The need for a continually improving ISO 9001 certification guide

Implementing ISO 9001 certification changes depending upon the size of the organization and the complexity of its products or services. And, like a competent quality management system, the certification process is subject to change and continuous improvement. Rather than becoming a static document, Conformance1 has created an interactive approach where this guide becomes more of a summary and is, in turn, linked to more expansive tools, information, and processes on the Conformance1.com website. In this way, we are taking your continual feedback on what is needed to streamline ISO 9001 certification and incorporate it.

ISO 9001 Defined

ISO 9001 is an international standard to govern and improve an organization’s quality management system (QMS). As a widely-used QMS, the ISO 9001 standard outlines several criteria for managing processes and policies to increase efficiency, reduce costs, boost customer satisfaction, gain new business leads, and more. ISO 9001-certified businesses and organizations can meet high standards and satisfy stakeholders’ expectations. These requirements center around customer focus, the ‘process approach’, and continual improvement – resulting in a more streamlined, less costly organization that can save time, increase revenue, and improve efficiency. ISO 9001 serves a wide range of organizations and industries, including those producing products and those providing services. 

The Value of ISO 9001 for Business Stakeholders

No quality management system guarantees good outcomes, but many organizations have reported positive results from ISO 9001 certification. The benefits include:

• Better quality: Though focused on process rather than product, a well-implemented quality management system like ISO 9001 can lead to more quality products since they are made according to specific standards. This quality demonstrates your value to customers, leading to greater client loyalty.
• Improved efficiency: ISO 9001 can help you identify inefficient procedures within your organization, leading to better products and fewer costs. A more streamlined operation prevents wasteful incidents and identifies future problems.
• Marketing: A robust quality management system is helpful for lead generation and future growth. Organizations that show their ISO 9001 certification can attract new clients and better opportunities with the promise of higher quality. 
• Customer requirements/satisfaction: ISO 9001-certified organizations assure clients with an internationally recognized and highly regarded management system, which requires continued approval and frequent assessment to remain active. ISO 9001 is often required for doing business with key customers.
• Employee empowerment: ISO 9001 can empower employees through its clear directives and specific procedures, allowing for better performance metrics. More motivated employees who meet more explicit expectations and standards improve your organization’s effectiveness.

While a traditional driver for gaining ISO-9001 certification lies in fulfilling customer requirements, when ISO 9001 is integrated with existing quality management systems, most organizations achieve an increased output with lower quality costs. As ISO 9001 requirements are flexible for many businesses and organizations, non-ISO 9001-certified organizations are likely already engaging in activities with procedures that meet quality management needs. The standard does not define quality or efficiency for any specific business but offers a process for continuously improving quality outputs. This approach’s value is applying the most tested and universally applicable quality management system approaches. This promotes uniformity and comparability across many different types of quality applications.

According to a 2021 Survey by ISO, six out of the top twenty sectors of organizations that are certified to the ISO 9001 quality standard are service-oriented, This 30 percent-sized segment is likely to grow as services dominate more maturing economies that are moving away from manufacturing as a critical economic driver. Typically, ISO 9001 represents the most significant number of certifications issued among all standards.

Once the requirements are implemented, an organization’s systems and performance become streamlined and efficient. Processes are more repeatable, and results are more predictable, which provides opportunities for great product and service delivery, creative employee contribution, and significant cost savings.

Being ISO-certified or compliant is a marketing advantage for many enterprises, giving them a competitive advantage over other companies vying for new business. The reputation of the ISO standards is well established and has clout. When prospects evaluate a company’s products or services, the ISO 9001 certification carries weight as many businesses require it for their vendors. The value of that designation can increase the bottom line substantially.

How ISO 9001 Is Applied in Business 

ISO 9001 can be implemented in any type or size of organization. Instead of using a rigid methodology that prescribes specific processes and procedures, ISO-compliant organizations apply the standards and methods according to their business requirements and objectives. They will define what the standards mean to their business model, build processes, identify risks, and document information accordingly.

The advantage of this quality management system is its adaptability to most entities. Because of its focus on universally accepted processes, small businesses find it as effective as mega-corporations. It can benefit non-profit or for-profit organizations as well as academic institutions. The standard is designed to be customized for a business or organization based on their respective needs and desired outcomes.

Companies may seek certification or opt for training and implementation of the standard if certification is not a requirement for their purposes. However, those who wish to maintain an active ISO 9001 certification must be audited yearly and go through the entire certification process every three years and when the standard changes. Therefore, an organization may already use the ISO 9001 standard but needs to update to the new criteria and/or rework the standard for a changing business environment.

Calculating ISO 9001 Certification Costs

The cost of ISO 9001 certification is influenced by various factors, many of which are within the organization’s control. For instance, the organization’s size and intricacy directly impact the overall cost. Limiting the certification scope can be an effective way to manage the size and subsequently control costs.

However, the content should always align with the business’s objectives. Factors such as other facilities and locations can increase the audit days required, thereby raising costs.

Initial Costs

Before a company can gain ISO 9001 certification, it must invest in several preparatory steps, often called initial, internal, or “soft costs.” These costs can vary greatly depending on the company’s size, the industry, and the current quality management practices in place. The following are some of the most common initial costs associated with ISO 9001 certification:

• Implementing ISO 9001 as a Quality Management System (QMS)
• Training
• Internal audits
• Documentation

A critical effort is preparing and implementing the ISO 9001 Quality Management System (QMS). This often involves developing or refining processes and procedures to align with ISO 9001 standards, which might require hiring external consultants or dedicating internal resources. This effort will depend upon the type and extent of any existing quality systems and approaches and the capacity to which these can be applied to the standard’s requirements.

Training is often a less obvious but potentially sizeable initial expense – depending upon the organization’s size, current quality management skill level, and involvement. Employees at various levels, from executives to frontline staff, may need to be trained on the ISO 9001 standards and the changes that will be necessary for the organization to meet them. This could involve hiring external trainers, paying for online courses, or setting up an internal training team. Likewise, there will be time costs associated with training, as employees will be spending working hours in training sessions.

Internal audits are a crucial part of the preparation process, identifying gaps in the organization’s current practices compared to ISO 9001 requirements. Performing these audits requires time and potentially the hiring of an external auditor or training of an internal one.

Lastly, documentation is a significant part of ISO 9001 compliance, as the standard requires the organization to keep some records of its quality management processes. The cost of developing and managing this documentation can include the labor hours spent on this task and potential software or system upgrades to collect this information effectively.

Despite these initial costs, achieving ISO 9001 certification can provide significant value to an organization, including increased efficiency, higher quality products or services, and improved customer satisfaction, leading to a strong return on investment over time.

Certification Costs

The actual cost of obtaining ISO 9001 certification involves several components, with the main expenses associated with the engagement of a third-party certification body to conduct the certification audit and award the certificate. Certification costs include:

• Certification audit
• 9001 certificate fee
• Annual surveillance audits

The certification journey starts with a ‘Stage 1’ or readiness audit. The Registrar reviews your management system to ensure all of the ISO 9001 requirements have been met.

The certification audit or ‘Stage 2’ audit is a comprehensive assessment by a third-party Registrar to verify that the company has fully implemented its system  – are you doing what your system requires? The cost of this audit can vary significantly based on the size of the company, the complexity of its operations, the number of locations, and the rates of the selected certification body. These costs usually include a combination of the certification body’s day rates, which cover the auditor’s time, and any travel or accommodation expenses if the audit is conducted on-site. (See accompanying sidebar titled, “How an ISO 9001 Registrar Determines its Auditing Costs.”)

In addition to the audit, the certification body typically charges a fee for issuing the ISO 9001 certificate. There may also be additional costs for any pre-certification assessments that the certification body may recommend to ensure your organization is ready for the certification audit.

ISO 9001 certification is not a one-time cost. Maintaining certification requires regular surveillance audits, usually annually or biannually, to ensure ongoing compliance with the standard. These surveillance audits represent a continuing cost to the business. However, they can be viewed as an investment, as they help to ensure the continued effectiveness and improvement of the QMS, leading to better business performance overall.

Therefore, when budgeting for ISO 9001 certification, companies should consider the upfront costs and these ongoing costs to maintain the certification. 

How an ISO 9001 Registrar Determines its Auditing Costs

he actual amount of time a certification body/registrar is allowed to charge for is determined by a group called the International Accreditation Forum (IAF), which sets the number of “audit days” a registrar is required to spend for Stage 1 and Stage 1 certification audits. This is determined by the number of employees an organization has. While this can vary based upon the definition of “Effective Number of Personnel,” which can include or exclude workers based upon various conditions, the registration auditing cost is effectively determined by multiplying their daily rate times the number of audit days, plus expenses. You can see the IAF document that governs this here. Registrars can also add on other fees such as for annual management, applications, additional certificates issued for multiple locations, auditing of additional locations and other services and variations. 

Comparing ISO 9001 Certification Approach Costs

The method chosen to enact ISO 9001 dramatically determines the overall cost. The main choices are “Do it Yourself,” using outside help like a consultant or some combination of both. Either way, it’s a good idea to start with Conformance1’s Certification Cost Calculator: Our calculator incorporates feedback from ISO consulting and training experts. While individual costs inevitably vary across providers, this tool can give you an idea of the cumulative cost of different ISO services.

Use of Templates and Educational or Training Programs: The organization utilizes document templates and educational or training systems to structure its quality management system and train its staff. While still a solo approach, this approach offers support and can save significant time and resources.

Hiring an ISO consultant: This option is the most expensive but could be ideal for organizations short on personnel. Consultants can manage the whole process, but costs can range significantly. The consultant can calculate the total cost for ISO 9001 certification. (Consult our Management Systems Resources directory for  listings with descriptions of hundreds of consultants we’ve compiled. It’s a great way to save time and have the ability to directly contact a group of them to review in one place.)

Carefully considering the value of the different methods for the organization’s specific needs and resources is essential to lowering costs. Understanding these options can dramatically reduce the cost of ISO 9001 certification while still providing a solid foundation for a quality management system and the subsequent benefits of ISO 9001 certification.

ISO 9001 Pre-Audit Gap Analysis

The initial stage in an ISO 9001 pre-audit gap analysis is the comprehensive understanding of the requirements. Understanding each clause in the business context helps establish the connection between the standard’s expectations and the organization’s practices. 

Conformance1 has developed the ISO 9001 Gap Checklist to streamline the pre-audit process. It includes a comprehensive and user-friendly interface allowing businesses to go through the 9001 standards and answer questions about where their systems align with the requirements and where adjustments might be needed.

With the Gap Checklist, organizations can systematically evaluate their systems and processes by guiding them through each clause of the ISO 9001 standard, providing an easy way to note compliance and compile the information in a final report. Users can share all or parts of the ongoing report via e-mail and assign tasks to specific employees.

Step-By-Step Implementation

Organizations may already have processes that can meet ISO 9001 requirements. Analyzing the organization’s current procedures will help identify which resources, processes, and systems count toward certification rather than re-creating these items to meet the standard.

Use the Business’s Existing Processes to Start

The above flowchart shows the standard’s main sections, each representing an essential element of the Quality Management System. The image is divided into two distinct layers: the upper layer represents the Plan-Do-Check-Act (PDCA) cycle, which is integral to ISO 9001, and the lower layer shows how this cycle is applied to various aspects of the organization.

The following processes can be found in many businesses and can be used toward 9001 certification. Organizations should thoroughly examine each level of their operations for these quality management procedures:

• Real-time data reporting: Real-time quality data is essential in a quality management system so that organizations can make evidence-based decisions. If your organization already measures employee or supplier performance, customer service, cost, failure rate, error frequency, or others, these metrics can assist you in ISO 9001 certification.
• Layered process auditing: These audits guarantee that your standard processes are followed according to documented standards.
• Risk management tools: Many organizations use at least one tool, such as decision trees, risk matrices, or failure modes and effects analysis (FMEA). 
• Process mining: A feature of data science, process mining uses data to determine how well specific processes at your organization are performing.
• Work instructions: Many organizations have training manuals and employee expectation guidelines to help them achieve ISO 9001 certification. Often some approaches employ continuous improvement with employee input and more accessible capture methods like video.
• Stakeholder needs assessments: Stakeholder assessment identifies who exactly stakeholders are and what needs, interests, or influence they have in your organization. The reviews help ensure you effectively communicate and meet stakeholders’ needs.
• Cost of quality estimates: Measuring the cost of quality, even poor quality, looks at how internal or external factors can cost your organization. Examples include repair costs, waste from poorly designed procedures, improper maintenance, customer returns or dissatisfaction, proper employee training, and shortages.

Outline of the 9001 Standard

Register for the Free Gap Checklist with its Full Step-By-Step Plan

Clause 4

This section mandates organizations to understand their context, the needs, and expectations of interested parties and define the scope of their Quality Management System (QMS).

• Organizations must identify internal and external issues relevant to their purpose and strategic direction that affect their QMS outcomes.
• Organizations need to understand the needs and expectations of relevant interested parties (like customers, suppliers, and regulators).
• Companies must outline the QMS’s scope by considering the identified external and internal issues, relevant parties’ requirements, and the organization’s products and services.
• Organizations must establish, implement, maintain, and continually improve a QMS, considering their process needs and interactions.

Clause 5

This clause revolves around leadership. It asserts the importance of commitment and proactive involvement from top management to ensure the Quality Management System’s (QMS) effectiveness.

• Top management must show responsibility for the QMS’s effectiveness and support integrating QMS requirements into the organization’s business processes.
• Top management should establish a quality policy appropriate to the organization’s purpose and context, providing a framework for setting quality objectives.
• Leadership should ensure that responsibilities and authorities for relevant roles are assigned, communicated, and understood within the organization.

Clause 6

This clause emphasizes planning. It calls for organizations to identify risks and opportunities, establish and plan to achieve quality objectives, and plan changes to the quality management system.

• When planning for the QMS, the organization must consider the issues and requirements identified in Clause 4 and determine the risks and opportunities to ensure the QMS achieves its intended results.
• The organization should establish quality objectives at relevant functions, levels, and processes needed for the QMS.
• When the organization determines the need for changes to the QMS, the changes should be carried out in a planned manner.

Clause 7

This section refers to support and details the requirements for providing adequate resources, competence, awareness, communication, and documented information to establish, implement, maintain, and continually improve the quality management system (QMS).

• The organization must determine and provide the necessary resources for establishing, implementing, maintaining, and improving the QMS.
• The organization must determine the necessary competence for individuals performing work under its control and ensure they are competent.
• The organization must ensure that individuals performing work under its control know the quality policy, relevant quality objectives, their contribution to the QMS, and the implications of non-conformance to the QMS requirements.
• The organization should determine what, when, with whom, how, and who will communicate internal and external information relevant to the QMS.
• The QMS must include information required by the ISO standard and information the organization deems necessary for the system’s effectiveness.

Clause 8

This section defines the various procedures and practices related to an organization’s operations to ensure it meets its QMS requirements.

• Organizations need to plan, implement, and control the processes needed to meet the requirements for providing products and services and show verifiable evidence that they have done this.
• Organizations must determine customer requirements for the products or services they provide.
• Organizations should follow specific steps during their products or services’ design and development phase.
• Organizations must ensure that externally provided processes, products, and services meet specified requirements.
• Organizations should follow guidelines for controlling production and service provision under controlled conditions.
• Nonconforming outputs, whether found before or after delivery, should be identified and controlled to prevent unintended use or delivery.

Clause 9

This section covers the performance evaluation aspect of an organization’s Quality Management System (QMS).

• Organizations must identify what should be monitored and measured and develop valid methods for these activities.
• Internal audits should be carried out at planned intervals to assess whether the QMS meets the organization’s requirements and those of ISO 9001.
• Top management should periodically review the organization’s QMS.

Clause 10

This section speaks to continuous improvement within an organization’s Quality Management System (QMS).

• Organizations should identify and implement opportunities for improvement to meet customer requirements and enhance their satisfaction.
• If a nonconformity occurs, including any complaints, the organization must react by controlling and correcting it, dealing with the consequences, and evaluating the need for action to eliminate its causes.
• The organization should continuously strive to improve the suitability, adequacy, and effectiveness of its QMS.

Managing Initial and Ongoing ISO 9001 Certification

Consider the benefits of utilizing quality management software such as SimplifyISO for the ISO 9001 certification process.

With SimplifyISO, a cloud-based ISO Management System software offering unparalleled configuration compatibility, organizations are offered a strategic and simplified path toward achieving and maintaining ISO 9001 standards:

• Transfer the best parts of the QMS system onto a secure, cloud-based platform. This digital transformation allows for increased accessibility and seamless management of the QMS.
• Identify and eliminate parts of the system that aren’t adding value to the organization’s workflow.
• Simplify document control, ensure timely closeout of non-conformances (NCs), and reduce audit-related stress.
• Utilize the time saved to improve the QMS, enhance business processes, and boost profit.

Going Beyond ISO 9001 Certification

Staying up-to-date with the dynamic landscape of ISO 9001 is essential. The expertise and resources offered by the International Management System Institute (IMSI) can help.

Quality and safety leadership is changing, with trends leaning towards stakeholder capitalism and new demands from the International Organization for Standardization (ISO). ISO standards now prioritize management systems, expanded stakeholder constituencies, and a shared structure. 

These changes underscore the growing need for professionals who can seamlessly merge quality, safety, environmental, information security, supply chain, and other functions with the strategic direction of an organization.

IMSI’s Certified ISO Management System Professional (MSP) program aims to elevate the value, skill level, and expertise of the quality/safety manager, transforming them into certified quality experts. The curriculum covers core areas such as ISO 9001:2015 standard alignment, ISO auditing, and risk management. This broad spectrum of knowledge can be applied across various standards and industries.

The following IMSI courses allow professionals to interact with decision-makers across their organization, thus raising the Management System’s value:

• ISO 9001 Basics Course
• Sustainability Success
• Customer Satisfaction
• Risk Management
• Psychosocial Health and Safety At Work
• Innovation Management
• Business Continuity