How to get ISO 9001 certified: a step-by-step guide for UK manufacturers

ISO 9001 is the international standard for quality management systems. For many UK manufacturers it is a condition of getting onto an approved supplier list, whether the customer is a tier one automotive firm, an aerospace prime or a public sector buyer.

Certification is not a product you buy. It is an independent confirmation that your management system meets the standard and is actually used. The route is well established and follows a sensible order.

Start with what the standard asks of you

Buy or access a copy of the current version of ISO 9001 through BSI or another authorised seller. Read it before you hire anyone. Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement.

Decide who will own the project. Top management must be visibly involved, because the standard places specific duties on them. A named project lead, usually the quality manager or operations manager, should have time set aside for it.

Define the scope too. This states which sites, products and processes the certificate will cover. A tight, honest scope is easier to certify than a vague one.

Step 1: run a gap analysis

A gap analysis compares what you do today with what the standard requires. Most factories find they already meet a good share of it through work instructions, inspection records, calibration and corrective action.

You can do this in-house or use a consultant. Either way, record each clause, the evidence you have and what is missing. The output is a short action list with owners and dates.

Step 2: build the quality management system

Now close the gaps. The standard is less prescriptive about documents than many assume, but you will need to keep certain documented information. Typically this includes:

The scope of the system and a quality policy
Measurable quality objectives
Risk and opportunity planning
Process controls, work instructions and inspection records
Calibration records for measuring equipment
Supplier evaluation records
Internal audit results and management review minutes
Records of nonconformities and corrective actions

Resist the urge to copy a template wholesale. Auditors can tell when procedures describe a business other than yours. Write down what people really do, then improve it where needed.

Train staff on the parts of the system that affect their jobs. Operators should know the quality policy and how their work contributes to it.

Step 3: run the system and gather evidence

A system needs to have operated for a while before it can be audited. Certification bodies expect to see records showing it working, not a set of documents written last week.

Ask your chosen certification body how much operating history they expect before the stage 2 assessment, and confirm the current requirements with them directly.

Step 4: carry out an internal audit and management review

The standard requires both before certification. Internal audits test whether the system meets the standard and your own procedures. Auditors should be trained and should not audit their own work.

Management review is a formal meeting where senior leaders look at audit results, customer feedback, process performance, risks and resources. Minute it properly, with decisions and actions.

Fix any findings and record the corrective action. Auditors from the certification body will want to see that loop closed.

Step 5: choose a UKAS-accredited certification body

UKAS is the UK's national accreditation body. It assesses certification bodies for competence and impartiality. A certificate from an accredited body carries more weight with customers and is more widely accepted.

Check the body's accreditation on the UKAS website rather than relying on a logo. Confirm that ISO 9001 and your industry sector are within its accredited scope.

Get quotes from several bodies. Compare the audit days proposed, the surveillance schedule, the contract length and how auditors are allocated. Cheapest is not always best if the auditor lacks experience in your sector.

Keep your consultant, if you have one, separate from the audit. Certification bodies cannot certify a system they helped design.

Step 6: the stage 1 and stage 2 audits

Stage 1 is a readiness review, often part on-site and part document-based. The auditor checks your scope, documentation, internal audit and management review, and your understanding of the standard. They will list any areas of concern to fix before stage 2.

Stage 2 is the full on-site assessment. Auditors sample processes, interview staff and examine records to confirm the system is implemented and effective. Expect them to follow a product through the shop floor and to question operators directly.

Findings are usually graded as major or minor nonconformities. A major must be resolved, with evidence, before a certificate is issued. Minors need an agreed action plan.

After certification: keeping it

Certificates normally run for three years, with surveillance audits in between and a recertification audit at the end. Treat the system as a working tool. Companies that let it lapse between audits tend to struggle at the next visit.

Use the data you gather. Scrap rates, on-time delivery, customer complaints and supplier performance should drive real improvement, which is where the commercial return comes from.

How long does it take to get ISO 9001 certified?

It depends on the size of the business, the maturity of your existing controls and how much time you can commit. Small firms with good records can move faster than larger multi-site operations. Ask your certification body for realistic timings.

How much does ISO 9001 certification cost?

Costs vary with headcount, sites, complexity and the audit days required, plus any consultancy and internal time. Get written quotes from several UKAS-accredited bodies, and confirm current cost guidance with them before you budget.

Do I need a consultant to get certified?

No. Many manufacturers do it in-house, particularly if they have an experienced quality manager. A consultant can save time on the gap analysis and system build, but cannot also be your certifier.

Is ISO 9001 certification a legal requirement in the UK?

No. It is voluntary, although customers, tenders and supply chains often require it as a condition of doing business.