and responsibilities.
- Clause 6, planning: addressing risks and opportunities, quality objectives and planning of changes.
- Clause 7, support: resources, competence, awareness, communication and documented information.
- Clause 8, operation: planning and controlling processes, from determining customer requirements to delivering the product or service and controlling nonconforming outputs.
- Clause 9, performance evaluation: monitoring, measurement, analysis and evaluation, customer satisfaction, internal audit and management review.
- Clause 10, improvement: dealing with nonconformities, corrective action and continual improvement.
These clauses map onto the PDCA cycle: Plan in clause 6, Do in clauses 7 and 8, Check in clause 9 and Act in clause 10, with leadership at the heart of the cycle. Other standards share this common structure — ISO 14001 for the environment, ISO 45001 for occupational health and safety, ISO 22000 for food safety, ISO/IEC 27001 for information security — which makes it easier to combine them into one integrated management system.
Documented information
The standard uses the term documented information instead of speaking of "procedures" and "records" in the traditional sense. It distinguishes information to be maintained, such as the scope, the quality policy and quality objectives, from information to be retained as evidence of what has been done, such as evidence of competence, the results of internal audits and management reviews, and corrective actions. It no longer requires a quality manual as such, and leaves it to the organization to decide how much documentation suits its size, the complexity of its processes and the competence of its people.
Certification and accreditation: what is the difference?
- Certification: an assessment by an independent body confirming that the organization’s system meets the standard’s requirements.
- Accreditation: formal recognition, by an accreditation body, of the competence of the certification body itself.
The International Organization for Standardization develops standards but does not issue certificates. It is therefore advisable to check that the chosen certification body is accredited by a recognized accreditation body and that its accreditation covers the organization’s field of activity.
A typical path to certification
- Leadership commitment and definition of the system’s scope, i.e. the sites and activities covered.
- Gap analysis between the current situation and the requirements of the standard.
- Identification of processes, their interactions and risks, and preparation of the documented information needed.
- Implementation of the system and staff training, running it long enough to generate evidence.
- Internal audit and management review, and treatment of any nonconformities found.
- Stage 1 audit: an accredited certification body reviews the documentation and the organization’s readiness.
- Stage 2 audit: an on-site evaluation of the system’s implementation and effectiveness, followed by the certification decision.
- Periodic surveillance audits, usually annual, during the three-year certification cycle, followed by a recertification audit.
Worked example: a small manufacturer
A small manufacturer of metal parts decides to build a quality management system. The gap analysis shows that customer orders are taken by telephone without their requirements being recorded, that measuring instruments are not calibrated periodically and that complaints are handled informally. The company introduces a simple form to review each order before accepting it, a calibration schedule for measuring instruments and a complaints log in which the root cause of each case is analysed, and sets a quality objective linked to reducing returns. Two operators from two different workshops are then trained in internal auditing, each auditing the other’s workshop, and a management review is held to evaluate the results and take decisions. The main lesson: the system stayed simple, with few documents, but documents that are actually used.
Common mistakes
- Treating the certificate as the goal instead of a tool for improvement.
- Over-documenting at the expense of practice.
- Copying ready-made documents from another organization that do not reflect actual practice.
- Leaving the project to one person without involving everyone.
- Turning the management review into a formality where no decisions are taken.
The value of ISO 9001 lies in the system an organization builds, not in the certificate on the wall.
