ISO 9001 — Quality Management Systems
ISO 9001 consulting that fits how your business actually works.
Why this matters
ISO 9001 is the most-implemented management system standard worldwide. For US companies, certification is often a prerequisite to bid on customer contracts, qualify for OEM supplier programs, or pursue federal and state government opportunities. Done well, it reduces defects, lowers insurance premiums, and creates the documented operational backbone that lets the business scale without losing consistency.
Done poorly, ISO 9001 becomes a binder on a shelf that nobody opens until the next surveillance audit. The difference is whether the system is designed around how your business actually runs or grafted onto it from a generic template. We do the former.
Our ISO 9001 engagements start with what you already do well. We document the operating practices that are working, redesign the ones that aren't, and build the audit trail in parallel. The certification body sees a coherent system. Your team sees something they recognize. Six months in, the system is still being used — that's the only outcome that matters.
What's included
The full ISO 9001 engagement covers everything from initial assessment through certification and ongoing maintenance. Components are also available standalone — gap analysis only, internal audit only, certification body liaison only — when that fits your situation better.
-
Gap analysis & scope definition
A two-to-four-week structured review of your current operating practices against ISO 9001:2015. You finish with a prioritized list of what exists, what's missing, what's overbuilt, and an effort-calibrated roadmap.
-
Quality management system documentation
Quality manual, policy, scope statement, procedures, work instructions, and forms — designed around how your business actually runs. Lean, readable, and built to be used by the team, not just shown to the auditor.
-
Process design & risk-based thinking
Process maps for every core business activity. Risk and opportunity register treated as a real management tool, not compliance theater. Action plans for high-priority items, integrated with your existing operational rhythm.
-
Internal audit & management review
First internal audit conducted by us, with auditor-grade documentation. Management review meeting facilitated and recorded. Both deliver an action register that closes nonconformities before the certification body sees them.
-
Stage 1 & Stage 2 audit support
We prepare your team, attend both audits in person or via video, and address any findings before they become non-conformities. Our clients pass Stage 2 the first time as a matter of routine.
-
Certification body liaison
We work with your chosen ANAB-, IAS-, or A2LA-accredited certification body on scope, scheduling, and post-audit corrective actions. If you haven't selected one yet, we'll guide that decision with no commercial relationship to influence it.
-
Ongoing support after certification
Surveillance audit prep, annual internal audit cycle, document updates as operations evolve, employee training refreshers. Most clients keep us on a quiet retainer because the cost of letting the system drift is much higher than the cost of light-touch maintenance.
How we work
Engagement length varies with your starting point and target complexity. The fastest small-company engagements complete in roughly four months; the most complex multi-site multi-standard programs run twelve to eighteen. The four phases below are constant; the duration of each scales with your scope.
- 01
Scope & gap analysis (2–4 weeks)
We map your current state against ISO 9001:2015. Output: a prioritized roadmap with timeline, effort estimate, and a clear go/no-go decision point. Fixed scope, fixed price.
- 02
Build & implement (3–5 months)
Design and document the QMS around your actual operations. Train your team on new procedures. Conduct first internal audit. Run management review. Close findings before any certification body sees them.
- 03
Certify (1–2 months)
Stage 1 audit (documentation review). Address findings. Stage 2 audit (operational review). Address findings. Receive your ISO 9001 certificate.
- 04
Sustain (ongoing)
Annual internal audits, surveillance audit prep, document updates as your business evolves, recertification at year three. Light-touch retainer, heavy-touch when you actually need us.
Where this fits in the US compliance landscape
ISO 9001 sits at the foundation of a family of related quality standards. Many clients pursue ISO 9001 either alone or as the base layer of an integrated system that includes one or more of these crossover frameworks.
AS9100 — Aerospace QMS
Builds on ISO 9001 with aerospace-specific requirements. If you're a tier-1 or tier-2 aerospace supplier, AS9100 is what your customers actually require. We scope integrated AS9100 + ISO 9001 engagements regularly.
IATF 16949 — Automotive QMS
The automotive supply chain's QMS standard. Builds on ISO 9001 with TS-specific requirements for tier-1, tier-2, and tier-3 auto suppliers. Required by every major OEM.
ISO 13485 — Medical Devices QMS
For medical device manufacturers, ISO 13485 is the QMS standard rather than ISO 9001. Aligned with the FDA QMSR (21 CFR Part 820), which now incorporates ISO 13485, and MDSAP. We do this work too — see the ISO 13485 service page.
TL 9000 — Telecom QMS
The telecommunications industry's QMS extension. Less commonly required than AS9100 or IATF 16949 but still mandatory for some telecom customers and equipment suppliers.
ITAR / EAR controls
If you handle export-controlled goods, your QMS needs to incorporate ITAR or EAR controls into design, production, and shipment workflows. We integrate the controls into the QMS design rather than running them in parallel.
FAR / DFARS quality clauses
Federal acquisition regulations include quality requirements that often reference ISO 9001 or AS9100. We design QMS to satisfy the relevant FAR / DFARS clauses your customers cite in contract.
Who we serve
ISO 9001 applies to organizations of any size, sector, or activity. The standard scales — a 15-person consulting firm and a 1,500-person manufacturer use the same framework with very different documentation depth. Our active engagements span these sectors:
- Manufacturers — machined parts, metal fabrication, plastics, electronics, food
- Aerospace tier-1 and tier-2 suppliers
- Automotive tier-2 and tier-3 suppliers
- Government and defense contractors (FAR, DFARS, agency quality clauses)
- Engineering and construction firms
- Professional services firms pursuing certification for procurement eligibility
- Logistics and 3PL operators
- Food and beverage manufacturers (often paired with HACCP or SQF)
Frequently asked
Common questions about ISO 9001
How long does ISO 9001 certification take for a small company starting from scratch?
For a US company with no prior management-system experience, ISO 9001 typically takes four to seven months from kickoff to Stage 2 certification. The variables are: how clearly your current operations are documented, how engaged your team is in implementation, and whether your certification body has audit slots available. We give you a calibrated timeline after the gap analysis — not before.
We're a small services firm (under 25 people). Is ISO 9001 even appropriate for us?
Yes. ISO 9001 was redesigned in 2015 specifically to work for service businesses and small organizations. The standard scales to your size. A 15-person consulting firm can have a perfectly functional ISO 9001-certified QMS that fits on roughly 20 pages of documentation. The key is designing for your scale, not adopting a generic 200-person manufacturing template.
How much should we budget for ISO 9001 consulting?
Engagement scope is the dominant variable. A standalone gap analysis for a small organization is typically in the low five figures. Full implementation from scratch — documentation work, internal audit, certification body liaison — ranges considerably higher and depends on your size, complexity, and how much of the work your team will own. The certification body charges its own fees, typically $3,000 to $15,000 depending on scope and audit days. We don't publish a rate card because the rate-card framing misleads more than it informs. Reach out and we'll walk through honest scope.
We have a heavy ERP system. Can ISO 9001 be built into it instead of as separate documentation?
Yes, and increasingly we recommend it. Modern QMS design treats your ERP, PLM, and document management systems as the operational backbone. The 'ISO 9001 documentation' is largely structured outputs from those systems rather than separate documents maintained in parallel. We design the QMS to work with your existing infrastructure rather than around it.
Can we transition from a different framework, or recover from a failed prior implementation?
Yes. About a third of our work is companies that either hold a different framework certification (AS9100, IATF 16949, ISO 13485) and need to add or transition to ISO 9001, or attempted ISO 9001 with another consultant and need to recover. We bring in a fresh assessment, identify what's salvageable, and design the path forward rather than ripping out everything and starting over.
What's the difference between ISO 9001 and SOC 2?
ISO 9001 is a quality management standard — it governs how you produce consistent, customer-satisfying outputs. SOC 2 is a security and trust framework specific to service organizations handling customer data. They cover entirely different domains. Many clients pursue both because their enterprise customers require both. If you're going down that path we'll scope an integrated engagement that shares evidence and audit coverage where the frameworks overlap.
Do you guarantee we'll pass the audit?
No legitimate consultant will, and you should be skeptical of any who do. The certification body is independent of the consultant by design — that's what makes the certificate worth anything. What we will guarantee is preparation: we will not put you in front of an auditor until your system can defend itself. Our clients pass Stage 2 the first time as a matter of routine because we don't take them to the audit before they're ready.
Other standards we cover
Related management systems
Ready to scope your ISO 9001 engagement?
Send a short note describing your current state, your target, and your timeline. We respond within one business day with clarifying questions and a path to a no-pressure scope call.
Last reviewed May 2026