ISO 9001 consulting and certification

What ISO 9001 asks for and what the certificate attests

ISO 9001 specifies the requirements for a quality management system for an organisation that needs to demonstrate its ability to consistently provide products or services that meet customer and applicable statutory and regulatory requirements, and that aims to enhance customer satisfaction. That is the scope stated in clause 1 of the standard, which also makes two points useful to anyone wondering whether it fits them: the requirements are generic, and they apply to any organisation, regardless of type or size.

In practice the standard does not say how to make a product or deliver a service. It asks you to know what your processes are, who is accountable for them, how you measure whether they work and what happens when something goes wrong. The requirements sit in clauses 4 to 10: context of the organisation, leadership, planning, support, operation, performance evaluation, improvement.

The certificate is issued by an accredited certification body after a third-party audit. Under Regulation (EC) No 765/2008, each EU Member State appoints a single national accreditation body. Accreditation bodies also point out what the certificate does not say: Accredia, Italy's national body, notes that it does not guarantee the organisation's legal compliance, nor that a product or service conforms to a reference standard. It attests a management system.

The transition document from Global ACI, the international organisation of accreditation bodies, counts more than one million accredited ISO 9001 certificates worldwide, and notes that the standard is also adopted by sector schemes such as IATF 16949 for automotive and the AS/EN 91XX family for aerospace and defence. For a customer or a contracting authority, then, it is a common language: it says how you work without you having to explain it from scratch.

ISO 9001:2026: what changes for companies certifying now

The sixth edition of the standard was published in September 2026. The ISO foreword says the new edition cancels and replaces the 2015 edition, which has been technically revised, and incorporates the 2024 amendment. The main changes listed in the foreword and detailed by Global ACI:

• quality culture and ethical behaviour enter the requirements on leadership (5.1.1), environment for the operation of processes (7.1.4) and awareness (7.3);
• risks and opportunities are separated: 6.1 has three sub-clauses, with distinct actions to address risks and to address opportunities;
• planning of changes (6.3) also asks how the effectiveness of the change is monitored, how it is communicated and how its results are reviewed;
• management review (9.3.2) has inputs the review is required to include, among them changes in the needs and expectations of interested parties;
• clause 3 includes some management system terms, Annex A is revised with no additional requirements, and Annex B is removed.

Global ACI considers the overall changes minimal. The dates are set by its document Global ACI-TECH-3-TR of 4 September 2026, mandatory for signatory accreditation bodies and accredited certification bodies:

• 30 September 2027: by this date accreditation bodies complete their transition decisions on certification bodies. Before that decision, a certification body cannot issue accredited certificates on the 2026 edition.
• 31 March 2028: from this date new and initial certifications are issued only on the 2026 edition.
• 30 September 2029: accredited certifications on the 2015 edition are no longer valid.

What this means in practice. If you are starting from scratch today, we build the system on the 2026 requirements and check with the certification body when it will be able to certify on the new edition: an initial certificate on the 2015 edition is still possible until March 2028, but it will need moving to 2026 by September 2029, with a transition audit in between. If you already hold the certificate, the transition can be done within a surveillance or recertification audit or in a special audit, remotely too if the body shows that the audit objectives are met, and the body assesses whether additional audit days are needed. Each national accreditation body then issues its own operational instructions.

The two points that change day-to-day work the most are risk-based thinking, which the introduction to the 2026 edition now pairs with opportunity-based thinking, and the analysis of context, on which everything else depends.

How we work: the path, phase by phase

The phases are the same for every company; what changes is how much work each one involves. We describe them as we run them: a dedicated advisor who follows the project from the initial analysis to the audit, documents and evidence kept on Vanta, and the audit with an accredited body of your choice.

1. Initial analysis

We compare how you work today with the requirements of the standard, clause by clause: what exists and is used, what exists only on paper, what is missing. The result is a plan with actions in order of priority, who does them and what is delivered at the end of each phase. It is also when the scope is decided: the whole company, one site, one service line. The scope counts twice, because it sets the preparation work and the headcount on which the certification body calculates the audit days.

2. Context, interested parties and processes

The internal and external factors that affect results are written down, along with the interested parties and what they expect, and the process map with its interactions. On this basis management writes the quality policy and sets measurable objectives. This phase shapes all the others: a badly drawn scope or process map produces documents nobody uses.

3. Risks, opportunities and documents

With the 2026 edition, risks and opportunities have separate actions, so the register is built with two different logics. Then the documentation. The introduction to the standard says there is no need to align documents with the structure of its clauses: documents follow your processes, not the ISO table of contents. Only the procedures you genuinely need get written.

4. The system at work

A system is proved by its records: nonconformities opened and closed, corrective actions, complaints handled, indicators measured, suppliers assessed. Before the external audit the system needs to have produced real evidence, not forms filled in the week before. On Vanta every piece of evidence has an owner and a due date, and readiness can be read clause by clause. The thread that holds it all together is the PDCA cycle: plan, do, check, act.

5. Internal audit and management review

Before the certification body, the system checks itself: an internal audit on the processes in scope and a management review with the inputs that 9.3.2 makes mandatory. Your advisor runs a pre-audit on the evidence, then the findings are closed before the external audit. It is best if the internal audit is not run by whoever wrote the procedures being checked.

6. Certification audit: Stage 1 and Stage 2

The certification body's initial audit takes place in two stages, Stage 1 and Stage 2, and it is on this pair that TECH-3-004 calculates the initial audit time. As a rule, Stage 1 looks mainly at documents, scope and readiness; Stage 2 checks within the processes that the system is applied and effective. Then come the handling of any findings, the certification decision and the certificate. We prepare the evidence with you and support you in handling the findings; during the audit the company speaks, because the body assesses the organisation, not the consultant.

7. After the certificate

The certificate covers a three-year cycle, with annual surveillance audits and a recertification audit. According to TECH-3-004, in the first cycle the time spent each year on surveillance is about one third of the initial audit time. The goal of our work is a quality lead who can maintain the system without calling the consultant for every change, with evidence kept up to date during the year rather than rebuilt before each visit.

What the timeline depends on

There is no standard duration. The fixed part is the certification body's audit, in days calculated on public tables. The variable part is phases 1 to 5, and it depends on three things: how much of a system already exists, how broad the scope is, and how much time the key people give it. Keeping documents and evidence on a platform instead of shared folders and spreadsheets shortens the collection; it does not shorten the decisions that belong to management, and that is usually where the weeks are lost.

What we need from your company

The part no consultant can do for you is also the part that sets the timeline. Before starting, it helps to be clear about who brings what.

• A quality lead with real time. You don't need a full-time dedicated role; you need a person with hours set aside for the project and the authority to ask colleagues for data.
• Management inside the project. The standard devotes a whole clause to leadership, and with the 2026 edition management is also accountable for quality culture and ethical behaviour. In the audit the questions go to those who decide, not only to those who fill in the forms.
• The process owners. A few hours each to describe how they really work and to validate the procedures that concern them.
• The data that already exists. Complaints, returns, late deliveries, supplier problems, organisation chart, standard contracts. They become the system's indicators, instead of inventing new ones.
• Access to the tools. ERP, ticketing, shared folders: linking evidence to where it is created avoids copying it by hand.

What the cost of ISO 9001 certification depends on

We don't publish a price list, because the bill depends on variables you only see case by case. We can, however, say how it is made up. There are four items, paid to different parties: preparing the system (with a consultant or in-house), the certification body's audit, maintenance over the three-year cycle, and your people's time. The last one never arrives as an invoice, but it is often the largest.

The item with a written rule is the audit. The days are calculated by the certification body using Global ACI TECH-3-004 (ex IAF MD 5:2023), in application since 28 August 2026: it starts from the effective number of personnel in scope, is adjusted for risk and complexity, and the reduction from the table cannot exceed 30%. The certification body is required to give you the audit time calculation and its justification as part of the contract, and it is the right figure for comparing two offers.

• Pushing the cost up: more sites, more processes, in-house design, outsourced processes, highly regulated sectors, a starting point far from the standard.
• Bringing it down: a well-defined scope, an already mature system, evidence kept alive all year rather than rebuilt before each audit.

With low-cost certification offers, two checks are enough: that the audit days are justified against the table, and that the certification body is accredited for ISO 9001 and for your sector in the register of its national accreditation body. After an assessment we give you an estimate that keeps our support separate from the cost of the certification body.

ISO 9001 and public tenders

Many companies come to ISO 9001 because of a tender. In EU public procurement, Directive 2014/24/EU sets the rule in Article 62: when contracting authorities require certificates attesting that a supplier meets quality assurance standards, they refer to quality assurance systems based on the relevant European standards series and certified by accredited bodies, and they recognise equivalent certificates from bodies established in other Member States.

How much weight ISO 9001 carries is then decided by each tender: a participation requirement, an award criterion or neither. Three things to check in the tender documents before starting: that the scope of the certificate covers the activity being tendered, that the certification body is accredited, and the date. With the transition under way, a certificate on the 2015 edition is not valid beyond 30 September 2029, and for tenders in the coming years it pays to arrive already on the 2026 edition.

The mistakes we see most often

• The manual before the analysis. Documents ready before anyone has looked at the processes describe a generic company, and they are the first weak point in the audit.
• A scope chosen for the audit, not for the market. A narrow scope makes the audit lighter, then the next tender asks for precisely the activity left out.
• The system in the hands of one person. If only the consultant, or only the quality lead, knows how it works, the system stops at the first absence.
• An empty opportunities column. Opportunities were already in 6.1 of the 2015 edition; with 2026 they have a sub-clause and actions of their own, and a register with risks only is incomplete.
• Evidence rebuilt before surveillance. An auditor recognises records all written on the same afternoon.
• Starting on 2015 with no plan for 2026. You pay twice for the same work, a short time apart.
• A certification body chosen on price alone. Without checking accreditation for the standard and the sector, the certificate risks being rejected by the very customer who asked for it.

Consultant and certification body: two roles, two choices

The consultant helps you build the system and prepare for the audit; the accredited certificate is issued only by the certification body. The two roles are kept separate by rule: ISO/IEC 17021-1, the standard against which certification bodies are accredited, requires them to safeguard impartiality and to keep certification separate from management system consultancy. That is why we do not certify: we prepare you, help you read the offers, and you choose and contract the certification body yourself.

When choosing the consultant, what counts is experience with your type of process, a method stated before starting, named people who stay until the audit, documentation that stays yours, independence from the certification body and transfer of skills to your team. For the certification body, the non-negotiable filter is accreditation for the standard and for the sector.

Today there is one more question to ask both: which edition they are working on, and from when. The consultant should be able to tell you whether they are building the system on 2026; the certification body should be able to tell you from when it will issue accredited certificates on the new edition.

After ISO 9001: integrating other standards

ISO 9001:2026 applies the harmonised approach of the ISO/IEC Directives, the structure common to management system standards. That is why ISO 14001, ISO 45001 and ISO/IEC 27001 share context, leadership, risks, internal audit, management review and improvement with ISO 9001, and a well-designed system takes them on without redoing the work, up to an integrated audit.

It happens often with information security: ISO 9001 comes for a tender, and the next tender also asks for ISO/IEC 27001 or information security requirements. The work done on the quality system stays, and on Vanta the shared evidence is linked to both standards. The full path is on our ISO 27001 certification page.