Maintaining ISO 9001
Congratulations on your ISO 9001 certificate. Now the real work starts: making sure your system keeps working to the requirements of NEN-EN-ISO 9001:2015 . Your accredited certification body (CB) will check your system every year. Too many companies see ISO 9001 as a project that is finished once certified. That is a recipe for problems. Also keep an eye on the upcoming revision of ISO 9001. A new version of the standard gives you a transition period.
Most companies that lose their certificate do not fail an audit. They lose it because they let the system slip and miss their surveillance audits.
The three-year ISO 9001 certification cycle
Your certificate is valid for three years, but there are interim checks:
| Year | What happens |
|---|---|
| Year 0 | Certification audit (stage 1 and 2) |
| Year 1 | Surveillance audit 1 |
| Year 2 | Surveillance audit 2 |
| Year 3 | Recertification audit |
After year 3, the cycle starts again.
What must you do every year for ISO 9001?
To keep your certificate, you must do certain things every year. Here is a practical checklist:
Mandatory activities
| Activity | Frequency | Explanation |
|---|---|---|
| Internal audit | At least once a year | All parts of the QMS |
| Management review | At least once a year | Status of the system and opportunities for improvement |
| Update the risk analysis | Yearly and when things change | Identify new risks and opportunities |
| Review documents and procedures | Yearly | Check that they are current and followed |
| Staff awareness | Ongoing | Keep track of training and communication |
Plan the internal audit and management review at least 4 to 6 weeks before your surveillance audit. That way you have evidence that your system was recently reviewed.
Carry out an internal audit
You must audit all parts of your system at least once a year. You may spread this across the year.
When: At least 4 to 6 weeks before the external audit, so you have time to fix any findings.
Who: Someone who is independent of what is being audited. Internal or external.
Result: An audit report with findings and corrective actions.
Hold a management review
Top management must review the quality system at planned intervals. Often once a year, but it can also be twice a year.
When: Before the external audit, so you have recent results.
Who: Top management, possibly with the quality manager.
Result: Minutes with decisions and actions.
Evaluate quality objectives
Check whether you have met your objectives. Set new objectives for the coming year.
When: Often combined with the management review.
Result: An overview of performance, and new or revised objectives.
Close corrective actions
Resolve all open nonconformities and check that the actions are effective.
When: Ongoing, but make sure everything is closed before the external audit.
Undergo a surveillance audit
The certification body visits to check that you still meet the requirements.
When: Every year. The date is agreed with the CB.
Ongoing maintenance of your quality system
Alongside the yearly activities, there are things you must track all the time:
| Task | Frequency | Explanation |
|---|---|---|
| Record and handle complaints | Ongoing | Record every complaint, look for the cause, take action |
| Record nonconformities | Ongoing | Internal errors and nonconforming output |
| Measure customer satisfaction | At least once a year | Survey, reviews, collect feedback |
| Evaluate suppliers | Yearly | Assess and keep track of performance |
| Keep documents up to date | Ongoing | Replace outdated versions |
| Keep competence records up to date | When things change | New staff, new roles |
How do you keep your ISO 9001 system alive?
The biggest risk is that your system becomes a “paper tiger”. On paper everything is correct, but in practice nobody uses it.
Signs that things are going wrong
- Staff do not know where the procedures are
- The quality manual has not been updated for years
- Nonconformities are no longer recorded
- Top management has “no time” for the management review
- The same problems keep coming back
How to prevent this
1. Keep it simple
The more complex your system, the faster it decays. A simple checklist that everyone uses is better than a detailed document nobody reads.
2. Build it into daily work
Quality management should not be a separate activity. It should be part of how you work. Not: “Now we are going to do some quality work.” But: “This is how we do things here.”
3. Give someone responsibility
Someone needs to keep track of the big picture. This does not have to be a full-time quality manager, but someone must keep an eye on it.
4. Plan ahead
Put the key activities in the diary:
- Internal audit: which month?
- Management review: which date?
- Surveillance audit: when is it expected?
5. Use it to improve
The system is not there for the auditor, but for you. Use the data you collect to get genuinely better.
Preparing for the ISO 9001 surveillance audit
The surveillance audit is shorter than the certification audit (usually about half the time), but just as serious.
What the auditor checks
- Whether you still meet the standard
- What you have done with earlier findings
- Changes in your organisation
- Specific parts of the standard (not everything every year)
Preparation checklist
4 weeks before
4 weeks before the audit:
- Internal audit completed
- Management review held
- Open actions from the last audit checked
- Quality objectives evaluated
- Records complete and easy to find
What if you fail a surveillance audit?
It can happen. Perhaps something went structurally wrong, or an important part was not in order.
Major nonconformity during surveillance
For a major nonconformity, you usually have 90 days to fix it. The certification body can suspend your certificate until you have shown that the problem is solved.
What you need to do:
- Analyse the nonconformity thoroughly
- Find the cause
- Make an action plan
- Carry out the actions
- Provide evidence to the CB
- A limited re-audit may follow
Losing your certificate
You lose your certificate if you:
- Do not fix the nonconformities within the set deadline
- Do not allow the surveillance audits to take place
- Consistently fail to meet the standard
After losing it, you must go through the full certification process again.
Losing a certificate is rare. Most companies that run into trouble have plenty of opportunity to put things right.
The ISO 9001 recertification audit
After three years, your certificate expires and you must be certified again.
Difference from a surveillance audit
- Duration: Longer, comparable to the initial audit
- Scope: The whole system is assessed
- Depth: More thorough than surveillance
Benefits
- Your track record counts (positive if you have performed well)
- The auditor already knows your organisation
- Less start-up time needed
Timing
Plan the recertification audit well before your certificate expires. If there are nonconformities, you then have time to fix them.
What does ISO 9001 maintenance cost per year?
Expect these annual costs after certification:
| Cost item | Small company | SME | Larger |
|---|---|---|---|
| Surveillance audit | €800 to €1,200 | €1,200 to €2,000 | €2,000 to €3,500 |
| Internal audit (external) | €400 to €800 | €800 to €1,500 | €1,500 to €3,000 |
| Internal hours | 20 to 40 hours | 40 to 100 hours | 100+ hours |
After three years, the recertification audit is added. It is comparable to the initial audit.
Tips from experienced quality managers
”Do not keep it a secret”
Share results with the team. Show what is going well and what could be better. Transparency creates involvement.
”Use real data”
Measure what is relevant, not what is easy. If you want to improve customer satisfaction, measure customer satisfaction, not the number of surveys sent.
”Learn from nonconformities”
A nonconformity is not a failure. It is a chance to learn. The question is not “who did this?” but “how do we prevent this in future?"
"Involve top management”
If top management is not involved, staff feel it. Make sure management shows visible commitment, not only in words but in actions.
”Keep it current”
A system that is three years old does not fit an organisation that is changing. Update your documentation when processes change.
Frequently asked questions about ISO 9001 maintenance
How often must I carry out an internal audit?
The standard says “at planned intervals”, not how often. Most organisations audit every part at least once a year. You can spread it out: one part each quarter.
Can the same auditor come every year?
Yes, but certification bodies often rotate auditors after a few years. This prevents “organisational blindness”.
What if my organisation changes a lot?
Inform your certification body about major changes. They decide whether extra audit time is needed.
Can I switch certification body?
Yes, but it takes extra work. The new CB must assess your system again. Do not do this just before an audit.
More information
- Internal audit ISO 9001: annual planning, carrying out the audit and a checklist per chapter
- Management review ISO 9001: mandatory input and output, example agenda
- Nonconformities and corrective actions: how to record incidents and prevent recurrence
- The audit process: what can you expect during audits?
- Resources: checklists and templates
- Frequently asked questions: more answers