What does ISO 9001 certification require?

The QMS clauses (4 to 10)

ISO 9001:2015 is organized into requirement clauses 4 through 10: context of the organization (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9), and improvement (10). You document a QMS that addresses each, scoped to your organization. Clauses 1 to 3 cover scope, references, and terms.

Scope and exclusions

Clause 4.3 asks you to set the boundaries of the QMS and keep them as documented information. You can treat a requirement as not applicable, but you must justify it. The exclusion may not affect your ability to deliver conforming products and services or to enhance customer satisfaction. A firm that does no design work of its own might justify 8.3 (design and development) as not applicable on that basis. Your certificate states the scope, so a narrow scope gives you a narrow certificate.

Top management and customer focus

Clause 5 puts the QMS on top management. They are accountable for its effectiveness (5.1.1), they set the quality policy (5.2), and they assign roles and authorities (5.3). Under 5.1.2 they also answer for customer focus: customer and legal requirements are determined and met, and risks to conformity and customer satisfaction are addressed. Clause 9.1.2 then asks you to monitor how customers see what you deliver, and 9.3 has top management review the whole QMS at planned intervals. Auditors usually interview top management in person. A QMS that a quality manager runs alone, with no sign of leadership involvement, tends to draw findings.

Built on risk-based thinking and continual improvement

The standard is founded on the quality management principles (customer focus, leadership, engagement of people, the process approach, improvement, evidence-based decision making, and relationship management) and on risk-based thinking and the plan-do-check-act cycle, rather than a fixed checklist of controls.

Criteria for ISO 9001 certification

To be certified, your QMS has to meet every applicable requirement in clauses 4 to 10, and you have to show it running. ISO 9001:2015 does not require a quality manual or a fixed set of written procedures. It asks for documented information and leaves the format to you. Auditors will still ask for specific records. Expect to show your QMS scope (4.3), quality policy (5.2), quality objectives (6.2), evidence of competence (7.2), internal audit results (9.2), management review outputs (9.3), and records of nonconformities and corrective action (10.2). Certification bodies generally want at least one full internal audit and one management review done before the Stage 2 audit, so the system has to run for a while before you book it.

Certification is a three-year cycle

An accredited certification body assesses your QMS in a Stage 1 (documentation and readiness) and Stage 2 (implementation and effectiveness) audit, issues a certificate valid for three years, conducts annual surveillance audits, and recertifies at year three. ISO publishes the standard and does not certify anyone itself. Major nonconformities raised at Stage 2 have to be corrected before the certificate is issued.

Where Keel fits

Keel Quality, a paid add-on, adds the product-quality half of ISO 9001 (nonconforming outputs, supplier quality, complaints, and change control) on the same graph as your ISMS. The management-system clauses ISO 9001 and ISO 27001 hold in common (internal audit, management review, corrective action) are in your workspace on every plan, add-on or not, so running both is one program.

FAQ