ISO 9001
The quality standard, and the one with no Statement of Applicability.
ISO 9001 has no Annex A and no Statement of Applicability; a customer or a tender makes it required, and the first number to know is what the audit takes for a company of your size.
For 25 people the certification audit is 3 auditor days under IAF MD 5 Table QMS 1, against 7 for ISO 27001 at the same headcount: €3,600 to €6,000 for the initial audit and €6,000 to €10,000 for the three-year cycle, at the day rates accredited bodies in Europe charge, audit fees only.
Read the arithmetic, from IAF MD 5Built on ISO 9001:2015, which certified organisations are audited against until they transition by 30 September 2029. The edition notice
- Who it applies to
- A company whose customers or tenders ask for ISO 9001, the quality management standard: it describes the system that turns a customer's requirement into what is delivered, and the records that show it ran.
- The dates
- Before the first tender that names the standard, since the system has to run long enough to have records before the certification audit; then a management review at least once a year and a surveillance audit each year of the three-year cycle.
- The one thing to do
- Write the quality manual, the one document that says what the company delivers, the scope, the processes and where each clause's evidence lives; the quality policy, the management review minutes and the audit programme follow from it, and every one has a free page here that writes it. Write the quality manual
TED, the EU's procurement portal, carried 17,076 notices naming ISO 9001 in the last 365 days against 3,405 naming ISO 27001, 5 times as many, read on 12 September 2026. Where, by country, and how often a buyer asks for both
What we hold, clause by clause
The three-year certificate cycle
- Stage 1 audit
- Stage 2 audit3 auditor days, stages 1 and 2
- Certificate
- Surveillance, year 1about 1 auditor days
- Surveillance, year 2about 1 auditor days
- Recertification, year 3
Auditor days for 25 people in scope, IAF MD 5:2023, Issue 4, Version 3, Annex A, Table QMS 1; surveillance is about a third of the initial audit.
Of 36 clauses. The 8 we hold in part:
Every clause carries a note inside the product saying what is held and what is still missing. This list is meant to shrink, and the clause 8 entries left it when their registers were built.
Most of it you have already built
Clauses 4 to 7, 9 and 10 are the Harmonized Structure, the same skeleton as ISO 27001 and ISO 42001: context, interested parties, leadership, competence, documented information, internal audit, management review, corrective action. If you run one of those standards you have most of ISO 9001's management system already, and StandardOS keeps those records once for every standard you hold rather than once per standard.
Clause 8, held for each product or service
ISO 9001 clause 8 is Operation, and each product or service you sell carries its clause 8 record in StandardOS. That is the requirements with every review before a commitment, the design record or its exclusion, how it is produced and traced, and who releases it. Nonconforming outputs have a register of their own. The orders, the drawings and the shop floor stay in the tools that run the work.
Honest about what it does not do
You get the clause register, the recurring calendar of obligations, starting policies, a risk register and the clause 4 to 6 records. Each product or service also carries its clause 8 records. You do not get a Statement of Applicability, because the standard does not have one.
Design history and unit-level traceability stay in the systems built for them. The register holds what the management system is asked for, and the exclusion where you do not design. The clauses still held in part are listed above, and each says inside the product what it lacks.
Five tools, free, no account
- Document writerWrite the quality policyClause 5.2 from ten answers: what the company delivers, why quality matters to it, the commitments, the objectives it will measure, who is accountable, and how the policy is communicated and reviewed.
- Document writerWrite the internal audit programmeClause 9.2 from five answers and the names of your processes: the criteria, the frequency, the auditors and their independence, the methods, a schedule that spreads the seven clause sections and your processes over the year's audits, the reporting and the records.
- Document writerWrite the management review minutesClause 9.3 as an agenda: the six inputs in the clause's order, the seven performance trends with their counts, the conclusion on the system, the decisions on improvement, changes and resources, the actions with owner and date, and the minutes an auditor reads.
- Document writerWrite a corrective action recordClause 10.2 for one finding: the nonconformity, the correction and its consequences, the cause, whether it exists elsewhere, the action with owner and date, the effectiveness check, the risks and opportunities updated, and the change to the system, as the record an auditor reads.
- Document writerWrite the quality manualThe one document that describes the quality system: what the company delivers, the scope and the exclusions, the processes, the roles, and a clause map that names where the evidence for every clause lives, from a few answers.
Every free template on one page
Read next
- ArticleDoes ISO 9001:2015 require a quality manual? What clause 7.5 asks for instead, the 21 places the standard names documented information, and what a manual is for todayISO 9001:2008 required a quality manual; ISO 9001:2015 does not, and says so in its Annex A.
- ArticleThe ISO 9001 management review: the 13 inputs and 3 outputs of clause 9.3 as an agenda, where each input comes from, and what the minutes have to showClause 9.3 of ISO 9001:2015 is the one meeting the standard writes the agenda for.
- ArticleThe ISO 9001 quality policy: the four things clause 5.2 says it must contain, the three things that must happen to it, and a one-page exampleClause 5.2 of ISO 9001:2015 is short and precise.
- ArticleWhich EU countries name ISO 9001 in public tenders: 4,897 German notices, 4,743 Romanian, and one in ten Romanian notices names itOver 365 days, ISO 9001 appears in 16,356 TED notices from EU-27 buyers, 1.87% of everything they published and five times the 3,361 that name ISO 27001.
- ArticleHow to check an ISO 9001 certificate is real: what a certificate must show, three checks that take ten minutes, and the 27 accreditation registersISO does not certify companies and keeps no register of them, so a certificate is only as good as the body that issued it and the accreditation behind that body.
- ArticleISO 9001 for a software company: what clause 8 means when the product is code, sub-clause by sub-clauseClauses 4 to 7, 9 and 10 of ISO 9001:2015 are the management-system skeleton an ISO 27001 company already runs.
- ArticleWhat ISO 9001 certification costs: the audit days IAF MD 5 fixes by headcount, the day rate, the three-year total, and why it is a third of ISO 27001Certification bodies do not publish prices, but the audit days are not their opinion: IAF MD 5 sets them by the number of people in scope, 1.5 days for up to five people, 3 for 16 to 25, 7 for 86 to 125, and the accreditation body holds the certifier to the table.
What it asks of you
36 clauses in 7 sections
Clause 4
4- 4.1 The issues, internal and external, that affect the quality system
- 4.2 Interested parties and what they require of you
- 4.3 The scope of the quality management system, documented
and 1 more
Clause 5
4- 5.1.1 Top management demonstrating commitment to the system
- 5.1.2 Customer focus: meeting customer and legal requirements
- 5.2 A quality policy, documented, communicated and available
and 1 more
Clause 6
3- 6.1 Actions to address the risks and opportunities that matter
- 6.2 Quality objectives, measurable, monitored and planned for
- 6.3 Changes to the system, planned rather than improvised
Clause 7
10- 7.1.1 Resources determined and provided
- 7.1.2 People needed to run the system
- 7.1.3 Infrastructure for the operation of processes
and 7 more
Clause 8
7- 8.1 Planning and controlling the processes that deliver the product
- 8.2 Customer requirements: communication, determination, review and change
- 8.3 Design and development, from planning through to changes
and 4 more
Clause 9
5- 9.1.1 What is monitored and measured, by what methods, and when
- 9.1.2 Customer satisfaction, monitored as a perception
- 9.1.3 Analysis and evaluation of the resulting data
and 2 more
Clause 10
3- 10.1 Determining and selecting opportunities for improvement
- 10.2 Nonconformity and corrective action, through to effectiveness
- 10.3 Continual improvement of the system's suitability and adequacy
The ISO 9001 system and its records, in one place
Every clause as a register, with the processes, nonconformities and management reviews that evidence it, in one workspace.
Related:ArticlesFree tools