What Are the Requirements for ISO 9001?

This guide outlines the requirements for ISO 9001 certification and provides an overview to support your understanding of ISO 9001 certification.

ISO 9001 specifies the requirements for a process-based Quality Management System (QMS) aligned with an organisation’s operations and objectives.

The standard is structured in clauses 1–10.

It begins with introductory clauses 1-3. Clause 1 defines the purpose and applicability of ISO 9001:2015, clause 2 lists ISO 9000 as the key normative reference, and clause 3 sets out essential terms and definitions used throughout the standard.

Clauses 4–10 go on to address different aspects of quality management, from organisational context to improvement.

Learn more with our guide to ISO 9001 clauses.

Documented information helps support the implementation and operation of your QMS, and some records are required to demonstrate conformity. Key types of required documentation include:

Scope of the Quality Management System (Clause 4.3)

A documented scope is required under Clause 4.3 of ISO 9001. It defines your organisation’s activities and the areas covered by the QMS, which helps auditors understand its boundaries.

It describes:

• The products and services you offer
• Any rules or regulations you need to follow
• Your main business activities
• All your locations and departments
• What parts of your business your quality system covers

A scope document helps auditors know exactly what to evaluate, prevents customer misunderstandings about your certification, and keeps your team focused on the right areas. It’s a specific requirement of the standard (Clause 4.3) and helps keep your quality system manageable by preventing it from expanding beyond its intended areas.

While the QMS may not cover every part of the business, any exclusions must be justified and must not affect the organisation’s ability to meet customer or regulatory requirements.

Without a clear scope, you risk creating an overly complex system or missing critical elements that should be included.

Quality Policy Statement (Clause 5.2)

Clause 5.2 of ISO 9001 requires a documented quality policy that communicates your quality goals and commitment to meeting requirements. It includes your goals to employees, customers, and auditors, providing direction for your entire quality management system.

ISO 9001 requires this statement explicitly (Clause 5.2) as it demonstrates top management’s commitment to quality principles and continual improvement.

The policy also creates a foundation for setting measurable quality objectives and helps align everyone in your organisation around common quality values and expectations.

Quality Objectives and Implementation Plans (Clause 6.2)

Set and document your organisation’s quality objectives. These objectives should align with your quality policy and your organisation’s broader strategic goals.

Objectives should be specific and measurable with clear plans for reaching them.

Plans should include:

• Who’s responsible for each objective
• Resources required
• Timeline for achievement
• How progress will be measured

1. Monitoring and Measuring Equipment Calibration Records (Clause 7.1.5.1)

ISO 9001 requires records demonstrating equipment calibration and maintenance. These records must be traceable to recognised measurement standards and retained as evidence of accuracy and reliability.

Where applicable, records should demonstrate that calibration is traceable to international or national measurement standards and include details of the approved laboratories used. Proper maintenance and calibration are vital for ensuring the accuracy and reliability of measurements.

View Assets Register Template.

2. Training and Competence Records (Clause 7.2)

Maintain records that demonstrate personnel are competent to perform work that affects the quality of products and services. This may include evidence such as formal qualifications, relevant experience, and training completed.

Where training is used to achieve competence, records should show what training was delivered and to whom. These records support the organisation’s ability to determine, maintain and evaluate competence in line with quality management responsibilities.

3. Product/Service Requirements Review Records (Clause 8.2.3)

Maintain records of the review of customer requirements to demonstrate your organisation’s ability to meet them, including changes and confirmation of acceptance.

It includes records showing you’ve thoroughly reviewed what customers are requesting, verified your ability to meet these requirements (considering your technical capabilities, capacity, and available resources), documented any customer-requested changes, confirmed compliance with applicable regulations, and noted any differences between initial quotes and final agreements.

These records essentially prove that you understand and can fulfil what you promise to deliver, protecting your organisation and your customers from misunderstandings or unmet expectations.

4. Design and Development Records (Clauses 8.3.3, 8.3.4, 8.3.5)

Document all inputs, controls, outputs and changes in the design and development process, including:

• Initial inputs and requirements (including materials, regulatory considerations)
• Control mechanisms ensuring desired results
• Reviews assessing outcomes against requirements
• Verification that outputs meet input requirements
• Validation that products/services meet application requirements
• Final outputs (drawings, process instructions, specifications)
• Any changes made during development with proper authorisation

This documentation supports the development of products and services that meet customer and regulatory expectations.

5. External Provider Evaluation Records (Clause 8.4.1)

Document how you evaluate, select, and monitor external providers. Include detailed criteria for assessment, results of evaluations, and evidence of ongoing performance monitoring.

This documentation demonstrates your control over externally provided processes, products, and services that impact your quality.

6. Product/Service Characteristic Records (Clause 8.5.1)

Document your product or service quality throughout the production process.

It should include comprehensive specifications detailing what your finished offerings should be like (including dimensions, performance metrics, and appearance), the environmental conditions required for consistent quality (such as temperature and cleanliness), evidence of ongoing monitoring during production, verification records showing completed products meet specifications, and include records of acceptance criteria and conformity to specified requirements.

These records provide the foundation for consistent quality delivery and prove that your organisation maintains control over critical quality characteristics.

7. Nonconformity and Corrective Action Records (Clause 10.2.2)

Recording any instances of nonconformity in your products or services is key to quality control.

You should include clear evidence of how conformance is achieved following corrective actions as nonconformity records help identify root causes and prevent recurrences.

These records should show:

• Nonconformity details
• The corrective actions taken
• Detail any special permissions obtained from customers
• Who was responsible for fixing the problem

You can record this information in different ways, such as forms, emails, purchase orders, customer feedback or tender requests. Use formats that best suit your organisation, ensuring the quality of your products or services is maintained.

8. Internal Audit Results (Clause 9.2.2)

An initial audit will help you identify areas needing attention.

Conducting regular internal audits to assess the effectiveness of your QMS and overall organisational performance should involve documenting the audit and its results.

As a result, you can then identify any nonconformities or opportunities for improvement.

Learn how to conduct effective audits with our online Internal Auditor Training Course for awareness of the standard requirements and general best practices (rather than a customised solution)

9. Management Review Results (Clause 9.3.3)

Senior management should also regularly review the QMS to ensure its performance and effectiveness. They should maintain records of these reviews, including minutes, policies, objectives, targets, audit results and progress towards meeting objectives and numeric targets.

Having these documents and processes in place supports readiness for ISO 9001 audits and provides evidence of a functioning QMS. A checklist can help organisations review documented information against ISO 9001 requirements.

Download our ISO 9001 checklist today.

You don’t need perfect documentation before beginning certification. A Stage 1 audit will evaluate your organisation’s readiness for certification and review documented information relevant to the management system. Preparing key documents in advance can streamline the process significantly. The more documentation you have ready, the smoother your certification journey can be.

Get started on your journey to ISO 9001 certification – get a quote today or contact our team to discuss your needs.