Guide

ISO 9001 requirements, a practical guide

ISO 9001 is the international standard for quality management systems. It does not tell you how to run your business, it asks you to show that you understand your customers, control the work that affects quality, and improve on evidence. This guide walks through what the standard requires, what auditors look for, and how growing organisations get from first read to certificate.

• Written for SMEs and medium-sized organisations preparing for certification
• Links each requirement to the record that proves it
• Covers the current edition and the 2026 revision

What ISO 9001 is for

ISO 9001 sets out the requirements for a quality management system (QMS). Certification shows customers and tenders that you consistently deliver what you promise, and that you have a system for catching and fixing problems.

The standard follows the same high level structure as ISO 14001, ISO 45001 and ISO 27001, so a well built QMS becomes the backbone of an integrated management system later.

The core requirements, at a glance

• Understand your context, interested parties and the scope of your QMS (clause 4)
• Top management leadership, a quality policy and clear roles (clause 5)
• Risk based planning, quality objectives and planned change (clause 6)
• Resources, competence, awareness, communication and document control (clause 7)
• Operational control from customer requirements through design, purchasing, production and release (clause 8)
• Monitoring, customer satisfaction, internal audit and management review (clause 9)
• Nonconformity, corrective action and continual improvement (clause 10)

What auditors actually sample

Certification bodies test whether the system works, not whether a manual exists. Expect them to pick a recent order and follow it end to end, sample training and calibration records, read management review minutes, and trace a nonconformity from report to verified fix.

The most common findings in first audits are internal audits that do not cover the full scope, corrective actions closed without effectiveness checks, and objectives that are not measured.

ISO 9001 and the 2026 revision

ISO 9001 is being revised, with publication expected in 2026 and a transition period for certified organisations to follow. The structure stays familiar. If you are starting now, build to the current edition and plan for the revision rather than waiting.

Next steps

1. Run a gap analysis. Compare what you already do with each requirement, and record the evidence you hold against it.
2. Close the gaps and run the system. Build the missing processes, then operate them for long enough to generate real records, usually two to three months.
3. Audit, review, certify. Complete one internal audit cycle and a management review, then book Stage 1 and Stage 2 with an accredited certification body.

Frequently asked questions

Is ISO 9001 a legal requirement?

No. It is voluntary, but many customers, public sector buyers and supply chains ask for it as a condition of doing business.

Do we need a quality manual?

Not since the 2015 edition. You need documented information where the standard asks for it, such as the scope, quality policy, objectives and key records. Many organisations keep a short manual because it helps people navigate the system.

How long does certification take?

Typically three to six months for a small or mid-sized organisation, depending on how much of the system already exists in practice.

Who issues the certificate?

An independent certification body, ideally one accredited by UKAS in the UK. Consultants and software providers cannot certify you.

Related guides

• ISO 9001 clauses explained, Clauses 4 to 10 in plain English, with the records each one produces.
• ISO 9001 internal audit guide, How to plan, run and report an internal audit programme that meets clause 9.2.
• ISO 9001 gap analysis, Find out where you stand against each requirement.
• ISO 9001 overview, Who needs the standard and how our packages support it.
• ISO 45001 certification guide, The route to ISO 45001 certification, from gap analysis to Stage 2 and surveillance.
• ISO 27001 requirements guide, What the ISO/IEC 27001 standard requires, how Annex A works and how certification runs.

Turn the requirements into a working QMS

The platform maps your documents to each ISO 9001 clause, flags the gaps and keeps evidence ready for audit, with consultants on hand when you need them.