ISO 9001 step-by-step guide
From zero to an ISO 9001 certificate. This step-by-step guide takes you through the whole process. The standard is available in the Netherlands from NEN (Netherlands Standardization Institute) , and certification takes place through an accredited body accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council).
Lead time varies from company to company. A small company with clear processes can be ready in 2-3 months. A larger company with complex processes often needs 6-8 months.
The 10 steps to ISO 9001 certification
The process from zero to certificate consists of 10 steps. The table below gives you the overview, from orientation to receiving your certificate. We explain each step below.
| Step | What do you do? |
|---|---|
| 1. Orientation | Decide whether ISO 9001 suits you, management commitment |
| 2. Gap analysis | Map what you already have and what is missing |
| 3. Define the scope | Set out which activities and locations will be certified |
| 4. Document processes | Describe and record how you work |
| 5. Implement | Apply the system in practice and collect evidence |
| 6. Internal audit | Check your own system for shortcomings |
| 7. Management review | Management reviews the system and makes decisions |
| 8. Choose a certification body | Request quotes from certification bodies |
| 9. Certification audit | An external auditor assesses your system in two stages |
| 10. Certificate | Receive the certificate and maintain it every year |
Good to know: The auditor checks not only whether you have completed these steps, but also whether your system works in practice. So focus not on paperwork, but on evidence that your processes function. Step 5 (implementing) and step 6 (internal audit) are the most important in this respect.
1. Orientation: is ISO 9001 right for you?
Before you start, you need to know whether ISO 9001 is right for your organisation. Ask yourself these questions:
- Why do we want this? (customer requirement, tender, internal improvement?)
- Do we have the capacity to take this on?
- Who will lead this?
The management must support it. Without top-level commitment, the process becomes difficult. ISO 9001 requires that management is actively involved, not just on paper.
Action: Discuss this with the management and appoint a project leader.
2. Gap analysis: where does your organisation stand?
A gap analysis maps what you already have and what is still missing. Go through the requirements of ISO 9001 and be honest: do we meet this? Partly? Not at all? Step 4 also requires you to make a context analysis for ISO 9001: a description of the internal and external factors that affect your organisation.
Most companies already have more than they think. You probably already have:
- A way of working (processes)
- Agreements about who does what
- Some form of customer administration
- Complaint handling
The challenge is to make this explicit and identify the gaps.
Action: Make an overview of all ISO 9001 requirements and score yourself on each point.
3. Define the ISO 9001 scope
The scope determines what you are certified for. This matters: you do not have to certify your whole company.
A construction company that also runs a small temping agency can choose to certify only its construction activities. The scope must still be logical. You cannot leave out parts at random.
Action: Describe exactly which activities, locations and products or services fall under the certification.
4. Describe and document processes
Now comes the real work: describing your processes. This does not need to be complicated. The standard does not ask for thick manuals, but for clarity.
What you must record as a minimum:
| Component | What do you describe? |
|---|---|
| Context | Internal and external factors that affect your organisation |
| Interested parties | Who are your stakeholders and what do they expect? |
| Quality policy | What is your vision of quality? |
| Objectives | Concrete, measurable quality goals |
| Processes | How you carry out your work |
| Responsibilities | Who does what? |
A common mistake is documenting too much. Keep it practical. If nobody reads it, it has no value. A simple flowchart is often more effective than pages of text.
Action: Start with your core processes. First describe how things really work, not how they should ideally work.
5. Implement the quality management system
You cannot go to an audit with paper processes alone. You must show that your system works. That means:
- Training employees in the new way of working
- Keeping records
- Recording and resolving nonconformities
- Completing at least one full cycle
The auditor wants to see evidence. Invoices, purchase orders, complaint records, meeting minutes. Make sure you collect these.
Action: Implement your system and collect at least 2-3 months of evidence that it works.
6. Carry out the internal audit
Before the external auditor visits, you carry out an internal audit. You check yourself whether your system meets the requirements.
This is mandatory under the standard, but it is also sensible. You find out now what is not yet right, so you can fix it before the real audit begins.
You can carry out the internal audit yourself, but the auditor may not check their own work. The quality manager therefore may not audit their own processes. Many small companies have an external party do this. A full explanation of the approach, from annual planning to reporting, is on the page internal audit ISO 9001.
Action: Plan and carry out a complete internal audit. Record findings and resolve nonconformities.
7. Management review
Management must review the quality system at regular intervals. This is a formal requirement of the standard. On the page management review ISO 9001 you can read which input is mandatory, which decisions must come out of it and what an agenda looks like.
In this review you look at:
- Audit results
- Customer satisfaction
- Process performance
- Status of improvement actions
- Changes that affect the system
It is not a formality. The auditor asks for the minutes and wants to see that management is actively involved.
Action: Schedule a management review and record the results.
8. Choose a certification body
Now you need to choose who will carry out the audit. Well-known certification bodies in the Netherlands include:
Note: choose a body that is accredited by the Raad voor Accreditatie (RvA) . Only then is your certificate recognised. You can check on the RvA website whether a body is accredited.
Action: Request quotes from 2-3 bodies and compare price, lead time and approach.
9. The ISO 9001 certification audit
The audit consists of two stages:
Stage 1: Documentation review The auditor reviews your documentation and checks whether you are ready for stage 2. This can take place on site or remotely. You receive feedback on any shortcomings.
Stage 2: Implementation audit The auditor visits on site and checks whether your system works as described. They speak with employees, review records and follow processes.
Afterwards you receive a report with:
- Conformities: what is going well
- Observations: points for improvement (not mandatory)
- Minor nonconformities: shortcomings you must resolve, but which do not block certification
- Major nonconformities: serious shortcomings that block certification
For minor nonconformities you usually get 90 days to resolve them. For major nonconformities a re-audit may be needed.
Action: Prepare your employees. Everyone should know what ISO 9001 is and what their role is.
10. Receive and maintain the certificate
If the audit is positive and any nonconformities have been resolved, you receive the certificate. It is valid for 3 years.
But it does not stop there. Every year the auditor returns for a surveillance audit. After 3 years a recertification audit follows.
Action: Schedule your annual audits and keep your system up to date.
ISO 9001 lead time by company size
Small business (1-10)
Total lead time: 2-4 months
- Orientation and gap analysis: 1-2 weeks
- Documentation: 2-4 weeks
- Implementation: 4-6 weeks
- Internal audit and management review: 1 week
- Certification audit: 1-2 days
Tips for a smooth ISO 9001 process
Do not work on paper only
The biggest pitfall is building a system that exists only on paper. Employees do not know the procedures, records are not kept, and improvements are not implemented.
An auditor sees through this. More importantly, you gain nothing from it.
Start with what you already do
You do not need to reinvent the wheel. Start by describing how you work now. Only then look at where changes are needed.
Involve your employees
ISO 9001 only works if everyone takes part. Involve employees in describing processes. They know best how the work is done.
Keep it simple
The simpler your system, the better it works. A short checklist that everyone uses is more valuable than a detailed procedure that nobody reads.
Plan for after certification
The certificate is not the end point. You must keep maintaining and improving the system. Plan capacity for this.
Common mistakes in ISO 9001 implementation
| Mistake | Consequence |
|---|---|
| Starting too late | Stress and rushed work, the system does not hold up |
| No management commitment | Certification becomes a paper tiger |
| Documenting too much | The system becomes unworkable and nobody follows it |
| Describing processes as they “should” be | The auditor finds a gap with practice |
| Involving only the quality manager | The rest of the organisation knows nothing about it |
Next step
Ready to start? See what it costs or read more about the specific requirements of ISO 9001.