ISO 9001 is the international standard, published by ISO, that sets out the requirements for a quality management system: defined processes, clear roles, risk-based thinking, control of nonconformity, internal audit and management review. ISO reports that more than 1 million certificates have been issued to organizations in 189 countries, making it the most widely used quality management standard in the world. The roles stay separate: your organization implements the system, an independent certification body audits and certifies it, and a consultancy prepares your team and trains your internal auditors.
ISO 9001 is the international standard that sets the requirements for a quality management system, and it is published by ISO. If you are asking what is ISO 9001 in practical terms, it asks you to run your work through defined processes, clear responsibilities, controlled records, and improvement based on evidence. According to ISO (undated), more than 1 million certificates have been issued to organizations in 189 countries, which makes it the most widely used quality management standard in the world.
This guide is written for four readers: an owner or general manager meeting ISO 9001 for the first time; a quality manager building or rebuilding a QMS; an HR or quality lead sourcing in-house internal auditor training; and a laboratory or medical device lead comparing ISO 9001 with the standard their own sector works to. Each of them has a section below.
What ISO 9001 asks an organization to do
ISO 9001 states requirements. It does not hand you a set of procedures to copy. The system has to fit your scope, your processes and your risks, so two certified firms in the same sector rarely document their work the same way.
The standard is generic by design. ISO (undated) notes that it is used in almost every sector worldwide, including manufacturing, services, healthcare, education, construction, technology and public administration.
Customer focus and defined processes
The starting point is the context of the organization: your interested parties, and what they require of you. From there you define your processes, their inputs and outputs, and how performance is measured. Customer requirements, feedback and complaints are handled inside the system, not beside it.
Risk-based thinking, nonconformity and corrective action
ISO 9001 requires you to address the risks and opportunities that affect your intended results. It also requires control of nonconformity. You react to the problem, then examine its cause, then decide whether action is needed to stop it recurring.
Correcting a single output is not corrective action. Keeping those two steps apart in your records is what makes the process auditable.
Internal audit and management review
Two requirements carry the improvement cycle: internal audit and management review. Internal audit checks that the system conforms to the standard and to your own criteria, and that it is effective. Management review puts performance results, audit findings, customer feedback and improvement opportunities in front of top management for decisions. ISO (undated) states that the quality management principles enable continual improvement for the benefit of the organization, its people, its stakeholders and its customers.
What the published evidence says
Buyers are right to ask whether a management system repays the effort. The table below holds every external source cited on this page, with the publisher named so you can read it yourself.
Published statements about ISO 9001 and its effects
What the research actually measures
Read those figures as what they are. International Economics (2025) reports a 48.3% increase in total sales for firms certified to ISO 9001:2015, drawn from World Bank Enterprise Survey data across 33 countries. That is an average across a large sample, not a forecast for one company. The International Journal of Quality & Reliability Management (2015) compared 397 US firms certified between 1991 and 2002 with non-certified and matched-control firms. No study promises a result for your organization, and no consultant can.
What the 2026 edition changes
If you already run a certified QMS, this is the section that matters. ISO (undated) states that ISO 9001:2026 builds on the strengths of the 2015 edition, and that it clarifies existing requirements rather than introducing major new ones.
ISO (undated) also notes that the standard adopts the latest Harmonized Structure for ISO management system standards, which makes it easier to integrate ISO 9001 with other management system standards. ASQ (undated) describes the edition as keeping the existing quality management framework while making quality management more responsive to organizational culture, risk, change, climate considerations and modern business conditions.
If you already hold a certificate
Plan the transition as a review of what you have, not a rebuild. Map your existing documented information against the current wording, note where a clarified requirement exposes a thin record, and fix the record rather than the binder. Transition arrangements, dates and conditions for your own certificate are set by the certification body that issued it, so ask that body what applies to you.
Is ISO 9001 mandatory, and what would we have to keep?
For an owner signing off the spend, two questions decide it. Must we, and what does it cost us in work?
Whether any certificate is legally required depends on your sector, your product and the rules where you sell, so confirm that with your regulator or legal adviser. The more common trigger is commercial. A customer, a tender or a contract asks for ISO 9001, and the quality system becomes a condition of the order.
What you keep is documented information: your scope and quality policy, process and responsibility definitions, risk and opportunity assessments, monitoring records, nonconformity and corrective action records, internal audit results, management review outputs, and competence and training records. Certificate validity and surveillance arrangements are decided by the certification body you apply to, under the accreditation rules it works to.
Who does what
- Your organization implements the quality management system and runs it every day.
- An independent certification body audits the management system and makes the certification decision.
- An accreditation body accredits certification bodies, laboratories and inspection bodies. In Türkiye that body is TÜRKAK.
- A consultant prepares and trains. Kalite Pusulası works on ISO 9001 certification readiness with your team; the certification decision is never ours.
No consultancy can promise a certificate, a pass, or a fixed certification date. Anyone who does is describing a role they do not hold.
ISO 9001 alongside ISO/IEC 17025 and ISO 13485
ISO 9001 is a generic quality management standard, which is why it appears across so many sectors. It does not replace the standard your own sector works to.
If you run a testing or calibration laboratory, ISO/IEC 17025 is the standard your customers ask about, and laboratories are accredited rather than certified. That accreditation decision belongs to the accreditation body, TÜRKAK in Türkiye. If you manufacture medical devices, ISO 13485 is the standard your customers and regulators are most likely to name.
ISO 9001 can sit alongside either one. ISO (undated) points to the Harmonized Structure as making integration with other management system standards easier. In practice that means one set of processes, one internal audit programme and one management review, instead of parallel systems that disagree with each other. If you work to more than one standard, a current-state analysis across all of them is the cheaper place to start.
Internal audit and internal auditor training
Internal audit (iç tetkik) is a requirement of ISO 9001, and it only works when auditors are competent and independent of the work they audit. That is why many organizations train their own people instead of outsourcing every audit.
Internal auditor training (iç tetkik eğitimi) covers the full cycle: planning an audit programme, preparing checklists from the standard and from your own processes, collecting objective evidence, writing a finding that states the requirement and the evidence, and following corrective action through to closure. ISO 9001 awareness training for wider staff is a shorter session with a different aim: people should recognise their own part in the system.
Training is tailored to your organization, on site or online, and built on your own processes and records. Participants receive a certificate of attendance. That is a record of the training they attended, and nothing more.
What to check before you order quality management consultancy or training
- Ask for a current-state analysis first: a gap list against ISO 9001, then a roadmap and a proposal naming scope, effort and responsibilities.
- Ask who does the work. A system written entirely for you, without your team, is a system nobody can run.
- Check that the proposal separates what the standard requires from what is only good practice.
- Confirm that nobody offers you a certificate, a pass, or a fixed certification date. Only a certification body decides, after its own audit.
- Ask how the first internal audit and management review will be run, and who runs them afterwards.
- For training, ask whether the material uses your own processes and documents, whether delivery is on site or online, and what participants receive.
- If you also work to ISO/IEC 17025 or ISO 13485, ask for one integrated plan rather than separate systems.
- Ask what happens after the certification audit, because surveillance, internal audit and management review continue every year.
Working with Kalite Pusulası
Establish. Improve. Make it sustainable. We are a quality management consultancy and training firm, which means we prepare and train. We do not certify, and we do not accredit.
- Current-state analysis and a roadmap.
- Setting up or improving the quality management system with your team.
- Internal audit, management review and audit preparation.
- Training tailored to your organization, on site or online, after which participants receive a certificate of attendance.
The next step is simple. Request a current-state analysis: we review your current processes against ISO 9001 and send you a roadmap and a proposal. If training is the priority, ask for an internal auditor or ISO 9001 training proposal built around your own processes.
Sources
- ISO — ISO 9001:2026 Quality management systems — Requirements
- ISO — ISO 9001 explained
- ISO — ISO 9001:2026 — How to use it: Guidance for organizations using ISO 9001:2026
- ISO — Quality management principles: The foundation for success
- ISO — ISO 9001:2026
- ISO — The ISO Survey
- ASQ — ISO 9001
- International Economics (2025) — Upfront efforts for upcoming benefits? ISO 9001:2015 certification and firms’ performance in 33 countries
- International Journal of Quality & Reliability Management (2015) — Impact of ISO 9001 certification on firms financial operating performance
Frequently asked questions
Is ISO 9001 certification mandatory?
Whether a certificate is legally required depends on your sector, your product and the rules where you sell, so check that with your regulator or legal adviser. In practice the usual trigger is commercial: a customer, a tender or a contract asks for ISO 9001. ISO (undated) reports more than 1 million certificates issued to organizations in 189 countries, which is why buyers so often treat it as a baseline expectation rather than a differentiator.
How long does it take to get ISO 9001 certified?
No consultancy can give you an honest date, because the certification decision belongs to an independent certification body after its own audit. What we can give you is a current-state analysis, a roadmap and a proposal, so you can see the gaps against ISO 9001, the work each one needs and who does it. The realistic variables are your scope, how many processes are already defined, and how quickly your team can run internal audit and management review for the first time.
What does ISO 9001:2026 change for a system already certified to the 2015 edition?
ISO (undated) states that ISO 9001:2026 builds on the strengths of the 2015 edition and clarifies existing requirements rather than introducing major new ones, and that it adopts the latest Harmonized Structure for ISO management system standards, making integration with other management system standards easier. ASQ (undated) describes the edition as keeping the existing framework while making quality management more responsive to organizational culture, risk, change, climate considerations and modern business conditions. Treat the transition as a review of your documented information, and ask your certification body for the transition conditions that apply to your certificate.
Do we need ISO 9001 if we already work to ISO 13485 or ISO/IEC 17025?
ISO 9001 is a generic quality management standard and does not replace a sector standard. Laboratories are accredited against ISO/IEC 17025, and that decision belongs to the accreditation body, TÜRKAK in Türkiye; medical device organizations work to ISO 13485. ISO (undated) points to the Harmonized Structure as making ISO 9001 easier to integrate with other management system standards, so the practical answer is usually one integrated system with one audit programme. Ask for a current-state analysis across every standard you work to before deciding.
What does internal auditor training include, and what do participants receive?
Internal auditor training (iç tetkik eğitimi) covers planning an audit programme, building checklists from ISO 9001 and from your own processes, collecting objective evidence, writing findings that state the requirement and the evidence, and following corrective action to closure. It is tailored to your organization, delivered on site or online, and based on your real documents rather than generic examples. Participants receive a certificate of attendance, which records the training they attended and is not a certification of your system.