Certification · Quality management
Sightadel guides you through every requirement of ISO 9001 – with industry templates drawn from years of consulting and certification practice, AI that helps with the wording, and real consultants for the difficult parts.
What it is about
ISO 9001 describes how an organisation manages its work so that customers reliably get what was agreed. The standard does not assess any individual product. It requires you to know your processes, manage them with objectives and KPIs, and be able to prove that you learn from mistakes.
The requirements are set out in clauses 4 to 10: context of the organisation, leadership, planning with risks and opportunities, support, operation, performance evaluation and improvement. ISO 27001 and ISO 42001 use the same basic structure. That is why several management systems can be run together.
The standard requires less paper than many manuals contain. A quality manual is not mandatory. What is required is documented information on specific points – and proof that the system triggers decisions. That is what audits get stuck on, not the number of documents.
More on the matching software: ISO 9001 software, with features, rollout and prices.
The framework agreement requires ISO 9001, and the deadline is set. You need a scope, a quality policy, objectives, processes and a first internal audit – in exactly that order.
The manual is thick, the KPIs are out of date, corrective actions remain open. The surveillance audit will notice. Sightadel turns dates into cycles and reminds you in good time.
ISO 27001 or a customer standard is next. If you build ISO 9001 properly, you can reuse document control, internal audit and management review.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
Internal and external issues, interested parties, a justified scope and the system's processes and their interactions.
In SightadelGuiding questions lead you to the scope. The industry template suggests typical parties and a process map; you confirm or adjust them.
Top management takes responsibility, approves a quality policy, focuses the system on the customer and assigns roles.
In SightadelAI draft of the quality policy based on the industry template. Approval and responsibilities remain your decision – Sightadel flags these points.
Risks and opportunities are determined and addressed. Quality objectives are measurable, planned and monitored. Changes to the system are made in a planned manner.
In SightadelRisks and opportunities as a register with measures. Objectives with KPI, deadline, owner and current value – progress is visible at all times.
Suitable resources, proven competence for each role, awareness among those involved, and controlled documents and records.
In SightadelTraining as recurring cycles with evidence. Documents with version, approval and expiry date in the evidence archive.
Planning and control of processes, clarification of customer requirements, design and development, control of external providers, release and handling of nonconforming outputs.
In SightadelSuppliers are assessed and regularly reviewed in the Vendors module. Deviations in operations are logged as an issue with an owner and deadline.
It is defined what is measured, how and when. Customer satisfaction is surveyed and evaluated.
In SightadelKPIs and surveys as cycles with dates. Results are filed as evidence and feed into the management review.
An audit programme covering all processes, completed audits and a documented review by top management with decisions.
In SightadelDates rather than good intentions: Sightadel schedules both as a cycle, provides the checklist and records reports and decisions as evidence.
Errors are addressed, causes eliminated, the effectiveness of the correction checked and the system continually improved.
In SightadelDeviations become action plans with a deadline and effectiveness check. The activity log shows who did what and when.
Process
Certifiable in around three months if management backs it and one person has at least one day per week available. Without that, it becomes a six-month project.
Define the scope, identify interested parties, adopt the quality policy. Engage the certification body early – audit dates are allocated weeks in advance.
Work through all 55 controls with guidance. Upload and assign existing documents. Sightadel shows what is missing and who is responsible.
Describe processes as they actually run: owner, KPI, intervention threshold. Quality objectives with current value, risks and opportunities with measures.
Complete document control, supplier evaluation and evidence of competence for each role. File evidence with expiry dates.
Audit all processes once, initiate corrective actions, evaluate customer satisfaction for the first time, hold a management review with decisions.
An independent, accredited auditor first reviews the documentation, then the implementation. There is time for improvements between the two stages. The auditor works directly in Sightadel with their own role and can never delete anything.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
A thick quality manual looks thorough but is rarely read. Describe processes concisely and focus on proving that they are controlled.
“Increase customer satisfaction” is not an auditable objective. Define the KPI, target value, deadline and owner.
If only the quality manager knows the system, the audit will notice. Process owners must be able to explain their processes and KPIs themselves.
An error is fixed but comes back. Ask about the cause, define a measure and check later whether it worked.
An evaluation at onboarding is not enough. Define criteria and frequency and evaluate regularly, especially critical suppliers.
Minutes that only list figures do not meet the requirement. Record decisions on objectives, resources and improvements.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Same basic structure of clauses 4 to 10. Document control, internal audit, management review and corrective action are set up once. Many certification bodies offer a combined audit.
ISO 42001If you build AI into products or processes, you can reuse the leadership, risk process and audit programme of your quality management.
HACCPIn food businesses, supplier evaluation, training records, control of records and corrective actions carry over into both systems.
NIS2Supplier management and training records can be shared. The actual security measures, reporting channels and registration are added on top.
Audit and evidence
Under ISO 17021, a certification body may not both consult and certify. That is why Sightadel does not certify. You choose an accredited auditor from our independent partner network or a body of your choice. No commission is paid for audits – neither to us nor to the partners.
The certification audit takes place in two stages: stage 1 reviews the documentation, stage 2 the implementation in operation. This is followed by annual surveillance audits and recertification after three years. The auditor receives their own access in Sightadel: they see the audit scope, add comments and – once you approve – create or edit entries. They can never delete anything.
To the independent auditor networkThe cost of ISO 9001 certification has three parts. The first is the tool: the Sightadel licence for ISO 9001 is charged monthly per edition, with a minimum term of one year. ISO 9001 itself is not discounted. Every other framework permanently costs less as long as ISO 9001 is licensed, for example if HACCP or NIS2 is added later. ISO 27001 is excluded. You will find all prices and a calculator on our pricing page.
The second part is the certification body. It invoices independently based on audit days. Their number depends on headcount, sites and scope. Compare quotes on the basis of audit days across the entire three-year cycle, i.e. initial audit, two surveillance audits and recertification, and ask about travel expenses.
The third and largest part is your own time. The person running the system needs at least one day per week during implementation. Process owners invest hours in descriptions, KPIs and audit interviews, management in the quality policy, objectives and management review. If you already have well-organised processes and only need to prove them, you will progress considerably faster than a business that first has to clarify its processes. Where experience is lacking, you can add consulting as a package in the Sightadel app.
The most common trigger is a customer. In public sector tenders, industrial framework agreements and supplier audits by large buyers, an ISO 9001 certificate is often the ticket to entry. Without it, the bid ends up in the pile of follow-up questions or is rejected outright. With a certificate, many questions in supplier self-assessments no longer apply, because an accredited body has already audited your system.
The internal benefit is at least as important. ISO 9001 forces you to clarify responsibilities, define KPIs and learn systematically from complaints. Errors are not just fixed but addressed at their root cause. New employees find their way into processes faster because they are described and trained.
However, the benefit only materialises if the system triggers decisions. A management review that never leads to anything is effort without return. That is why Sightadel tracks objectives with KPI, current value and owner, and shows where progress deviates from the plan.
The revised edition ISO 9001:2026 was published in September 2026. According to the transition rules communicated by certification bodies, existing certificates to ISO 9001:2015 have three years to transition, expected to run until the end of September 2029. Your current certificate remains valid until then. Your certification body determines the exact procedure.
The basic structure of clauses 4 to 10 is retained. The revision is an evolution rather than a fresh start. According to the information published so far, greater emphasis is placed on quality culture and leadership behaviour, among other things, as well as on how risks and opportunities are handled. The requirement to consider climate change as a potentially relevant issue in the context was already introduced by an amendment in 2024.
In practice, this means: if you are implementing now, you should build with the new edition in mind, and if you are already certified, it is best to schedule the transition into a regular surveillance or recertification audit. Experience shows that auditors are in short supply in the final year of a transition period. When a new edition of the standard is published, it is available in Sightadel as part of your existing subscription at no extra cost.
The standard distinguishes between documented information that you maintain, i.e. requirements, and documented information that you retain, i.e. records. Requirements include the scope, the quality policy, the quality objectives and everything you need to control your processes. Records include, for example, evidence of competence, results of supplier evaluations, inspection and release records, measurement results, the audit programme and audit reports, the management review, and nonconformities with corrective actions.
How detailed process descriptions need to be is up to you. The rule of thumb: as much as is needed for the result to be reliably right, even when your experienced colleague is on holiday. A flowchart with responsibilities and a KPI often goes further than ten pages of prose.
In Sightadel, requirements and records are stored in the evidence archive with version, approval and expiry date. They are attached to the controls of the respective clauses, so it is clear for every requirement what supports it. You import existing Word and Excel files rather than rewriting them.
Before the certification body arrives, two things must have been completed in full at least once: an internal audit covering all processes in scope and a management review with documented results. Without both, the certification audit cannot be completed successfully.
During the audit, the auditor works in a process-oriented way. They ask sales to show them an order and follow it through planning, purchasing, service delivery and invoicing. At every step, they ask how it is controlled, how success is measured and what happens when errors occur. Process owners should know their KPIs and be able to explain what has resulted from them.
A trial run has proven its worth: someone who was not involved in the build-up asks the typical questions and takes samples, such as a complaint, a supplier evaluation or a training record. Anything that sticks becomes an action plan with a deadline. Minor nonconformities in the certification audit are normal. What matters is that you clarify the causes and prove the correction on time.
An ISO 9001 certificate is valid for three years. In the two years in between, the body checks in a surveillance audit whether the system remains effective, and recertification follows in the third year. The main focus is on development: have KPIs improved, have objectives been adjusted, have corrective actions become effective?
For this to work, the system needs an annual calendar. KPIs are collected monthly or quarterly, customer satisfaction once a year, suppliers evaluated at a defined frequency, the audit programme spread over the year, the management review on a fixed date. In Sightadel, these tasks run as recurring cycles with an owner and reminders.
If you are planning further management systems, you can reuse this structure. ISO 27001 and ISO 42001 share clauses 4 to 10, and HACCP shares supplier evaluation and training records. Internal audit and management review can then be carried out together, and many certification bodies offer combined audits.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Terms
Not by law. The usual trigger is a customer: a tender or framework agreement that lists the certificate as a prerequisite. The standard is sector-neutral and is certified for service providers just as it is for manufacturers.
For certification, yes, under three conditions: management backs it, the scope is clearly limited, and one person has at least one day per week available for it. The system only becomes effective in day-to-day operations over several quarters of repetition.
No. The current edition does not require a manual but documented information on specific points. A manual is allowed, but it is effort that nobody audits.
As many as you need to manage your work. A mid-sized company often manages with eight to twelve processes. Where a description is missing but the result is still right, that is not a finding. Where errors recur because of it, it is.
Two items: the Sightadel licence for ISO 9001 (prices on our pricing page) and the certification body, which invoices independently. Its effort depends on headcount, sites and scope. Obtain two quotes – the range is considerable.
Yes, and it is worthwhile. Both standards share the structure of clauses 4 to 10. In Sightadel, you attach a piece of evidence to the requirements of both standards and maintain it only once.
No. ISO standards are protected by copyright. Sightadel contains structure, controls, guiding questions, templates and its own explanations – not the wording. You need a copy of the standard in-house.
Annual surveillance audits and recertification after three years. Sightadel keeps track of KPIs, supplier evaluations, internal audits and the management review as recurring cycles. When a new edition of the standard is published, it is available as part of your existing subscription at no extra cost.
The new edition was published in September 2026. The structure of clauses 4 to 10 remains; the changes are an evolution, with more weight on quality culture and leadership behaviour, among other things. Existing certificates to the 2015 edition remain valid during a three-year transition period. Your certification body determines how the transition works.
Not necessarily. With one committed person in-house, clear processes and a guided structure, many businesses achieve certification themselves. A consultant is helpful for the process map, for KPIs or for an independent internal audit. In Sightadel, you can add consulting as a package in the app.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
