Quality Management
ISO 9001
Learn, implement and run a Quality Management System (QMS)
ISO 9001 is the international standard for quality management. Strip out the jargon, and it asks three things: can you show you understand what your customers need, that you have consistent processes for delivering it, and that you do something useful when things go wrong.
ISO 9001 Options
ISO 9001 Quality Management Templates
Grab our complete set of Free QMS templates to help you get compliant.
ISO 9001 Coaching & Internal Audits
Need help implementing 9001?
That’s what we do.
ISO 9001 Checklist / Internal Audit Pack
Download our free pack of templates and guidance here.
Most businesses that struggle with ISO 9001 struggle because they build a quality management system for an imagined auditor rather than for their own business. The result is a folder of documents nobody reads, a system that adds cost without adding control, and a surveillance visit everyone dreads. We work the other way round. Build the smallest system that genuinely runs your business and satisfies the standard, then let it grow only where there is a reason to.
Looking into ISO 9001?
Here’s some quick guidance.
Free Gap Analysis assessment
Find out where you stand with our free online gap analysis tool.
5 minutes, and understand where you are.
What Is ISO 9001?
ISO 9001 is the international standard for a Quality Management System (QMS). It sets out what an organisation needs to have in place to consistently deliver products or services that meet customer and regulatory requirements, and to keep getting better at it.
It is published by the International Organization for Standardization (ISO) and is the most widely used management system standard in the world. It is not industry-specific: manufacturers, software companies, consultancies, charities and public bodies all certify to it. It does not tell you how to make your product or deliver your service. It asks you to show that you understand what your customers need, that you run consistent processes to deliver it, and that you act on what goes wrong.
The current edition is ISO 9001:2026, published on 16 September 2026. It replaces ISO 9001:2015, and organisations certified to the 2015 edition have a transition period of around three years to move across. More on that below.
Certification is optional. You can use ISO 9001 purely as a framework, but most organisations pursue it because customers, tenders or supply chains ask for a certificate from an accredited certification body.
The Seven Quality Management Principles
ISO 9001 is built on seven quality management principles, defined in ISO 9000. They are not audited directly, but every requirement in the standard traces back to one of them, and they are a useful test of whether your system is doing its job.
- Customer focus: understand and meet customer needs, and aim to exceed their expectations.
- Leadership: leaders set direction and create the conditions for people to deliver quality.
- Engagement of people: competent, empowered people at every level.
- Process approach: manage activities as connected processes, not isolated tasks.
- Improvement: keep improving, rather than standing still once certified.
- Evidence-based decision making: decisions rest on data and analysis, not instinct alone.
- Relationship management: manage relationships with suppliers and other interested parties.
How ISO 9001 Is Structured
ISO 9001 follows the same high-level clause structure as other ISO management system standards, including ISO 27001 and ISO 14001. That shared structure is what makes an integrated management system possible. Clauses 1 to 3 cover scope, references and terms; the requirements sit in clauses 4 to 10:
- Clause 4, Context of the organisation: the internal and external issues that affect you, your interested parties, the scope of your QMS and the processes within it.
- Clause 5, Leadership: top management commitment, the quality policy, and roles and responsibilities.
- Clause 6, Planning: actions to address risks and opportunities, quality objectives, and planning changes.
- Clause 7, Support: resources, competence, awareness, communication, organisational knowledge and documented information.
- Clause 8, Operation: how you plan, design, buy in, produce and deliver your products or services, and control what goes wrong.
- Clause 9, Performance evaluation: monitoring and measurement, customer satisfaction, internal audit and management review.
- Clause 10, Improvement: nonconformity, corrective action and continual improvement.
The logic is Plan, Do, Check, Act. Clauses 4 to 7 plan the system, clause 8 runs it, clause 9 checks it, and clause 10 acts on what the checks find.
What Changed in ISO 9001:2026?
The 2026 edition is an evolution, not a rewrite. The core principles and the clause structure stay the same, so a system built well against the 2015 edition transitions through updates rather than a rebuild. The main themes of the revision are:
- Quality culture and ethical behaviour: a stronger expectation that leaders actively promote both.
- Risks and opportunities: clearer separation of the two, with more emphasis on analysing and acting on them rather than simply listing them.
- Change management: planning, communicating and reviewing significant changes that could affect quality.
- Climate change: the 2024 climate change amendment is built into the context and interested parties requirements.
- Organisational knowledge: more on how knowledge is identified, retained and shared.
If you are already certified to ISO 9001:2015, your certificate remains valid during the transition period, and your certification body will agree when to audit you against the new edition. Our guide to what ISO 9001:2026 means for you covers the changes clause by clause.
What Documents Does ISO 9001 Require?
Far fewer than most people expect. ISO 9001 talks about “documented information” rather than procedures, and it only mandates a small core. You must maintain a scope, a quality policy and quality objectives, and retain records that show the system is working, such as:
- Evidence of competence and training.
- Reviews of customer and product or service requirements.
- Evaluation and monitoring of external providers (your suppliers).
- Monitoring and measurement results.
- The internal audit programme and its results.
- Management review outputs.
- Nonconformities and the corrective actions taken.
Beyond that, you document whatever your business needs to run consistently. A ten-person firm and a 500-person manufacturer will produce very different systems, and both can be compliant. The mistake to avoid is writing documents for an imagined auditor rather than for the people who use them.
How ISO 9001 Certification Works
Certification is carried out by an independent certification body. In the UK, look for one accredited by UKAS. The process follows a three-year cycle:
- Stage 1 audit: a readiness review of your documented system, scope and plans, which confirms you are ready for the main audit.
- Stage 2 audit: the certification audit, where the auditor checks that your processes are implemented and working, with evidence.
- Surveillance audits: shorter audits in years one and two after certification.
- Recertification: a fuller audit in year three, which starts the cycle again.
Before your certification audit, you will need to have run at least one internal audit and one management review. These are the two areas new systems most often fall short on. The number of audit days, and so most of the cost, is set by your headcount and complexity under a mandatory accreditation rule, not by negotiation. Our ISO 9001 certification cost guide breaks this down across the full three years.
ISO 9001 FAQs
Is ISO 9001 a legal requirement?
No. ISO 9001 is voluntary. In practice, it is often a condition of tenders, framework agreements and supply chains, which is why most organisations pursue certification.
Should we certify to ISO 9001:2015 or ISO 9001:2026?
If you are starting now, build to the 2026 edition and talk to your certification body about when they can audit against it. If you are already certified to 2015, plan your transition within the three-year window rather than waiting until the end of it.
Can a small business get ISO 9001 certified?
Yes. The standard scales to the size and complexity of the organisation. Small businesses often find it easier, because their processes are fewer and the people who run them are in the same room.
What is the difference between ISO 9001 and ISO 27001?
ISO 9001 is about consistently meeting customer requirements; ISO 27001 is about protecting information. They share the same clause structure, so many organisations run them as one integrated system. Our ISO 9001 vs ISO 27001 guide explains where they overlap.
Do we need a consultant?
Not necessarily. Many organisations implement ISO 9001 themselves using templates and guidance. Where outside help pays for itself is in an independent internal audit before certification, and in someone who has been on the auditor’s side of the table telling you what will actually be raised.
Before you commit
Two questions come up before anything else.
The first is cost. Certification pricing is opaque, and quotes for the same scope routinely vary by a factor of three depending on who you ask. Our breakdown of ISO 9001 certification costs covers certification body fees across the three-year cycle, what drives a quote up or down, and the internal time that almost never appears on the invoice but always appears in the project.
The second is scope. If you already hold ISO 27001, or you are weighing up both, the two standards share the same management system backbone, and a good deal of the work transfers directly. ISO 9001 vs 27001 sets out where they genuinely overlap, where they do not, and whether an integrated management system saves you money or just complicates your audit.
Doing the work
You do not need to buy a system to get started. Our toolkit gives you the QMS templates in Word and Excel, editable under your own name, covering the documented information the standard actually requires rather than everything it might conceivably want.
Clause 9.2 requires internal audits, and this is where most implementations quietly fall down. The internal audit pack provides a clause-by-clause structure for auditing your own system, whether you are conducting a first gap analysis or building an audit programme you can evidence at your next visit.
If you would rather have someone alongside you, our ISO 9001 coaching programme and ISO 9001 internal audit service cover both routes: guiding you through implementing it yourself, or delivering the independent internal audit the standard requires. If you need ISO 27001 as well, we build and audit both as one integrated management system.
Who you will be working with
Our ISO 9001 work is led by Fiona Parker, a BSI-qualified Lead Auditor.
That matters for two reasons. You get guidance from someone who has sat on the auditor’s side of the table and knows what actually gets raised as a finding. And when we deliver your internal audit, it is conducted to the same standard your certification body applies, so nothing from your surveillance visit comes as a surprise.
About Fiona
Most people who audit quality management systems have only ever assessed other people’s. Fiona spent six years running one: she owned the integrated ISO 9001, 14001 and 45001 management system at a UK critical power systems contractor working across the UK, Central Europe and Scandinavia, built it from scratch, and took it through initial certification and recertification with four years of certification and surveillance audits along the way.
Before quality management, she spent two decades assessing how organisations actually work, including seven years benchmarking service management processes at Pink Elephant and nearly seven years at McLaren, latterly as Head of IT Support Services.
That combination means findings framed in terms your board will recognise, not just clause references.
Fiona Parker