Guide · ISO 9001 certification
How to get ISO 9001 certification in Australia, as a small business.
ISO 9001 certification is two jobs. First you build and run a quality management system that meets ISO 9001:2015. Then a JAS-ANZ accredited certification body audits it and issues the certificate. This guide walks through both, in order, for an Australian business with 1 to 25 people that has just been asked for ISO 9001 by a tender or a head contractor. PolicySystem does the first job. We are not a certification body and never issue certificates.
The nine steps
- Decide the scope and the standards. Which parts of the business, which sites, which states. Most tenders that ask for ISO 9001 also ask for 45001 within a year, and both share the same ten-clause structure, so decide now whether you build an integrated system. Add 14001 if environment is in scope. One integrated audit is cheaper than three.
- Build the documented system. A quality policy signed by the most senior person. Quality objectives you can measure. Procedures for how you win, deliver and check work, handle nonconformities, control documents, train people, audit yourself and review the system. All under document control. In PolicySystem this is the AI onboarding: describe the business and approve the drafts.
- Run it for real. Log nonconformities and customer complaints. Raise corrective actions and close them. Put people and training on the register. Keep evidence: checklists, sign-offs, supplier approvals. Three months of honest entries beats three years of perfect templates. The auditor will sample from here.
- Internal audit. Clause 9.2. Audit your own system against every clause, record findings, raise CAPA. The internal audit checklist walks through it. The AI internal auditor in PolicySystem does the first pass and scores each clause with the evidence it found and the form you need to file.
- Management review. Clause 9.3. The owner or director reviews the system using the numbers from the registers and records decisions and actions. Management review minutes are one of the first records a certification body asks for.
- Choose a JAS-ANZ accredited certification body. Get two or three quotes. They price on headcount, sites and standards. Check accreditation on the JAS-ANZ register. Ask about auditor experience in your industry and how they handle small businesses. Book Stage 1.
- Stage 1: documentation review. The auditor reads the system and checks readiness. Expect a list of things to tighten. Fix them, raise CAPA for each so there is a trail, and confirm the Stage 2 date.
- Stage 2: certification audit. On site or remote. The auditor samples records, follows a job from quote to delivery, and talks to the people doing the work. Minor findings get a corrective action plan. Major findings must be closed before the certificate. Then it is issued, usually within a few weeks.
- Keep it alive. Annual surveillance, three-yearly recertification. The registers, internal audit and management review keep running. Because the system is live rather than a folder, the second year is easier than the first.
What ISO 9001:2015 actually requires
The standard has ten clauses. The first three are scope, references and terms. The auditable content is clauses 4 to 10. Clause 4 is the context of the organisation, its interested parties and the scope of the system. Clause 5 is leadership: a quality policy and clear responsibilities. Clause 6 is planning: risks and opportunities, quality objectives. Clause 7 is support: people, infrastructure, competence, communication and documented information. Clause 8 is operation: how you plan, deliver and control the work, manage suppliers and handle nonconforming outputs. Clause 9 is performance evaluation: monitoring, customer satisfaction, internal audit and management review. Clause 10 is improvement: nonconformity and corrective action. Every clause maps to a policy or register in PolicySystem, so the system has no gaps for Stage 1 to find.
Choosing between a consultant, a template and software
| Option | Typical cost | What you get | The catch |
|---|---|---|---|
| Consultant | $15,000 to $40,000 plus the certification body | Documents written for you, sometimes a pre-assessment | Goes stale when they leave; you still run the registers somewhere |
| Template pack | A few hundred dollars | Word files to fill in | The writing, the control and the registers are all still your job |
| PolicySystem | From $49.00/mo inc GST, Starter $86.90/mo | AI-written controlled documents plus live registers, internal audit and review | The certification body is still a separate bill |
Mistakes that delay certification
- Booking Stage 1 before the registers have any history. The auditor has nothing to sample.
- An internal audit done by the same person who wrote every procedure with no findings raised.
- Management review minutes that say "no issues" with no numbers.
- Quality objectives that cannot be measured, or that nobody has measured.
- Three versions of the same procedure on a shared drive.
- Claiming certification on a tender before the certificate exists. Evaluators check the register.
ISO 9001 alone, or 9001 and 45001 together
If the tender only names 9001, you can certify 9001 alone. Most small businesses in trades, cleaning and services are asked for both within a short time, and the two standards share their structure, so building an integrated system once is cheaper than building twice. Certification bodies quote an integrated audit at less than two separate audits. See ISO 9001 and 45001 for tenders and the ISO certification cost breakdown.
Where to next
ISO 9001 · ISO 45001 · ISO 45001 checklist · Internal audit checklist · Management review · ISO certification cost
Common questions.
Three to six months from a standing start is realistic. Writing the documents is the fast part (an afternoon here). The certification body needs to see the system running: records in the registers, at least one internal audit and one management review. Then Stage 1 and Stage 2 are usually four to eight weeks apart depending on the body's calendar.
Three separate bills. Software or a consultant to build and run the system. The certification body's fees for Stage 1, Stage 2 and annual surveillance, which they quote on headcount and sites and which you pay them directly. Your own time. Our ISO certification cost page breaks each one down. We are not the certification body and do not publish their fees.
JAS-ANZ (the Joint Accreditation System of Australia and New Zealand) accredits certification bodies. A certificate from a JAS-ANZ accredited body is what Australian tenders and head contractors recognise. A certificate from an unaccredited issuer is often rejected. Check the body on the JAS-ANZ register before you sign.
Yes. Small businesses do it every month. The standard is written to be understood by the people running the business. A consultant can be useful for a pre-assessment before Stage 2, but paying one to write the documents is what software has replaced.
Stage 1 is a documentation review: the auditor checks your policies, procedures, scope and records exist and cover the clauses, and tells you what to fix before Stage 2. Stage 2 is the certification audit, usually on site, where they sample records and interview people to confirm the system actually runs. Findings are graded minor or major. Majors must be closed before the certificate is issued.
Surveillance audits every year and a recertification audit every three years. You keep running the registers, doing an internal audit and a management review each year, and closing corrective actions. The certificate is a licence to keep going, not a finish line.