ISO 9001 is the internationally recognised standard for Quality Management Systems (QMS). For many businesses, the idea of achieving certification feels daunting: a mountain of documentation, complex audits, and unfamiliar jargon. In practice, with the right approach, the process is far more manageable than it appears.
This guide walks through the ISO 9001 certification process step by step, so you know exactly what to expect and how to prepare.
What is ISO 9001?
ISO 9001 sets out the criteria for a Quality Management System. It is based on a set of quality management principles including a strong customer focus, the involvement of senior management, a process approach, and continual improvement.
Certification demonstrates to your customers, partners, and regulators that you have a robust, systematic approach to quality: and that you can consistently deliver products and services that meet customer requirements.
Who needs ISO 9001?
ISO 9001 applies to any organisation, regardless of size or sector. It is particularly valuable for:
- Businesses tendering for public sector contracts where certification is a prerequisite
- Companies in supply chains that require suppliers to be certified
- Organisations that want a structured framework for improving quality and reducing errors
- SMEs seeking to build credibility and win larger contracts
The certification journey: step by step
Step 1: Initial gap analysis
The first step is to understand where you currently stand relative to the standard’s requirements. A gap analysis maps your existing processes against the ISO 9001 clauses and identifies what is in place, what is partially in place, and what is missing.
This produces a prioritised action plan so that your implementation effort is targeted and efficient. It also helps to set realistic timescales for certification.
Step 2: Bespoke documentation
ISO 9001 requires certain documented information: including a quality policy, a quality manual (optional but useful), objectives, and evidence of process outputs. The key is that documentation should reflect how your business actually operates, not how a generic template says it should.
Bespoke documentation, written around your specific processes and language, is far more useful than off-the-shelf templates and is much easier to maintain after certification.
Step 3: Implementation
Documentation alone is not enough. The standard requires that processes are actually implemented and followed. This phase involves:
- Communicating the QMS to staff and explaining their roles within it
- Training teams on new or revised processes
- Establishing monitoring and measurement activities
- Running the QMS for a period before the certification audit (typically three to six months) to generate the records and evidence an auditor will expect to see
Step 4: Internal audit
Before the certification audit, ISO 9001 requires at least one internal audit of the entire QMS. This is a formal check that the system is operating as documented and that any nonconformities are identified and addressed.
Internal audits are often the most valuable part of the certification journey: they find the gaps before the external auditor does, giving you the opportunity to correct them.
Step 5: Management review
Senior management must review the QMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. This management review must be documented and must cover defined inputs and outputs.
This step is important: it puts quality management firmly on the leadership agenda, rather than delegating it entirely to a quality manager.
Step 6: Certification audit
The certification audit is conducted by an accredited certification body (also called a registrar or notified body). It is typically conducted in two stages:
Stage 1 (document review): The auditor reviews your documentation and checks that your QMS is ready for the Stage 2 audit. They will confirm that your documented system meets the requirements of the standard and that internal audits and management reviews have been completed.
Stage 2 (main audit): The auditor visits your premises (or conducts a remote audit) to verify that the QMS is implemented and effective. They will interview staff, review records, and observe processes. Any nonconformities found are classified as major or minor. Major nonconformities must be resolved before certification can be granted.
Step 7: Maintaining certification
Certification is not a one-time event. Certification bodies conduct surveillance audits (typically annually) to verify that the QMS is being maintained and improved. Every three years, a recertification audit is required.
Common pitfalls to avoid
Over-documenting. ISO 9001:2015 significantly reduced mandatory documentation compared to earlier versions. Document what is useful for your business: not everything imaginable.
Treating it as a paperwork exercise. Certification gained without real implementation is fragile and quickly becomes a liability at surveillance audits.
Underestimating staff buy-in. A QMS that is owned only by one person in the business will not survive. Involving teams early makes implementation smoother and certification more sustainable.
Choosing the wrong certification body. Use a UKAS-accredited certification body. Accreditation by the UK Accreditation Service means the certification is recognised internationally and by most procurement frameworks.
How Elmar can help
At Elmar Risk Management, we guide businesses through every stage of the ISO 9001 certification process: from the initial gap analysis through to supporting you on the day of the certification audit. We prepare bespoke documentation that reflects your actual processes, mentor your team through implementation, and conduct a rigorous internal audit so there are no surprises on audit day.
Whether you are starting from scratch or refreshing a lapsed certification, we can help you achieve certification efficiently and build a QMS that genuinely supports your business.
Get in touch to discuss your ISO 9001 certification plans.
Share:
LinkedIn