ISO 9001 built on how you work
A quality system mapped onto your real process flow, documented to the 2026 edition, and run by your team before an assessor sees it.
- Edition
- ISO 9001:2026, published 16 September 2026
- Gap analysis
- One to two days on site
- Documentation
- Within a week of the gap analysis
- Before the certification audit
- At least one internal audit and one management review
- Pace
- You and your certification body
ISO 9001 certification means an accredited certification body has audited your quality management system against the standard. Your documentation (manual, procedures, forms): within a week of the gap analysis. Then your team runs it. Before the certification audit, that means at least one internal audit and one management review, with the records to show them. You and your certification body set the pace. New systems are built to ISO 9001:2026.
- 01 Enquiry
- 02 Gap analysis
- 03 Plan
- 04 Build
- 05 Embed
- 06 Internal audit
- 07 Close out
- 08 Management review
- 09 Handover
ISO 9001 built on how you work sits at step 4 of the readiness cycle. You receive the documented management system.
Why systems fail at Stage 2
Almost nobody fails Stage 2 because a document was missing. They fail because the system has never been run.
The most common reason is the simplest: no completed internal audit cycle and no management review before the audit. An assessor cannot verify a system that has never checked itself. The second is clause 9.1 with nothing in it, because process performance was never measured, so there is no data to review and the review minutes say the system is working with nothing behind the statement.
After that it is corrective actions closed with a correction and no root cause, outsourced processes inside the scope but uncontrolled under 8.4, and a scope or an exclusion the operation does not actually support.
All five need attention before the audit date. That is why the implementation phase is the real cost of certification and the documentation phase is not. Records accumulate at the speed the business runs, and no consultant can compress that, because a record cannot be backdated.
What we build with you
The system is built on your process, in your language, by the people who run it. A procedure written in our office describes our assumptions.
| Element | What it is | Who writes it |
|---|---|---|
| Scope and context | What the certificate will cover, the issues and interested parties behind it, and the exclusions your operation can actually defend. | Us, with your management |
| Process map | Your operation as a sequence of processes with inputs, outputs, owners and the measures that show they work. | Workshop with process owners |
| Risks and opportunities | Two registers under the 2026 edition, with opportunities carrying an owner and an outcome rather than being an afterthought. | Us, reviewed by you |
| Documented information | Only what the standard requires plus what the business needs. We do not ship a manual you will never open. | Us, approved by you |
| Records and measurement | The forms and registers filled in by your people during normal work. | Your team |
| Internal audit and review | A full cycle across the scope, run as an external assessment, followed by a real management review. | Us, then handed over |
The system at handover
The gap report
Clause by clause against what already exists, marked met, partial or absent, with effort against each gap.
The implementation plan
Phases, owners on your side and dates. The plan is what turns a gap list into a project somebody is accountable for.
The documented system
Policy, process map, procedures, forms and registers, all version controlled inside your own document control.
A live record set
Real records produced by your people in normal work, which is what an assessor samples.
The internal audit report and review minutes
The two documents Stage 1 checks for, with findings raised, actioned and verified before anybody external arrives.
A readiness pack
Scope, sites, shifts, process list and the document index, assembled the way an assessor asks for it.
The sequence
Five phases. You can stop at the end of any of them and keep what you have.
- 01
Gap analysis
One to two days on site reading the operation against the standard. Ends with the gap report and a plan.
- 02
Documentation
Scope, policy, objectives, process interactions and the documented information the standard requires.
- 03
Implementation
Your team runs the system and the records accumulate. We are present for the parts that stall rather than sitting on site.
- 04
Internal audit and management review
Full scope audited, findings raised, corrective actions closed, review held and minuted.
- 05
Handover
You approach a certification body of your own choosing, with the readiness pack in hand.
A typical build, from no system
A trading and distribution company in Riyadh has a buyer whose next tender asks for ISO 9001. There is no system. The business runs on experienced people and email.
The gap analysis shows the work is real but unwritten. Orders get checked and complaints get resolved, but almost nothing leaves a record an assessor could sample.
We map the process chain from order to delivery, then write each procedure with the people who do that step. The registers are the ones they will actually use: supplier approval, customer complaints, nonconforming deliveries and corrective actions.
The team runs the system and the records build up in normal work. The internal audit then covers the whole scope, findings are closed and the management review is held. The company approaches a certification body of its choosing with a system that has history behind it.
Why you are doing this
The reason you are certifying changes the sequence more than the industry does.
A buyer or a tender demands a certificate
Plan the internal audit and management review before the certification audit. The tender deadline has to fit the pace you and your certification body set.
- Check first whether the tender names accreditation, not just certification
- Scope narrowly to the site and activity actually being bid
- Start the records clock immediately, because that is the long pole
You were audited and found wanting
You already have findings written by somebody else. That is a better starting point than a blank page, and the gap analysis should begin from their report rather than pretend it does not exist.
- Their findings map straight onto clauses in the gap report
- Fix the causes, not the instances, or the next audit finds the same thing
- Evidence of closure matters more than speed of closure
Nobody knows who owns what any more
This is the case where ISO 9001 pays for itself outside the certificate. The process map and the ownership it forces are worth more than the framed document, and the certificate is a by-product.
- Start with the process map, not the procedures
- Name an owner per process before writing anything
- Measure three things well rather than twenty badly
Quality plus environment or safety
Build them as one system from the start. Retrofitting an integrated system onto three separate document sets costs more than building it once.
- Shared document control, audit programme, review and corrective action
- One internal audit covering all applicable standards per process
- See the integrated management system page
Fair questions
Is ISO 9001 mandatory in Saudi Arabia?
No. It is voluntary as a standard and effectively mandatory as a commercial requirement, because buyers, tenders and in some sectors other authorities' licensing conditions ask for it.
Which edition should we build to?
ISO 9001:2026, published on 16 September 2026. There is no reason to certify against a superseded edition now, and doing so buys you a transition project you did not need.
Does an accredited certificate matter, or will any certificate do?
It matters, and the difference is visible. A certificate from a body accredited by the Saudi Accreditation Center or another IAF signatory carries an accreditation mark and is recognised through that chain. One from an unaccredited body is not, and buyers increasingly check the accreditation body's own list rather than the certificate.
Can you guarantee we pass?
No, and a guarantee from a consultant would be worth nothing, because the decision is taken by the certification body after their assessment and not by the auditor in the room. What is controllable is readiness, and readiness is checkable before anybody arrives.
Will you recommend a certification body?
No. You choose, and you can verify any candidate against their accreditation body's published list.
How much of our time does this take?
More than most consultancies admit. Process owners give up roughly half a day each during the mapping phase, and implementation needs somebody internal who owns the system. If nobody can be spared, the certificate will be real and the system will not.
Around this
Gap analysis
The cheapest first step, and the one that tells you whether the rest is worth doing.
Read moreServiceInternal audit
The audit that has to happen before Stage 2, run the way an external auditor runs it.
Read moreTransitionISO 9001:2026 transition
Already certified to 2015? This is the shorter piece of work.
Read moreServiceIntegrated management system
Quality with environment and safety as one document set.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Start with the gap analysis
One to two days on site tells you what is actually missing and what it takes to close. You keep the report whether or not we do the rest.