ISO 9001 Quality Management System: 9 Essential Elements Explained

An ISO 9001 quality management system gives an organisation a structured way to manage quality, maintain consistency and evidence how key processes are controlled.

For many businesses, parts of a quality management system may already exist. You may already keep customer records, use checklists, review suppliers, manage complaints, complete internal checks or monitor performance. The purpose of a QMS is to bring these activities together into a clear, controlled and reviewable system.

ISO 9001 is the internationally recognised standard that sets out requirements for quality management systems. Certification to this standard involves an independent assessment of whether an organisation’s system meets the relevant requirements and is being applied in practice.

This guide explains what an ISO 9001 quality management system is, what it commonly includes and what organisations may want to consider before applying for certification.

Simply Certification is a UKAS-accredited certification body providing independent and impartial certification assessment services.

If you would like to better understand your current position before applying for certification, you can complete our ISO 9001 readiness questionnaire here: ISO 9001 – Self Assessment

Please note: the questionnaire is for general readiness awareness only. It does not replace a formal certification assessment and does not confirm whether certification will be awarded.

What is an ISO 9001 quality management system?

An ISO 9001 quality management system is the framework an organisation uses to manage quality across its activities, people, processes, records and improvement actions.

A quality management system is often shortened to QMS.

In practical terms, a QMS helps an organisation answer questions such as:

• What does the customer require?
• Who is responsible for each key activity?
• How is work planned, delivered and checked?
• What records are kept?
• How are issues reviewed?
• How are corrective actions recorded?
• How does the organisation monitor performance?
• How are improvements considered over time?

The system should reflect how the organisation actually works. It should not be paperwork created only for an audit. A useful QMS is one that can be understood, followed and evidenced by the people using it.

Why does a quality management system matter?

A quality management system matters because it helps organisations manage quality in a consistent and controlled way.

Without a clear system, quality can depend too much on individual knowledge or informal habits. This can make it harder to maintain consistency as the organisation grows, takes on more work, changes staff or works with more complex customer requirements.

A clear QMS can help an organisation keep better control of:

• Customer requirements
• Process responsibilities
• Documented information
• Supplier activity
• Training and competence records
• Complaints and feedback
• Non-conformities
• Corrective actions
• Internal audits
• Management review
• Continual improvement

For organisations working in construction, retrofit, renewables, manufacturing, facilities management or public sector supply chains, quality management can also be important when demonstrating capability to customers, contractors or procurement teams.

An ISO 9001 quality management system can provide a recognised framework for managing and evidencing these activities.

A well-maintained ISO 9001 quality management system can also make it easier for an organisation to demonstrate how quality is controlled. This can be useful when customers, contractors or procurement teams ask for evidence of a structured approach to quality management.

Is a QMS the same as ISO 9001?

No. A QMS and ISO 9001 are closely connected, but they are not exactly the same thing.

A QMS is the organisation’s own system for managing quality.

ISO 9001 is the standard that sets out requirements a quality management system can be assessed against.

This means an organisation may already have quality processes in place before certification. The certification assessment looks at whether the management system meets the requirements of the standard and whether it is being implemented effectively.

The 9 essential elements of an ISO 9001 quality management system

Every organisation is different, so the structure of a QMS will vary depending on size, sector, activities and complexity.

However, many systems include the following essential elements.

1. Scope of the quality management system

The scope explains what the quality management system covers.

This may include the organisation’s services, products, locations, departments, activities or operational boundaries.

For example, a contractor may define a scope that includes project management, procurement, installation, inspection and customer handover. A service provider may define a scope around service delivery, customer support and contract management.

A clear scope helps everyone understand what is included in the system.

It also supports the certification assessment because the auditor can see which parts of the organisation are being assessed.

When reviewing scope, organisations may need to consider:

• What services or products are included
• Which locations are included
• Which departments or teams are included
• Whether any requirements are not applicable
• How the scope reflects customer and regulatory expectations

The scope should be clear, accurate and suitable for the organisation’s activities.

2. Quality policy

The quality policy sets out the organisation’s commitment to quality.

It should be relevant to the business and written in a way that can be understood by the people who need to use it.

A quality policy often refers to areas such as:

• Meeting customer requirements
• Meeting applicable requirements
• Maintaining effective processes
• Supporting continual improvement
• Reviewing quality objectives
• Ensuring responsibilities are understood

The policy should not be treated as a document that is created once and forgotten. It should be communicated and reviewed where appropriate.

A good quality policy is usually clear, practical and connected to how the organisation operates.

3. Quality objectives

Quality objectives help an organisation measure whether its quality management system is working.

Objectives should be relevant to the organisation and capable of being monitored.

Examples may include:

• Improving customer satisfaction scores
• Reducing repeat complaints
• Improving on-time completion of records
• Completing internal audits as planned
• Reducing repeated non-conformities
• Improving supplier performance
• Improving response times
• Reducing rework

Objectives should not be chosen only because they sound good. They should provide useful information about quality performance.

Organisations should also consider how objectives are reviewed, who is responsible for monitoring them and what evidence is retained.

4. Process map

A process map shows how work moves through the organisation.

This is often one of the most helpful parts of a quality management system because it shows how different activities connect.

For example, a business may have processes for:

• Enquiry handling
• Quoting
• Contract review
• Project planning
• Purchasing
• Supplier approval
• Delivery or installation
• Quality checks
• Customer handover
• Customer feedback
• Complaints
• Corrective action

A process map helps identify where information enters the business, how work is controlled and what evidence is created.

It can also help staff understand how their role affects the wider system.

The process approach is important because quality is rarely controlled by one single task. It is usually the result of several connected activities working together.

5. Roles and responsibilities

A QMS should make responsibilities clear.

People involved in key processes should understand what they are responsible for, what records they need to complete and when issues need to be escalated.

This does not mean every organisation needs complex documentation. For smaller businesses, a simple responsibility matrix may be enough. For larger organisations, responsibilities may be shown through job descriptions, procedures, organisation charts or process documents.

Responsibilities may include:

• Approving documents
• Reviewing customer requirements
• Managing supplier approval
• Checking completed work
• Recording customer feedback
• Reviewing complaints
• Completing internal audits
• Managing corrective actions
• Reviewing quality performance

Clear responsibilities help reduce missed tasks, duplicated work and confusion.

They also provide useful evidence that the system is understood and controlled.

6. Documented information

Documented information includes the documents and records needed to support the QMS.

Documents explain what should happen.

Records show what has happened.

For example, a procedure may explain how supplier approval works. A completed supplier review form is a record showing that the process has been followed.

Common documented information may include:

• Scope statement
• Quality policy
• Quality objectives
• Process map
• Procedures or process notes
• Forms and templates
• Training records
• Supplier records
• Customer feedback records
• Complaint records
• Internal audit records
• Management review records
• Corrective action records

Documented information should be controlled so that people know which version is current, where information is stored and how records are retained.

Poor document control can create problems if staff use old templates, records are incomplete or evidence cannot be found when needed.

7. Risk and opportunity management

An ISO 9001 quality management system includes risk-based thinking.

This means considering what could affect the organisation’s ability to deliver quality and meet requirements.

Risks may include:

• Customer requirements being misunderstood
• Documents being out of date
• Records not being completed
• Staff not being trained
• Suppliers missing deadlines
• Equipment not being maintained
• Project changes not being communicated
• Complaints not being reviewed
• Corrective actions not being completed

Risk-based thinking does not mean removing every possible risk. It means identifying relevant risks and considering appropriate controls.

The system should also consider opportunities. These may include ways to improve communication, simplify processes, strengthen records, improve supplier monitoring or enhance customer feedback.

The level of detail should be proportionate to the organisation.

8. Internal audits

Internal audits are used to check whether the quality management system is being followed and whether it meets relevant requirements.

An internal audit may review areas such as:

• Process control
• Documented information
• Customer requirements
• Supplier management
• Complaint handling
• Non-conformities
• Corrective actions
• Quality objectives
• Previous audit findings

Internal audits should be planned, carried out and recorded.

If findings are raised, the organisation should review them and take appropriate action.

A useful internal audit is not about blame. It is a way of checking the system, identifying evidence and supporting continual improvement.

Internal audit records are also important during certification assessment because they help show that the organisation is reviewing its own system.

9. Management review and continual improvement

Management review is where leadership reviews the performance of the quality management system.

This is important because quality should be connected to how the organisation is managed, not treated as a separate administration task.

A management review may include:

• Quality objectives
• Audit results
• Customer feedback
• Complaints
• Non-conformities
• Corrective actions
• Supplier performance
• Process performance
• Risks and opportunities
• Resource needs
• Improvement actions

The purpose is to review whether the system remains suitable, adequate and effective.

Continual improvement is also a key part of ISO 9001. This means using evidence to consider where the system can be improved.

Improvements may be small or large. They could include updating a checklist, improving record storage, clarifying a responsibility, changing a supplier review process or improving how customer feedback is recorded.

What happens during certification assessment?

Certification to ISO 9001 involves an independent assessment of the organisation’s quality management system.

The assessment considers whether the system meets the requirements of the standard and whether it is being applied in practice.

A certification assessment may include reviewing documented information, sampling records, speaking with relevant personnel and checking how processes are controlled.

Certification is not awarded automatically. It can only be awarded following a successful assessment against the relevant requirements.

Simply Certification provides independent and impartial certification assessment services as a UKAS-accredited certification body.

During assessment, the auditor will review whether the ISO 9001 quality management system meets the requirements of the standard and whether it is being applied in practice. Certification is only awarded following a successful independent assessment. A readiness questionnaire can help an organisation reflect on its current position, but it does not replace formal certification assessment.

What is UKAS-accredited certification?

UKAS is the UK’s National Accreditation Body.

A UKAS-accredited certification body has been assessed for competence to provide certification services within its accredited scope.

It is important to use the wording correctly:

• An organisation is certified to ISO 9001.
• A certification body is accredited by UKAS.

This distinction matters because ISO develops standards but does not certify organisations itself.

Many customers, procurement teams and supply chain partners look for certification from a UKAS-accredited certification body because it provides additional confidence in the certification process.

UKAS-accredited management system certificates can also be checked through UKAS CertCheck.

What documents may be reviewed?

The documents and records reviewed during assessment will depend on the organisation, scope and activities.

However, common examples include:

• QMS scope
• Quality policy
• Quality objectives
• Process map
• Risk and opportunity information
• Document control records
• Training and competence records
• Supplier records
• Customer feedback records
• Complaint records
• Non-conformance records
• Corrective action records
• Internal audit programme
• Internal audit reports
• Management review records

The assessment is evidence-based. This means the organisation should be able to show that processes are not only documented, but also being followed.

Readiness questions to consider

Before applying for certification, organisations may find it helpful to reflect on their current position.

Questions to consider include:

• Is the scope of the QMS clearly defined?
• Is the quality policy current and relevant?
• Are quality objectives in place and reviewed?
• Are key processes mapped or clearly described?
• Are roles and responsibilities understood?
• Are documents and records controlled?
• Are risks and opportunities considered?
• Are internal audits planned and recorded?
• Has management review been completed?
• Are corrective actions recorded and followed up?
• Is there evidence that the system is being used in practice?

These questions are not a substitute for formal assessment. They can, however, help organisations understand whether they have key evidence in place before applying.

ISO 9001 quality management system checklist

Use this checklist as a simple self-check.

You may want to review whether your organisation has:

• A defined QMS scope
• A quality policy
• Quality objectives
• A process map
• Clear responsibilities
• Controlled documents
• Organised records
• Risk and opportunity information
• Supplier monitoring records
• Training and competence records
• Customer feedback records
• Complaint records
• Non-conformance records
• Corrective action records
• Internal audit evidence
• Management review records
• Improvement actions

If several areas are unclear, the organisation may need to review its current system before applying for certification.

Frequently asked questions

What is an ISO 9001 quality management system?

An ISO 9001 quality management system is a structured framework used to manage quality. It includes processes, responsibilities, documents, records, monitoring and improvement activities.

Is a QMS the same as certification?

No. A QMS is the organisation’s own system for managing quality. Certification is the independent assessment of that system against the requirements of ISO 9001.

Does ISO certify organisations?

No. ISO develops international standards. Certification is carried out by independent certification bodies.

What does UKAS-accredited certification mean?

UKAS-accredited certification means the certification body has been assessed by UKAS for competence within its accredited scope. The organisation is certified to ISO 9001, while the certification body is accredited by UKAS.

Can a small business have a quality management system?

Yes. A QMS should be proportionate to the size and complexity of the organisation. Smaller businesses can have a simpler system, provided it is controlled, understood and evidenced.

What is the first step before applying for certification?

A useful first step is to review the organisation’s current position. This can include checking whether scope, processes, responsibilities, records, internal audits and management review evidence are in place.

Understand your current readiness position

An ISO 9001 quality management system can help an organisation manage quality, evidence key processes and support continual improvement.

Before applying for certification, it may be helpful to understand your current position.

Complete our ISO 9001 readiness questionnaire here: ISO 9001 – Self Assessment