Your Customer Says You Need ISO 9001. What Should You Do First?

It usually starts with an email. A new customer, or an existing one with a new supplier policy, asks for your ISO 9001 certificate. Sometimes there is a deadline. Sometimes it is a line in a supplier questionnaire. Either way, someone in the business is now responsible for "getting ISO."

The natural reaction is to move fast: buy a template pack, download a quality manual, start writing procedures. That is understandable. It is also the most common way small and growing manufacturers end up with a system that looks complete on paper and does very little for the operation.

Before you write anything, there are a few things worth doing first.

1. Find out exactly what the customer is asking for

"You need ISO 9001" can mean several different things. Ask the customer, politely and specifically:

• Do you require certification by an accredited certification body, or a quality management system that meets ISO 9001 requirements?
• Is there a deadline, and is it firm? Would evidence of progress, such as a signed contract with a certification body or an implementation plan, be accepted in the meantime?
• Are there other requirements alongside ISO 9001, such as customer-specific quality requirements, industry standards, or a supplier audit?
• Does the requirement apply to the whole business, or to the products and sites that supply them?

The answers change the plan. A customer who wants to see a credible system and a realistic timeline is very different from a contract clause that requires a certificate before the next purchase order.

2. Understand what certification actually involves

ISO does not certify companies. ISO publishes the standard. Certification is carried out by independent certification bodies (sometimes called registrars), which are themselves accredited by an accreditation body. In Canada, for example, that is the Standards Council of Canada.

A certification body will audit your quality management system against the standard, usually in two stages: first a review of your system and readiness, then an assessment of whether the system is actually implemented and working. After certification, there are regular surveillance audits.

The important point is this: the auditor is not looking for a binder. They are looking for evidence that the system you describe is the system you operate.

It is also worth knowing that the standard itself has just been updated. ISO 9001:2026 was published in September 2026. Organizations certified to ISO 9001:2015 have a transition period, and new certifications will move to the 2026 edition over the next couple of years. If you are starting now, ask your certification body which edition they will audit against and when.

3. Look honestly at where you are today

Most manufacturers who are told they need ISO 9001 are not starting from zero. You already control product quality in some way. You inspect. You deal with customer complaints. You train people. You have drawings, specifications, work instructions, and probably some records.

The question is not "do we have a QMS?" It is "how much of what we already do is defined, consistent and evidenced, and where are the real gaps?"

A useful starting picture covers a few areas:

• Leadership and direction: Does management treat quality as part of running the business, or as one person's job?
• Processes: Do you know how work actually flows, from enquiry to delivery, and who owns each part?
• People and information: Do people know what good looks like, and do they have the current information they need?
• Product and process assurance: How do you make sure what you ship is right, and what happens when it is not?
• Evaluation and improvement: Do you learn from problems, or fix the same ones repeatedly?

This is exactly what our free QMS Readiness & Maturity Scorecard is designed to help with. It is not an audit, but it gives you a structured starting picture and highlights critical gaps that an overall impression can hide.

4. Get leadership aligned before anyone writes a procedure

A QMS built by one person in an office, while the rest of the business carries on as usual, rarely survives first contact with a real audit, let alone a busy production month.

Before the work starts, the leadership team needs to agree on a few things: why the business is doing this, what the system should cover, who will own which processes, and how much time people will actually be given. Certification may be the trigger, but the system will only work if leadership sees it as a better way to run the operation.

5. Define your processes, then decide what to document

This is where most implementations go wrong. A template pack hands you dozens of procedures written for someone else's business. You then spend months adjusting your operation to fit the documents, or the documents quietly drift away from reality.

Reverse the order. First, map how work really happens in your business: the main processes, the handoffs between them, the risks that matter, and the controls you already have. Then decide what genuinely needs to be documented for people to do the work consistently and for you to demonstrate it. Often, it is less than you think.

6. Build a realistic plan

Once you understand the requirement, your starting point and your processes, you can build a plan that leadership believes in: what will be done, by whom, in what order, and when you will be ready to invite a certification body in.

That plan is also something you can share with your customer. In many cases, a clear, credible plan does more for the relationship than a rushed certificate.

The short version

• Clarify exactly what your customer requires and by when.
• Understand how certification works, and which edition of the standard applies.
• Establish an honest starting picture of your current practices.
• Align leadership before writing anything.
• Define processes first, documents second.
• Build a plan you can actually deliver.

Certification should be an outcome of building a system that works, not the purpose of the system. Start with the business, understand how the work happens, then build the system around it.

Not sure where your organization stands? Take the free QMS Readiness & Maturity Scorecard. It takes 10 to 15 minutes, and you will receive a readiness score, a five-dimension profile and three initial priorities to consider.