Which ISO quality management standard can a company be certified to?

Among the quality management standards published by ISO, ISO 9001 is the general-purpose standard a company can be certified to. It specifies requirements for a quality management system (QMS) intended to support consistent delivery of products and services that meet customer and applicable statutory and regulatory requirements.

Certification applies to an organization’s management system within a defined scope—not automatically to every site, product or activity. ISO 9001 is also not the only certifiable ISO standard related to quality: ISO 13485, for example, sets QMS requirements for organizations involved in the medical device sector. The distinction matters when selecting a standard or evaluating a supplier’s certificate.

Why ISO 9001 is the usual answer

ISO 9001 is designed for organizations of any size and sector. Its requirements address how an organization establishes, operates, evaluates and improves the processes needed to deliver conforming products and services. A manufacturer, logistics provider or engineering consultancy can use it, provided the organization defines a QMS appropriate to its activities and context.

The standard is organized around management responsibilities and operational controls rather than a prescribed production method. It covers areas such as leadership, planning, resources, competence, operational control, performance evaluation and improvement. For example, a company must determine applicable customer and regulatory requirements, control externally provided processes and address outputs that do not conform to requirements.

The standard does not prescribe a universal product specification or guarantee defect-free output. It requires the organization to establish controls appropriate to its processes and demonstrate that its QMS conforms to the applicable requirements. A certificate therefore provides evidence about the management system, not proof that every shipment meets a particular drawing, safety requirement or contractual specification.

How ISO 9001 differs from other quality-related standards

The ISO 9000 family includes documents with different purposes. Their numbers are similar, but they should not be treated as interchangeable certification claims.

Industry-specific schemes can add requirements beyond ISO 9001. For example, IATF 16949 is an automotive QMS standard used in conjunction with ISO 9001; it is not itself an ISO standard. Its applicability and certification rules depend on the automotive scheme. A customer specification or regulatory obligation may call for a sector-specific standard rather than ISO 9001 alone.

ISO 45001 is also certifiable, but it addresses occupational health and safety management, not quality management. Certification to one does not establish conformity to the other. An organization may operate an integrated system, but the relevant certification scope and audit coverage still need to be clear.

What an ISO 9001 certificate actually covers

The scope identifies the activities, products or services and locations covered by the certified QMS. A certificate for sales and distribution at one office does not, by itself, establish that a separate manufacturing site is certified. Similarly, a scope covering assembly does not automatically cover product design, even when the same corporate group offers both services.

Scope boundaries deserve particular attention when work is outsourced. ISO 9001 requires an organization to control externally provided processes, products and services as applicable. However, a buyer should not assume that a subcontractor holds its own ISO 9001 certificate merely because the contracting supplier is certified. The relevant question is how the certified supplier selects, monitors and controls that external provision.

Some requirements may be determined not applicable where they cannot be applied within the scope of the QMS. Such a determination must not undermine the organization’s ability or responsibility to ensure conformity of its products and services or enhance customer satisfaction. For example, design and development requirements may not apply to an organization that manufactures solely to a customer’s completed design, depending on its actual responsibilities. A short certificate scope alone does not explain that determination.

A certificate also does not replace evidence required for a product or shipment. Material test reports, inspection records, traceability information, product approvals and declarations of conformity may still be necessary under the contract or applicable law. ISO 9001 certification and product conformity answer different questions.

What certification involves

ISO develops and publishes ISO 9001; it does not issue ISO 9001 certificates. Certification is performed by independent certification bodies. For an accredited certificate, the certification body must be accredited for the relevant activities by a recognized accreditation body.

Before applying, an organization needs a functioning QMS, not just a set of procedures prepared for an audit. It must identify its processes and their interactions, define responsibilities, determine risks and opportunities relevant to the QMS, and retain the documented information required by the standard and by its own operations. Evidence must show that controls are being used and evaluated.

The certification body normally conducts an initial audit in two stages. Stage 1 reviews the organization’s readiness, including its QMS documentation, scope and understanding of relevant requirements. Stage 2 evaluates implementation and effectiveness through evidence such as interviews, observations and records. Auditors sample activities; they do not inspect every transaction or product.

When auditors identify nonconformities, the organization must respond under the certification body’s rules. A useful response addresses both the immediate issue and its cause. For instance, replacing an incorrectly calibrated instrument may contain a problem, but the organization also needs to determine why calibration control failed, assess affected results where appropriate, and verify that corrective action is effective.

A certification decision follows the audit and resolution of issues in accordance with the applicable certification rules. Certification is maintained through surveillance audits and subject to recertification. Certificates are commonly issued for a three-year cycle, but continued validity depends on the certification body’s decisions and the organization’s ongoing conformity. A printed expiry date alone is not enough to confirm current status.

Evidence that makes the QMS credible

Auditors look beyond the existence of a quality manual or procedure. The relevant evidence connects a requirement to an operational control and then to a result. For an inspection process, that connection might include an approved acceptance criterion, a competent inspector, suitable measuring equipment, recorded results and a defined response to a failed measurement.

Several areas often require careful interpretation:

• Risk-based thinking: The organization must address risks and opportunities relevant to the QMS. ISO 9001 does not require one universal risk assessment format or a formal enterprise risk-management system.
• Competence: Training attendance alone may not demonstrate competence. The organization needs appropriate evidence that people performing work affecting quality can perform their assigned tasks.
• Monitoring and measurement: The extent of equipment control depends on how measurement results are used. Where valid results require measurement traceability, applicable calibration or verification controls must be established.
• Nonconforming outputs: Controls should prevent unintended use or delivery and define what happens when a problem is discovered after delivery.
• Internal audit and management review: These must provide meaningful evaluation of the QMS. Completed schedules and meeting minutes are less persuasive if findings, decisions and follow-up do not connect to actual performance.

For safety-critical characteristics, ISO 9001 does not by itself define the necessary technical acceptance limits or demonstrate compliance with a separate safety law. Those requirements must be identified from applicable regulations, standards and contracts, then incorporated into the organization’s operational controls where relevant.

How to evaluate a supplier’s certificate

Start with the legal entity, site and scope—not the logo on a quotation. The supplier name should match the entity responsible for the contracted work, and the listed activities should cover the work being purchased. Where a certificate covers multiple sites, request the associated site schedule and check the role of the relevant location.

Check the certification body’s name, certificate number, issue and expiry dates, and standard edition. Verify status through the certification body’s public directory or directly with the body where possible. Check whether the certification body is accredited for the relevant certification activity; the accreditation body’s directory can help establish that relationship. Accreditation and certification are different: one assesses the certification body, while the other assesses the organization’s management system.

For cross-border sourcing, the IAF CertSearch database can be a useful additional verification route for participating accredited certification bodies, but absence from a database should not automatically be treated as proof that a certificate is invalid. Confirm with the issuing body and examine the applicable accreditation details.

Even a valid, accredited certificate is only one input to supplier approval. A buyer may need evidence about a particular production line, critical subcontractor, inspection capability or change-control process. Contractual quality requirements and proportionate product verification remain necessary, especially when a defect could affect safety, regulatory compliance or continuity of supply.

The practical distinction is therefore straightforward: ISO 9001 certification provides independent evidence that a defined QMS has been assessed against a recognized set of requirements. Confidence in a specific product or transaction still depends on whether the certified scope, technical controls and supporting records cover the work being purchased.