What is ISO 9001:2015? Meaning, Clauses, Audit Explained

What the standard actually covers

ISO 9001:2015 sets out requirements for how an organisation plans, runs and improves its core operations — not what it makes, but how it controls the way it makes it. It applies regardless of sector or size. A 20-machine job-work unit and a 300-person export house are assessed against the same ten clauses, scaled to the complexity of what they do.

The current version was published by ISO in September 2015, replacing the 2008 edition. It uses Annex SL, the high-level structure shared across ISO management-system standards, which is why a QMS, an environmental system (ISO 14001) and a safety system (ISO 45001) can later sit on the same documentation skeleton. The 2015 revision also replaced the old idea of 'preventive action' with risk-based thinking — you are expected to identify risks and opportunities to your processes up front, rather than reacting after a defect occurs.

ISO 9001 does not test a sample of your output in a lab. It tests your system: whether the plant does what its own procedures say it does, and whether that system is good enough to catch a problem before a customer finds it. That distinction matters when you are preparing for an audit — the auditor is not inspecting your welds or your packing; they are checking your records.

The clause structure, briefly

ISO 9001:2015 has ten clauses. Clauses 1 to 3 are scope, references and definitions — not audited directly. The requirements an auditor actually checks against sit in clauses 4 to 10, and every one of them needs to show up as a record, not just a statement in a meeting.

• Clause 4 — Context of the organisation and scope of the QMS
• Clause 5 — Leadership, quality policy, roles and responsibilities
• Clause 6 — Risk-based planning and quality objectives
• Clause 7 — Support: competence, infrastructure, documented information
• Clause 8 — Operation: design, purchasing, production, release, non-conforming output (8.7)
• Clause 9 — Performance evaluation: internal audit (9.2), management review (9.3)
• Clause 10 — Corrective action and continual improvement (10.2)

Who in India actually needs this certificate

ISO 9001 is not a legal requirement, but it has become a practical one. Government tenders and GeM listings frequently name it as a qualifying or scoring criterion. OEM and PSU vendor registration forms ask for it before they will even open your rate quote. Export buyers in engineering, pharma packaging and auto components routinely make it a condition of the first purchase order, not an afterthought for later.

The common thread is any organisation whose customer needs proof that quality is controlled, not assumed. That covers manufacturing units of every size, job-work and fabrication shops, pharma and FMCG packaging units, and a growing number of service businesses — logistics operators, facility management firms, schools and hospitals — where the 'product' is a service delivered consistently rather than a part shipped in a crate.

If your sales team is regularly asked 'do you have ISO 9001' on a tender portal, a buyer questionnaire or a customer audit checklist, that is the signal to start the process rather than wait for a lost bid to force the decision.

Who issues the certificate, and who does not

PraxisQ Consulting works with you to build and document the QMS — the policy, the procedures, the risk register, the internal audit — but PraxisQ does not audit and does not issue the certificate. That is done by an independent certification body, and the certificate only carries weight if that body is accredited by an IAF member: NABCB in India, or UKAS, JAS-ANZ and ANAB internationally.

This separation is the whole point of third-party certification. The body that helped you write your quality manual cannot be the body that signs off on it — that would be auditing your own work. A consultant's job ends where the certification body's audit begins.

When you are choosing a certification body, check its NABCB or equivalent IAF accreditation on the accreditation body's public register before you sign anything. An unaccredited certificate will not be recognised by a PSU buyer, an OEM vendor panel or most export customers, no matter how official it looks.

How the certification audit actually runs

Certification is a two-stage audit, done on-site by the certification body you choose. Stage 1 is a document and readiness review — the auditor checks that your quality policy, scope, objectives and procedures exist and cover the clauses, and flags any gap before committing audit time to stage 2. Stage 2 is the full on-site audit: interviews with staff on the shop floor, sampling of records, and verification that what the documents say actually happens at the machine, the store and the dispatch bay.

Audit duration is set by headcount and site count, following IAF guidance that certification bodies use to quote man-days. A micro unit under 25 staff typically needs around one audit day; a small unit of 25-100 staff usually needs one and a half to two days; a medium, multi-site operation of 100-300 staff can run to three or four days including travel between sites.

Design and development control (clause 8.3) adds scope and time if your unit designs products rather than only building to a customer's drawing. Where design is excluded from scope — common for pure job-work and contract manufacturing — the audit is shorter and the documentation lighter.

The records an auditor actually asks to see

An ISO 9001 audit runs on paper trails, not conversation. The auditor will ask for a specific record against each clause and expects to see dates, names and closure, not a blank template. Missing or incomplete records are the single most common source of audit findings in Indian MSMEs applying for the first time.

• Quality policy and measurable quality objectives, reviewed on a set frequency
• Documented procedures and work instructions for key processes
• Training and competence records for operators and inspectors
• Approved supplier list with supplier evaluation scores
• Calibration records for every measuring instrument in use
• Internal audit report covering all clauses within the certification cycle
• Management review minutes with actions and owners
• Corrective action log with root cause and closure evidence
• Customer complaint and feedback records

What gets a certificate rejected or delayed

Certification bodies classify findings as major or minor nonconformities, and only a major blocks the certificate outright. The most common majors in a first-time ISO 9001 audit are straightforward: no internal audit has actually been carried out before the certification audit, no management review meeting has happened, or quality objectives exist on paper but nobody can show how they are measured.

Other recurring majors: calibration due dates that have passed with no record of recalibration, a corrective action log where entries are opened but never closed, and a quality policy that staff on the floor cannot explain in their own words when the auditor asks. Document control gaps — an outdated work instruction still pinned at the machine while a revised version sits in a folder — are a close second.

A major nonconformity does not end the process, but it does cost time. The certification body sets a fixed correction window, commonly around 90 days, during which you submit evidence that the root cause has been fixed, not just the symptom. Only after that evidence is reviewed and accepted does the certificate get issued. This is exactly why document maturity before the audit date is the biggest single driver of whether you certify in 4 weeks or closer to 8.

Validity, surveillance and renewal

Once issued, an ISO 9001:2015 certificate is valid for three years. It is not a one-time event — the certification body conducts a surveillance audit in year one and again in year two, each checking a sample of clauses rather than the full system, to confirm the QMS is still being run and not just filed away after the initial audit.

Before the three-year certificate expires, a recertification audit is required — in scope and depth close to the original audit — to renew the certificate for another three-year cycle. Surveillance audit man-days are shorter than the initial certification audit, but they are not optional: missing a surveillance window can result in the certificate being suspended or withdrawn.

Budgeting for this cycle matters as much as budgeting for the first certificate. Costs for surveillance and recertification audits sit within the all-inclusive range on our cost page, and factoring them in early avoids the common mistake of treating year one as the finish line when it is really the start of a three-year commitment.