ISO 9001 Certification: Requirements, Process and Readiness

What is ISO 9001?

ISO 9001:2015 is the international standard for quality management systems. It sets out how an organisation should plan, run, check and improve the way it delivers products and services so customers get consistent results. It does not tell you how to run your business; it tells you which management practices must be in place and which records prove they work.

In 2024 an amendment added climate change considerations to clauses 4.1 and 4.2. In practice, you now need to consider whether climate change is a relevant issue for your organisation and whether interested parties have climate-related requirements.

Who needs it

ISO 9001 applies to any organisation, whatever its size or sector — manufacturers, service providers, software companies, contact centres, distributors and public bodies. Organisations usually pursue it for one of three reasons:

• Customers or tenders require a certified quality management system.
• Growth makes informal ways of working unreliable, and leaders want consistent processes.
• It forms the base for other management system standards such as ISO 14001 or ISO 27001.

What ISO 9001 requires

The requirements sit in clauses 4 to 10. Here is what each one means in practice:

• Context (clause 4) — understand the issues that affect you, the needs of interested parties, and define the scope of your quality management system.
• Leadership (clause 5) — top management owns the system, sets a quality policy and assigns roles and responsibilities.
• Planning (clause 6) — identify risks and opportunities, set measurable quality objectives and plan changes properly.
• Support (clause 7) — provide people, infrastructure, monitoring equipment, competence, awareness, communication and controlled documents.
• Operation (clause 8) — plan and control how you review customer requirements, design, buy from suppliers, deliver, release and handle nonconforming output.
• Performance evaluation (clause 9) — monitor and measure, track customer satisfaction, run internal audits and hold management reviews.
• Improvement (clause 10) — deal with nonconformities, find root causes, take corrective action and keep improving.

The standard is written to fit your business. A small service company and a large manufacturer will meet the same clauses in very different ways.

Documents and evidence auditors expect

ISO 9001 calls documents and records “documented information”. Auditors typically expect to see:

• QMS scope (4.3)
• Quality policy (5.2)
• Quality objectives (6.2)
• Calibration and measurement records, where relevant (7.1.5)
• Competence records (7.2)
• Review of customer requirements (8.2.3)
• Design and development records, if applicable (8.3)
• Supplier evaluation records (8.4)
• Traceability and release records (8.5–8.6)
• Nonconforming output records (8.7)
• Monitoring and measurement results (9.1)
• Internal audit programme and results (9.2)
• Management review results (9.3)
• Nonconformities and corrective actions (10.2)

Beyond these, auditors look for evidence that people follow your processes: procedures, work instructions, forms, and conversations with staff on the floor.

How the certification process works

Most organisations follow the same path to ISO 9001 certification. The certificate itself is issued by an accredited certification body after its audit — not by CertiFlow and not by a consultant.

• Readiness or gap check — compare what you have today with the requirements and list what is missing.
• Implement and run the system — put the missing documents and controls in place and operate them long enough to produce real records.
• Internal audit and management review — check the system yourself and have top management review its results.
• Stage 1 audit — the certification body reviews your documentation and confirms you are ready for the main audit.
• Stage 2 audit — auditors check that the system is implemented and working in practice, through interviews, observation and records.
• Certification cycle — the certificate is valid for three years, with surveillance audits every year and a recertification audit in year three.

Findings raised at Stage 2 must be addressed before the certificate is issued, which is why closing gaps beforehand matters so much.

How CertiFlow gets you audit-ready

CertiFlow is an AI pre-certification platform. For ISO 9001 it checks your quality documents against clauses 4–10, turns every gap into a task, drafts what is missing and keeps your records ready for the auditor.

1. Free pre-certification check — Answer 5 quick questions and get your full questionnaire by email, or choose an AI audit of your documents.
2. AI certification audit — Upload your policies, procedures and forms. AI checks them against the requirements and lists every task still open.
3. Fix the gaps — AI drafts missing policies, procedures and forms so your team reviews and approves instead of writing from scratch.
4. Collect and verify evidence — Keep documents, photos and videos in one place, organised by requirement and checked by AI.
5. Audit day — Everything your auditor needs is verifiable and in one place.

Free pre-certification check

Start with 5 quick questions about your ISO 9001 journey. Receive your full questionnaire by email, or upload policies, SOPs and evidence for an AI pre-certification audit.

Start your free pre-certification check

Frequently asked questions

How long does ISO 9001 certification take?

It depends on your size and how mature your processes already are. The system must run long enough to produce real records, including at least one internal audit and one management review, before the certification audit. A readiness check shows how much work remains.

How much does ISO 9001 certification cost?

Cost depends on the size of your organisation, the number of sites and the certification body you choose. Quotes come from accredited certification bodies, so ask more than one for a proposal based on your scope. Internal effort is usually the bigger variable: preparing documents and records before the ISO 9001 audit is where most time goes, and that is the part CertiFlow helps with.

What documents are mandatory for ISO 9001?

The standard requires documented information such as the QMS scope, quality policy, quality objectives, competence records, supplier evaluation records, nonconforming output records, monitoring results, internal audit results, management review results and corrective action records — plus whatever else you need to run your processes effectively.

What's the difference between the Stage 1 and Stage 2 audit?

Stage 1 reviews your documentation and confirms you are ready. Stage 2 checks that the system is actually implemented and working, through interviews, observation and records.

Can AI help us get ISO 9001 certified?

AI cannot issue a certificate, but it can do much of the preparation: checking your documents against the requirements, listing gaps, drafting missing procedures and organising evidence. The certification decision always stays with an accredited certification body.