How do we get ISO 9001?

Prospective client to me: 'What do we have to do to get ISO 9001?'
Me to prospective client: 'Make sure your business management system meets all (not just some) of the requirements in ISO 9001 - nothing more, but nothing less'.

So, what are these 'requirements'?

Most of the requirements are just sheer good business sense. For example, there are requirements that you must know what your customers want, and deliver it to them. You must make sure your people are competent and that they have the right skills, training and experience.

You need processes suitable for producing and delivering your products or services. There are also requirements for monitoring whether customers are satisfied, following up problems and fixing them, and so on.

Can you see anything in what I've just written that a well managed business wouldn't need?

The requirements are organised into 4 broad groups:

1. Management responsibility - requirements for planning, having measurable objectives, review and general requirements, including for system documentation
2. Resource management - requirements for how you organise your people, premises, etc
3. Product realisation - dreadful term! Requirements for how you 'make real' your products (or services) - ie, how you do what you do, whether that is making widgets or providing services
4. Checking - requirements for checking how you are performing, assessing performance, identifying and fixing various problems, and improving your system.

It's also important to understand that an 'ISO 9001 system' is a documented one - which means you must have certain things written down. It does NOT mean you need reams and reams of manuals and incomprehensible jargon. Your system also must be auditable - ie, capable of being audited. And these two things are linked: you see, if you don't have anything written down, no one can audit you, because they can't read what's supposed to happen.

A related question: why do ISO 9001? I consider this is a very important question, in fact probably the most important question you should answer before you go down the 'ISO road'. You must have at least one good reason for doing it. And 'my biggest client is insisting' is not the best answer. Yes, that may be true, but you need to find at least one internal driver as well.

Some of the most common reasons are:

• Greater client assurance - your clients may insist, or you decide it would enhance your client reputation or business standing, or it may be a contract condition
• To match your internal system against a widely known and internationally accepted model. It doesn't matter whether a company is in Australia, China, the USA, Britain or Europe.. if it has ISO 9001, you know it meets the rigorous requirements of the Standard
• To gain benefits such as improved processes, greater control & discipline, reduced operational costs with fewer errors or increased sales
• To provide a platform for further growth.

If your current answer is 'because we want the certificate on the wall', please stop now. You will have enormous trouble with the project until you find at least one better reason than that.