ISO 9001
Quality management systems — Requirements. Updated: September 29, 2026.
ISO 9001 is the most widely held certificate in the world, and the one most likely to appear as a hard requirement in a public tender. It is not about product quality in the sense of excellence. It is about consistency: doing what you said you would do, finding out when you did not, and fixing the reason.
What It Requires
The structure will look familiar if you have read ISO 27001, because they share the same high-level clause structure deliberately — context, leadership, planning, support, operation, performance evaluation, improvement. The content differs:
- Understand your customers' requirements, and confirm you can meet them before you agree to.
- Define your processes, their inputs and outputs, and who owns them.
- Control your suppliers, because their output becomes yours.
- Handle nonconforming work — what happens when something is wrong, and how you stop it recurring.
- Measure customer satisfaction, and act on what it says.
- Risk-based thinking throughout, rather than a separate risk register.
Why an IT Business Would Bother
Usually because a customer requires it. In public procurement across much of Europe it is a scoring criterion or a qualification threshold, and no amount of demonstrated competence substitutes for the certificate number on the form.
The secondary reason is more interesting: it is the cheapest management system to run first. The clause structure is shared with 27001, 22301 and 20000-1, so the internal audit process, the management review, the document control and the corrective action process are built once and reused. An organisation that already holds 9001 finds 27001 substantially cheaper than one starting cold.
The Honest Criticism
ISO 9001 has a reputation for producing documentation rather than quality, and the reputation is partly earned. A system built to satisfy an auditor, describing processes nobody follows, passes audits and improves nothing. The standard does not require that outcome — it is what happens when the certificate is the goal rather than the by-product. Worth saying plainly before anyone starts.
What the Auditor Will Ask to See
- The scope statement and the process map — what you do, in what order, and who owns each step.
- Customer requirements captured and confirmed, for a sample of engagements: what was agreed, and evidence you checked you could deliver it before agreeing.
- Nonconforming work: the log, and for a sample, what was done and what stopped it recurring. An empty log over twelve months is read as not looking, not as perfection.
- Supplier evaluation — who you rely on, how they were assessed, and evidence of ongoing performance.
- Customer satisfaction measured, and the actions it produced. Measurement with no resulting action is the most common weakness here.
- Internal audit and management review, both mandatory, both with records showing the required inputs were considered.
- Competence: that the people doing the work are qualified to, and the training records to show it.
What It Does Not Prove
Nothing about the quality of your product. ISO 9001 certifies that you have a system for doing what you said you would do, finding out when you did not, and fixing the cause. A company making a consistently mediocre thing, consistently, satisfies it. That is not a flaw in the standard — consistency is genuinely what it measures — but it is why a certificate answers a procurement question rather than a question about whether the work is good.
Getting Certified
The process is the same eight steps as 27001: gap analysis, define scope and processes, implement, operate long enough to produce records, internal audit and management review, Stage 1, Stage 2, certificate for three years with annual surveillance. Three to nine months is typical for a first certification, and less for a small organisation with well-understood processes. Check the current edition and any transition deadline before you begin.
Written from an infrastructure perspective. We are not a certification body, an audit firm or a legal adviser, and this is not legal advice. Standards are revised on a cycle — confirm the current edition before you commit.