ISO 9001 — Quality Management

What does ISO 9001 actually require?

ISO 9001 does not tell you how to run your plant. It asks you to show that you understand your business, control the work that affects quality, and fix problems at their cause. The requirements below are cited from ISO 9001:2015, the edition many certified organizations are still audited against.

You start by defining your context, the needs of interested parties such as customers and regulators, and the scope of the system (clauses 4.1 to 4.3). Top management sets a quality policy and measurable objectives, and the organization identifies the risks and opportunities that could affect conformity (clause 6.1).

On the operational side, you control documented information (clause 7.5), make sure people are competent for the work they do (clause 7.2), keep measuring equipment calibrated and traceable (clause 7.1.5), and control externally provided processes, products and services (clause 8.4). Outputs that do not conform are identified and kept from unintended use (clause 8.7).

Finally, the system has to check itself. That means planned internal audits (clause 9.2), a management review in which leadership looks at the evidence and makes decisions (clause 9.3), and corrective action that removes the cause of a nonconformity so it does not recur (clause 10.2).

Who needs ISO 9001 certification in Canada?

No Canadian law requires ISO 9001 certification for most businesses. The pressure comes from customers, and it tends to arrive in a supplier questionnaire, a tender document or a purchase order. These are common situations where the request comes up.

How long does ISO 9001 certification take in Canada, and what drives the cost?

For a single-site plant with some existing controls, certification typically takes four to six months from gap analysis to the certification audit. A company starting with almost nothing written down, or one with several sites, should plan for longer.

The timeline is driven less by writing procedures than by generating evidence. The certification body wants to see the system running: records from production, at least one round of internal audits, a management review and corrective actions taken through to closure. The six-stage certification process shows how that work is sequenced.

Cost depends on a few factors you can estimate early. Headcount and the number of sites set how many audit days the certification body quotes. The scope matters, especially whether design is included. So does the state of your current controls, how much of the work your own team can carry, and which accredited certification body you choose.

Certification runs on a three-year cycle. A Stage 1 audit checks readiness and documentation, a Stage 2 audit checks implementation, surveillance audits follow at least once a year, and a recertification audit takes place before the certificate expires.

Common reasons ISO 9001 audits find nonconformities

A missing document is seldom the real problem. Findings often come from a gap between what the system says and what happens on the floor. These areas draw findings again and again.