Login Introduction
Looking to understand what ISO 9001 really asks of you? You’re in the right place.
ISO 9001:2015 is the international standard for building a quality management system (QMS) that helps your business deliver consistent quality, meet customer expectations, and drive continuous improvement. It’s designed to suit organisations of every size and sector — helping you sharpen internal processes and strengthen trust in your products or services, whether you’re serving local clients or competing for national contracts.
Rather than prescribing exactly how your business should operate, ISO 9001 focuses on what you need to achieve — like delivering on customer requirements, and showing clear, consistent evidence of how you do it. The Standard is built around seven quality management principles and ten clauses (with Clauses 4–10 outlining the key requirements). Together, they create a structured framework for long-term success.
In the UK, more than 30,000 organisations hold ISO 9001 certification, using it to win tenders, streamline operations, and demonstrate compliance with laws like the Consumer Rights Act 2015 and Trading Standards expectations.
ISO 9001 requirements at a glance
- Standard: ISO 9001:2015
- Core structure: Clauses 1–3 (introductory), 4–10 (mandatory requirements)
- Key themes: Context, leadership, planning, support, operation, performance evaluation, and improvement
- Documentation: Quality policy, objectives, risk assessments, audit records, corrective actions
- UK relevance: Supports compliance with Consumer Rights Act; often required for tenders
- Upcoming update: 2026 revision to include sustainability and climate resilience requirements
What are the ISO 9001 requirements?
ISO 9001 sets out a framework for running your business in a way that ensures quality, consistency, and continual improvement — built around the Plan–Do–Check–Act (PDCA) cycle.
The Standard is made up of 10 clauses. Clauses 1–3 introduce the scope, terminology, and references; Clauses 4–10 outline the actual requirements your organisation must meet to achieve and maintain certification.
At a glance:
- Clauses 1–3: Provide context — defining what the Standard covers and the terms it uses.
- Clause 4: Sets the context of your organisation.
- Clause 5: Defines leadership and accountability.
- Clause 6: Focuses on planning and risk-based thinking.
- Clause 7: Covers support — from resources to training.
- Clause 8: Details operational control and supplier management.
- Clause 9: Explains performance evaluation and audits.
- Clause 10: Drives continual improvement.
Together, they follow the PDCA cycle:
- Plan: Understand context, set objectives, and plan for risks.
- Do: Deliver your services under controlled, consistent conditions.
- Check: Monitor, measure, and audit performance.
- Act: Review results and drive continual improvement.
This risk-based approach was introduced in the 2015 revision, helping organisations identify potential issues before they affect quality or customer satisfaction.
You’ll find a detailed clause-by-clause breakdown further down this page — including practical checklists and UK-specific examples to help you apply each requirement in your business.
The 7 principles of ISO 9001
- Customer focus – Meeting customer needs and enhancing satisfaction.
Example: Map your complaint process to Consumer Rights Act expectations. - Leadership – Setting clear direction and alignment across your business.
Example: Directors review quality objectives during management meetings. - Engagement of people – Involving and empowering employees at every level.
Example: Include quality training in staff inductions. - Process approach – Managing activities as linked processes, not isolated tasks.
Example: Visualise sales-to-delivery workflows to reduce handover errors. - Improvement – Continually enhancing performance through data and feedback.
Example: Use customer feedback to refine processes and service quality. - Evidence-based decision making – Relying on facts and data, not assumptions.
Example: Monitor KPIs such as on-time delivery and customer satisfaction. - Relationship management – Building strong supplier and partner relationships.
Example: Maintain approved supplier lists and review performance regularly.
ISO 9001 requirements by clause
Clause 4 – Context of the organisation
This clause is about understanding your business environment and the factors that could impact how you deliver quality. You’ll look at both internal factors (like staffing, resources, or culture) and external ones (such as market conditions, regulations, or supply chain risks). You’ll also determine who your interested parties are (customers, regulators, suppliers, employees, shareholders, etc.) and understand what they expect from your organisation.
Checklist:
- SWOT or PESTLE analysis covering internal/external issues
- List of interested parties and their needs/expectations
- A defined scope for your QMS, outlining what parts of your business are covered and why.
- Process map showing how core activities link together
UK tip: If your business operates in sectors affected by post-Brexit changes (like importing goods or managing overseas suppliers), include this context — it shows awareness of external risks that could affect quality or continuity.
Clause 6 – Planning
Clause 6 introduces risk-based thinking — one of the key updates in ISO 9001:2015. It’s about identifying the things that could stop you from meeting customer expectations and planning how to prevent them. You’ll also set measurable quality objectives and plan any changes in a controlled way.
Checklist:
- A risk and opportunity register showing how risks are identified, rated, and managed.
- Quality objectives that are measurable, achievable, and linked to your policy.
- Evidence of planning to achieve those objectives (who’s responsible, by when, how measured).
- A process for managing planned changes (e.g. new systems, processes, or suppliers).
UK tip: Risks might include Brexit-related supply chain disruptions, rising material costs, or changes in UK legislation (like product safety or consumer protection). Including these examples in your risk register shows you understand your operating environment.
Note: While ISO 9001 doesn’t specifically cover Health & Safety (that’s ISO 45001), it does require you to identify risks that could affect quality — including safety-related risks in your operations.
Clause 8 – Operation
This is where you show how you deliver your product or service. Clause 8 covers everything from customer communication to design, purchasing, production, and managing nonconformities. It’s the part of ISO 9001 that deals with your day-to-day operations.
Checklist:
- Contract or order review records to confirm customer requirements before work starts.
- Design and development process (if applicable) showing planning, review, verification, and validation.
- Approved supplier list and evaluation records to show control of purchasing and external providers.
- Production or service records — evidence that work was done to agreed standards.
- Nonconformity and corrective action records where things didn’t go to plan.
Tip:
- If you import materials or products, ensure your purchasing requirements include UKCA or CE marking compliance and checks on product safety documentation.
- For service-based businesses, focus on how you control contractors or outsourced work to maintain quality consistency.
Clause 10 – Improvement
The final clause closes the PDCA loop. It’s where you demonstrate that you don’t just fix problems — you learn from them and make your system stronger.
Checklist:
- A corrective action process that finds the root cause and prevents recurrence.
- An improvement log tracking ideas, suggestions, and results.
- Evidence that improvements have a measurable impact (e.g. reduced defects, fewer complaints).
UK tip: Many UK organisations link improvement goals to tender feedback or customer satisfaction scores — it’s a great way to show continual improvement in action.
Clause 5 – Leadership
Clause 5 focuses on management’s role in driving quality. ISO 9001 expects visible leadership commitment — not just a policy on paper. Senior leaders are responsible for setting direction, communicating expectations, and making sure people have what they need to deliver.
Checklist:
- A quality policy that reflects your business goals and commitment to continual improvement.
- Clearly defined roles and responsibilities for quality.
- Regular management reviews where leadership discusses performance, risks, and improvement opportunities.
- Leadership involvement in promoting a culture of quality.
Tip: Leadership involvement is a core audit focus. Including objectives here strengthens the link to planning (Clause 6).
Clause 7 – Support
Clause 7 is all about providing the resources, training, and information your team needs to make the QMS work. It covers people, infrastructure, competence, awareness, communication, and control of documents and records.
Checklist:
- A competence and training matrix that shows people are qualified for their roles.
- A document control system that tracks versioning, approvals, and updates.
- Adequate facilities, tools, resources, and infrastructure for quality delivery
- Evidence that your team is aware of the quality policy, objectives, and their contribution to them
Tip: Keep training simple but focused. For example, integrate GDPR or data handling training if staff deal with customer data as part of quality processes.
Clause 9 – Performance evaluation
Clause 9 is about checking whether your system is working as intended. You’ll monitor, measure, and analyse performance, gather feedback, and conduct internal audits and management reviews.
Checklist:
- KPIs or metrics for quality performance (on-time delivery, customer complaints, returns).
- Customer feedback records and actions taken as a result.
- Internal audit reports and evidence that findings are followed up.
- Management review minutes showing leadership decisions and improvement actions.
Tip: Show your internal audits are objective, planned, and based on risk and performance.
Together, Clauses 4 to 10 make up the backbone of your QMS — from understanding your business and planning for risk to delivering consistent quality and improving every time.
When implemented properly, they don’t add bureaucracy — they clarify who does what, how you measure success, and how you keep getting better.
ISO 9001 documentation and records requirements
Your documentation is the backbone of your quality management system. It provides evidence that your processes are working and that you’re meeting the ISO 9001 requirements.
ISO 9001 doesn’t require piles of paperwork — but it does expect you to control the information that affects quality. That means keeping the right documents, in the right format, and making sure they’re up to date and accessible when needed.
In simple terms:
If it shows how you do something or proves that you’ve done it — it’s probably a controlled document or record.
Mandatory documents and records
These are the core items you’ll need to demonstrate compliance with Clauses 4–10 of the Standard.
| Document/record | Clause reference | Examples of evidence |
|---|---|---|
| QMS scope | 4.3 | Description of business activities covered by certification and any justified exclusions (e.g. design) |
| Quality policy | 5.2 | Approved and communicated policy, visible to staff and stakeholders |
| Quality objectives and plans | 6.2 | SMART objectives linked to business strategy, with progress tracked |
| Competence records | 7.2 | Training matrix, qualification certificates, skills assessments |
| Operational records | 8 | Job sheets, production/service logs, supplier evaluations, order reviews |
| Monitoring and measurement results | 9.1 | KPI dashboards, customer satisfaction surveys, complaint logs |
| Internal audit programme and reports | 9.2 | Audit schedule, findings, and corrective actions |
| Management review outputs | 9.3 | Review minutes, improvement actions, resource decisions |
| Improvement and corrective actions | 10.2-10.3 | Root cause analyses, completed corrective actions, improvement logs |
Recommended documents
While ISO 9001 doesn’t explicitly list these as mandatory, most certification bodies expect to see them during audits because they demonstrate a well-controlled, mature QMS. Plus, having them in place can make audits smoother and your system easier to manage — especially for growing organisations.
| Document / record | Purpose and benefit |
|---|---|
| Risk and opportunity register | Shows how you identify and manage risks (Clause 6). Auditors expect this even though it’s not formally required. |
| Document control procedure | Demonstrates how documents are approved, updated, and distributed — essential for consistency. |
| Supplier evaluation procedure | Proves you control and monitor suppliers in line with Clause 8.4 requirements. |
| Process flow diagrams or maps | Helps show how your business operates — makes audits faster and more transparent. |
| Training and competence procedure | Provides structure for staff development and competence tracking (supports Clause 7). |
| Statement of non-applicable clauses | Clarifies justified exclusions — prevents confusion during audits. (E.g. “Design and development not applicable to our operations”). |
| GDPR and data handling records | Shows compliance where personal data forms part of your quality processes (especially relevant for UK service businesses). |
UK tip: Keep your documentation practical. Certification bodies look for clear control, not piles of paper.
For many UK SMEs, a combination of well-structured folders, spreadsheets, and cloud-based forms is perfectly fine — as long as you can show documents are version-controlled, authorised, and retrievable.
Certification auditors rarely draw a hard line between “mandatory” and “expected.” They’ll simply ask, “Show me how you manage this.”
If you can point to a document, record, or system that demonstrates control, you’ll satisfy the requirement. So while some items aren’t named in the Standard, having them documented shows strong governance, saves audit time, and proves your system is working effectively.
In summary, think of your documentation as your evidence trail.
It should:
- Explain how you operate,
- Show who is responsible, and
- Prove what happened and when.
If you can demonstrate those three things, your QMS will be both compliant and credible — without unnecessary admin.
ISO 9001 requirements checklist
If you’re preparing for ISO 9001 certification, this checklist is a simple way to check how ready your business is to meet the key requirements.
It follows the Plan–Do–Check–Act (PDCA) model — the continuous improvement cycle that underpins ISO 9001. Use it as a self-assessment tool before your internal or external audit.
Plan
- Understand your business context (Clause 4)
Identify internal and external factors that could affect your ability to deliver quality (e.g. staffing, regulations, customer expectations) - Define your stakeholders and requirements (Clause 4.2)
Document the needs of customers, regulators, suppliers, and other interested parties. - Set measurable quality objectives (Clause 6.2)
Align objectives with your business strategy — for example, reducing complaints or improving delivery performance. - Identify risks and opportunities (Clause 6.1)
Maintain a risk and opportunity register showing how you manage key risks.
UK tip: Consider risks such as Brexit-related supply chain disruptions, regulatory changes, or resource shortages.
Do
- Provide training and maintain competence records (Clause 7.2)
Make sure everyone knows their role in achieving quality goals — keep records of training, qualifications, and refresher sessions. - Control purchasing and suppliers (Clause 8.4)
Keep an approved supplier list and evaluate supplier performance regularly.
UK tip: If you import goods or components, ensure they meet UKCA or CE marking requirements and that supplier documentation is complete. - Plan and manage operations (Clauses 8.1–8.7)
Define how customer orders or projects are handled — from enquiry and order review through to delivery and aftercare. Keep records of contract reviews, production/service delivery, inspections, and any rework or corrective action.
Check
- Monitor performance and customer satisfaction (Clause 9.1)
Track KPIs such as on-time delivery, returns, or complaint trends. Collect and act on customer feedback. - Conduct internal audits and management reviews (Clauses 9.2–9.3)
Plan and record audits across all core processes, and hold management reviews that address results, risks, and improvements.
Tip: Auditors like to see that internal audit findings are discussed in management reviews — it demonstrates active leadership involvement.
Act
- Address issues and drive continual improvement (Clauses 10.2–10.3)
Record nonconformities, complete corrective actions, and track improvement ideas through to completion.
Look for trends in performance data — are complaint levels reducing? Are delivery times improving? Evidence like this shows your QMS is genuinely working.
This checklist isn’t just for certification prep — it’s a practical way to keep your QMS on track all year round.
If you can tick most of these steps confidently (and provide evidence where needed), you’re already well on your way to meeting the ISO 9001 requirements and achieving certification with minimal stress.
Benefits of meeting ISO 9001 requirements
Meeting the ISO 9001 requirements does far more than tick a compliance box.
It helps you build a culture of quality and a stronger, more reliable business. You’ll gain efficiency, improve customer satisfaction, and reduce risks across your operations — all while demonstrating the credibility that helps you win new work.
Key benefits for your business
- Win more tenders and contracts
Many public sector and large private clients now require ISO 9001 certification for supplier approval.
Being certified shows you take quality seriously — helping you meet pre-qualification requirements and stand out in competitive bids.
Used by over 30,000 UK organisations, it’s often a requirement for NHS, MOD, and local authority suppliers. - Improve customer satisfaction and reduce complaints
By focusing on consistent processes, training, and communication, you’ll reduce errors and increase reliability.
Satisfied customers are more likely to return — and to recommend you. - Increase efficiency and reduce waste
ISO 9001 helps you streamline your operations by identifying bottlenecks and duplications.
With clearly defined roles and processes, you’ll spend less time fixing problems and more time improving performance. 89% of Citation ISO Certification clients say their business is more efficient as a result of achieving ISO 9001 certification. - Reduce risk and strengthen compliance
The Standard’s risk-based approach means you’re identifying and managing issues before they become problems.
This includes product, legal, regulatory, and even reputational risks — protecting your business from avoidable costs or disputes.
UK example: Linking your risk management to laws like the Consumer Rights Act 2015 or Trading Standards expectations strengthens both compliance and trust. - Build trust and credibility
Independent certification from a recognised accredited certification body provides reassurance to customers, partners, and regulators that your QMS meets international standards.
It’s proof that your business can consistently deliver what it promises — a powerful message in any supply chain. - Create a culture of continual improvement
ISO 9001 turns improvement into part of everyday business, not a one-off project.
You’ll use real data to make better decisions, engage staff in problem-solving, and embed accountability across the organisation
When you meet the ISO 9001 requirements, you’re not just achieving certification — you’re strengthening your business from the inside out.
You’ll deliver better quality, reduce risks, and gain the recognition that comes from being certified by a trusted provider like Citation ISO Certification.
Ready to take the next step?
[Book your free consultation] to find out how ISO 9001 can help your business work smarter and win more work.
Common Questions
About ISO 9001
ISO 9001:2015 is structured into 10 clauses. Clauses 1–3 are introductory, and Clauses 4–10 contain the actual requirements.
They are:
- Scope
- Normative references
- Terms and definitions
- Context of the organisation
- Leadership
- Planning
- Support
- Operation
- Performance evaluation
- Improvement
Clauses 4–10 are what your certification audit will focus on.
The seven quality management principles are:
- Customer focus
- Leadership
- Engagement of people
- Process approach
- Improvement
- Evidence-based decision making
- Relationship management
These principles guide the requirements in the Standard and form the foundation for continual improvement.
ISO 9001 doesn’t specify a fixed number of documents, but auditors typically expect to see at least six key ones:
- QMS scope
- Quality policy
- Quality objectives
- Competence and training records
- Operational process control records
- Internal audit and management review records
You may also keep supporting evidence like risk registers or supplier evaluations — these make audits smoother and demonstrate control.
The 2015 version introduced risk-based thinking, a focus on leadership, and greater emphasis on process management rather than strict procedures.
It also uses the Annex SL structure, aligning it with other ISO Standards like ISO 14001 and ISO 45001 for easier integration.
To achieve certification, you need to:
- Implement a Quality Management System that meets Clauses 4–10 of ISO 9001:2015.
- Complete internal audits and a management review.
- Undergo an independent certification audit by an accredited body.
Most UK SMEs complete this within three to six months with structured guidance.
The checklist summarises the key actions you’ll need to take to comply with the Standard — from understanding your business context and risks, through to audits and continual improvement.
It’s a practical tool to track progress and confirm you have evidence for each clause before your certification audit.
Costs depend on your business size, number of sites, and complexity.
Citation ISO Certification offers transparent pricing and tailored packages — typically far more cost-effective for SMEs than large providers.
ISO 9001 isn’t a legal requirement, but it’s often required by clients or tender frameworks to prove quality assurance.
It’s widely recognised as the benchmark for consistent, customer-focused quality management.
ISO 9001 focuses on quality management, ensuring your products and services consistently meet requirements.
ISO 45001 focuses on Health & Safety management, helping prevent workplace incidents and improve wellbeing.
Both Standards follow the same high-level structure (Annex SL) and integrate easily.
Your ISO 9001 certificate is valid for three years, with annual surveillance audits to check continued compliance.
After three years, you’ll complete a recertification audit to renew your certificate.