ISO 9001 is the international standard for a quality management system. It does not specify what your product must be like; it specifies how you manage the processes that produce it, so that you consistently meet customer and regulatory requirements and improve over time.
In South Africa it is most often pursued because a customer requires it — large corporates, government contracts and export markets frequently make certification a condition of supply. That is a legitimate reason, and it is worth understanding what you are actually committing to.
Business Requirements at a Glance
Certification requires a documented, operating quality management system meeting the standard’s clauses.
- Defined scope of the quality management system
- Understanding of the organisation’s context and of interested parties’ requirements
- Demonstrated leadership commitment, with a quality policy and assigned responsibilities
- Risk-based thinking — risks and opportunities identified and addressed
- Defined processes with inputs, outputs, sequence and criteria
- Documented information maintained and controlled as the standard requires
- Competence, awareness and training of people affecting quality
- Monitoring, measurement, internal audit and management review
- A process for nonconformity, corrective action and continual improvement
- Certification by an accredited certification body, following a two-stage audit
Registration and Legal Requirements
The distinction that matters most is between the standard and the certificate. Implementing ISO 9001 means building a system that works. Certification means an external body audits it and issues a certificate. You can do the first without the second, and organisations that do only the second have bought paper.
Accreditation of the certification body is the thing to check. A certificate is only worth what the issuing body’s accreditation makes it worth. In South Africa, certification bodies are accredited by the South African National Accreditation System (SANAS). Customers who require ISO 9001 generally require certification by an accredited body, and an unaccredited certificate is frequently rejected.
Verify a certification body’s accreditation with SANAS before contracting. Unaccredited certification is sold in South Africa and it is cheaper, which is exactly why it exists.
Certification bodies may not consult and certify. A body that designs your system cannot independently audit it, and accredited bodies are prohibited from doing both. If a provider offers to build your system and certify it, that is a warning sign.
The audit is in two stages — a readiness review of documentation, then a full assessment of implementation — followed by surveillance audits during the certification cycle and a recertification audit at the end of it.
Documents and Ownership Information Required
What an auditor will expect to see.
- Quality policy and quality objectives
- Documented scope of the quality management system
- Process maps or descriptions with defined inputs, outputs and criteria
- Risk and opportunity assessments
- Records of competence, training and awareness
- Documented procedures where the organisation determines they are needed
- Records of monitoring and measurement, including customer satisfaction
- Internal audit programme, reports and records of auditor competence
- Management review minutes and outputs
- Nonconformity records with root cause analysis and corrective actions
- Control of externally provided processes, products and services — supplier management
- Calibration and maintenance records for measuring equipment, where applicable
Tax, Licence and Compliance Requirements
The most common failure is a system that exists on paper only. Auditors test whether the documented processes are what actually happens. A manual written by a consultant and never used produces findings immediately, because staff cannot describe processes they have never followed.
That is why implementation genuinely takes months in most organisations. The system has to run long enough to generate records — internal audits, management reviews, corrective actions — before an auditor can assess it.
Certification is a cycle, not an event. Surveillance audits occur during the certification period, and recertification at the end of it. Fees are payable throughout. Organisations that treat certification as a once-off purchase are surprised by the ongoing cost and effort.
Related standards follow the same structure and are frequently pursued together: ISO 45001 for occupational health and safety, ISO 14001 for environmental management, and ISO 27001 for information security. Because they share a common framework, integrating them is considerably less work than certifying each separately.
ISO 9001 does not replace legal compliance. A certified quality management system does not discharge obligations under the Occupational Health and Safety Act, the Consumer Protection Act or any sector regulation. It is a management framework, not a licence.
Process, Deadlines and Ongoing Obligations
Be clear about why you are doing it. If a customer requires certification, the scope should cover what that customer buys. If you want the operational benefit, implement properly and certify when the system is genuinely running.
Budget for the full cycle — implementation effort, certification audit, surveillance audits and recertification — and for the internal time, which is usually the larger cost and the one most underestimated.
- Verify the certification body’s accreditation with SANAS before contracting
- Do not use a provider that offers to both build and certify your system
- Define the scope to cover what your customers actually require
- Implement genuinely — auditors test practice against documentation
- Allow months for the system to generate records before the audit
- Budget for surveillance and recertification, not just the first audit
- Consider integrating ISO 45001, 14001 or 27001 if you need more than one
- Remember that certification does not replace legal compliance
Frequently Asked Questions
Is ISO 9001 compulsory?
No. It is voluntary, but customers — particularly large corporates, government and export buyers — frequently require it as a condition of supply.
How do I check a certification body is legitimate?
Certification bodies in South Africa are accredited by SANAS. Verify accreditation before contracting, because unaccredited certification is sold and is frequently rejected by customers.
Can the same company help me implement and certify?
No. Accredited certification bodies are prohibited from consulting on and certifying the same system. An offer to do both is a warning sign.
How long does it take?
Usually months. The system must run long enough to generate internal audits, management reviews and corrective action records before it can be assessed.
Standard requirements, certification processes and accreditation are set by the International Organization for Standardization, certification bodies and SANAS, and are revised. Confirm current requirements with an accredited certification body and verify its accreditation with SANAS.