What is ISO 9001?

What it is

ISO 9001 is a set of requirements for how an organization controls the quality of what it delivers. The current edition is ISO 9001:2015. It does not tell you how to make your product. It tells you that you must define your processes, plan for the things that could go wrong, keep evidence that the plan is being followed, check the results, and act on what the checking finds.

The requirements sit in clauses 4 through 10: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. Clauses 1 through 3 are scope, references, and vocabulary, and carry nothing you have to do.

Two things about the 2015 edition matter to a manufacturer. It is risk-based, so you are expected to think about what could go wrong in each process rather than follow a fixed template. And it dropped the requirement for a quality manual as a named document, which is why the old binder on the shelf is no longer the point.

Certification is a separate thing from conformance. You can run a system that conforms to ISO 9001 and never be certified. What a customer usually wants is the certificate, because that is third-party evidence they can file.

When you will hear it

In a purchase order, a supplier agreement, or a request for quote. Customer flowdown language typically requires that your quality system conform to ISO 9001 as documented by a third-party registrar, and reserves a right to ask for your certificate annually.

In a tender. Certification is often a bid condition rather than a preference, which is why the trigger for most of these projects is a specific customer rather than a general desire to improve.

From your own people, usually as shorthand for the audit. When somebody says "we have ISO next month," they mean the registrar is coming.

What the auditor expects to see

Evidence, sampled across your processes, that the system described on paper is the system running on the floor.

In practice, the auditor picks a thread and pulls it. A customer order becomes a work order, becomes a material release, becomes an inspection record, becomes a shipment. At each step they look for the record the process says exists, signed by someone the competence records say was qualified to sign it.

The pattern that fails is a system written for the audit rather than for the work. Procedures that describe a process nobody follows produce findings faster than having no procedure at all, because the gap between the document and the practice is itself the nonconformity.

Common mistakes

Buying a template set and adopting it wholesale. Generic procedures describe a generic company. The auditor is looking at yours.

Treating it as a paperwork exercise. The clauses that get cited most are the ones that require ongoing activity: internal audits, management review, corrective action. Those cannot be produced the week before the visit.

Confusing ISO 9001 with your customer's own standard. Aerospace primes usually want AS9100, automotive wants IATF 16949, medical devices want ISO 13485. Each is built on ISO 9001 and adds to it. Read the clause your customer actually cited.

Assuming certification is permanent. It runs on a three-year cycle with annual surveillance audits in between, and it can be suspended.

FAQ

Is ISO 9001 a legal requirement?

No. It is voluntary as a matter of law. It becomes effectively mandatory when a customer contract requires it, which is how most manufacturers end up certified.

How many companies are certified?

Roughly 28,800 certificates in the United States as of 2024, a figure that has moved between about 25,000 and 30,000 for a decade. Fabricated metal, electrical and electronic equipment, and machinery are among the largest sectors worldwide.

Does ISO 9001 improve quality on its own?

It improves control, which is not the same thing. In the 2020 user survey, organizations rated process control and customer satisfaction as the top benefits. A system that only satisfies an auditor delivers neither.

Can a small shop get certified?

Yes, and the smaller you are the cheaper it gets, because audit time is set by headcount. Below about 25 employees the do-it-yourself route is realistic. Above that, the cost is mostly your own people's time.