Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ISO 9001
Manufacturers and suppliers running a quality management system - including defence.
ISO 9001 is the international standard for quality management systems. ComplyTrain is structured around its clause structure, so your QMS is audit-ready by design.
ISO 9001 is the international standard for a quality management system - the framework an organisation uses to consistently meet customer and regulatory requirements and to improve the way it works over time. Published by the International Organization for Standardization, it is the most widely held management-system certification in the world, with more than a million certified organisations across almost every sector.
At its core it asks one question in a rigorous way: can you show that your organisation reliably does what it says it does? The standard does not prescribe how you make your product or deliver your service. It sets out what a capable quality system must contain - defined processes, controlled information, competent people, managed risk and evidence of improvement - and leaves the specifics to you. It is worth being precise about words here: following ISO 9001, being compliant with it, and being certified to it are three different things, and we pull them apart in following, compliant, certified.
Quality that depends on individual heroics is fragile: it walks out of the door when a key person leaves, and it cannot be proven to a customer or an auditor after the fact. ISO 9001 exists to make quality a property of the system rather than of the person - repeatable, documented and demonstrable. To a buyer, a supplier's certificate is shorthand for "this organisation manages its work, so I do not have to inspect everything they send me." That is why, in regulated and safety-critical supply chains, it is frequently the price of being allowed to bid at all.
ISO 9001 is sector-agnostic - used by manufacturers, engineering and construction firms, software and service companies, healthcare providers and public bodies. Organisations usually pursue it for one of three reasons:
The current version, ISO 9001:2015, follows the "high-level structure" shared by all modern ISO management-system standards. Its requirements sit in clauses 4 to 10. Read as a list they can look abstract, so here is what each one actually asks of you in practice.
Three ideas run through all of it. The process approach: manage your work as a set of connected processes with defined inputs, outputs and owners. The Plan-Do-Check-Act cycle: plan a change, do it, check the result, act on what you learn - the engine of continual improvement. And risk-based thinking, made explicit in the 2015 revision: anticipate what could go wrong and build the controls in, rather than reacting after a failure.
Underneath the clauses sit the seven quality management principles the standard is founded on: customer focus, leadership, engagement of people, the process approach, improvement, evidence-based decision-making and relationship management. They are the "why" behind the "what".
For many organisations ISO 9001 is not the destination but the foundation. Several of the standards that regulated industries actually require are built directly on top of it, adding sector-specific requirements to an ISO 9001-grade system:
The practical consequence is the same in each case: you cannot meet the sector standard without meeting ISO 9001 first. Building a genuine ISO 9001 system is therefore rarely wasted effort even when the eventual target is AS9100 or AQAP 2110 - it is the base the sector requirements bolt onto.
Certification is a defined, predictable process, not a black box: a gap analysis against the standard, building and operating the system long enough to generate evidence, then a two-stage audit by an accredited certification body (Stage 1 readiness, Stage 2 assessment in operation). It is not a one-off badge either - annual surveillance audits and a three-year recertification keep it live. We walk the whole road, step by step, in how certification works.
The one thing that determines whether all of this is painful or straightforward is whether your evidence accumulates as you work or has to be reconstructed before each audit - which is the case for keeping the system in one place rather than scattered across drives and inboxes.
Beyond winning the contracts that require it, a working ISO 9001 system pays back in fewer nonconformities and less firefighting, in faster and less painful audits, and in a shared, documented way of working that survives staff turnover. The cost of the standard is the discipline of running it; the cost of not having it, in a regulated supply chain, is not being in the room.
ComplyTrain's quality management is built around the ISO 9001 clause structure, so your system lives where an auditor expects to find it - organised by the requirements it has to satisfy, rather than scattered across shared drives and inboxes:
Because the evidence is captured as you work, preparing for a certification or surveillance audit becomes a matter of showing what you already run, rather than assembling it the week before. ComplyTrain is structured around ISO 9001 - it does not make you certified (only an accredited body does that), but it is built to keep you audit-ready for the day they visit.
Tell us how you need to work with ISO 9001 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. ISO 9001 is about how you run your quality system, not which tools you use. But an auditor expects to see controlled documents, records, corrective actions and management review on demand - and that is exactly the work software removes the friction from. ComplyTrain keeps the evidence current as a by-product of the work.
Compliant means you genuinely meet every requirement of the standard and can show the evidence; certified means an accredited third party has audited you and issued a certificate saying so. You can be compliant without being certified - but you cannot honestly describe self-assessed compliance in words that imply an outside body has verified it. We pull the two apart, along with simply "following" the standard, in following, compliant, certified.
For most small and mid-sized organisations, three to six months from a standing start to the certification audit is realistic - longer if you are building the quality system from scratch, shorter if you already work in a disciplined way and only need to formalise it. The standard then requires annual surveillance audits, with a full recertification every three years. How certification works walks through each stage.
An accredited certification body audits your management system in two stages. Stage 1 reviews your documentation and readiness; Stage 2 checks that what you documented is actually being done, through interviews, records and observation. Findings are raised as nonconformities you must close before the certificate is issued.
Clause 9.2 requires you to audit your own management system periodically - your own people checking that what you do matches the standard and your procedures, and raising findings to fix. It is a requirement in its own right and your cheapest early-warning system: internal audits catch problems before a certification body or a customer does. Internal, external, second-party audits covers how to run an effective programme.
There are two costs, and the certification body's fee is usually the smaller one. That fee scales with the size and complexity of your organisation and recurs across the three-year cycle (initial audit plus surveillance). The larger cost is internal: the time to build the system, generate the evidence, and keep it current between audits. Treating compliance as an ongoing discipline rather than a pre-audit scramble is what keeps that second cost down.
Yes. ISO 9001 is deliberately sector-agnostic - its requirements are about how you manage quality, not about manufacturing specifically. Software, engineering and service organisations hold it widely; a controlled development and release process, for example, maps naturally onto the standard's requirements for operation, documented information and improvement.
ISO 9001 is the general quality-management standard. AQAP 2110 (NATO defence) and AS9100 (aerospace) are sector standards built directly on it - they require an ISO 9001-grade system and add requirements such as configuration management, government quality assurance or first-article inspection. Meeting the sector standard means meeting ISO 9001 first and layering the extra requirements on top.
Start with the quality module: it gives you the ISO 9001 clause structure, the record types and the review cadence out of the box, so you are building on the standard from day one instead of on a blank shared drive.
Implementation
Certification is the end of a route, not a single event. The path is broadly the same whatever your sector.
Decide what the quality system covers, then compare how you work today against the clauses of the standard. The gaps are your plan.
Set the quality policy and objectives, map your core processes with their owners, and put the documents and records they need under control.
Run the processes for long enough to generate real records - nonconformities raised and closed, competence logged, suppliers assessed. Auditors want evidence of use, not a fresh binder.
Audit yourself against the standard to find gaps before the certification body does, then have leadership review performance and act on what it shows.
An accredited body runs the Stage 1 and Stage 2 audits; you close any findings and the certificate is issued. Annual surveillance audits and a three-yearly recertification keep it live.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansOne system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.