What Is ISO 9001? A South African Manufacturer’s Guide

ISO 9001 · Starting point

What is ISO 9001, and do we need it?

A customer has asked your site for ISO 9001. Here is what it is, why your FSSC 22000 or BRCGS certificate does not cover it, what clauses 4 to 10 actually require, what documents you really need, what certification involves, and what it costs in South Africa.

By Mthokozisi Nkosi, Food Scientist & Lead AuditorUpdated 23 September 202616 min read

ISO 9001 is the international standard for a quality management system. It is not a food safety standard. If a retailer or an export customer has just asked your site for ISO 9001, they are not asking whether your product is safe. They are asking whether you can consistently deliver what you promised, in the right pack, at the right fill, on the right day, and prove it. Certification is now to ISO 9001:2026, the sixth edition, published on 16 September 2026. Getting there means writing down how you run the business, running it that way for a few months, and passing a two-stage audit by an independent certification body.

The short answer. ISO 9001 is the world’s quality management system standard. It sets out what a management system needs, across context, leadership, planning, support, operation, performance evaluation and improvement, so that a customer gets what was agreed, every time. It is a quality standard, not a food safety standard, and it sits beside FSSC 22000, BRCGS or ISO 22000 rather than replacing them.

New certifications are to ISO 9001:2026, the sixth edition. In practice it involves defining your scope and processes, setting a policy and objectives, building risk and opportunity registers, controlling your operations and suppliers, auditing yourself, reviewing at top management level, then a stage 1 and a stage 2 audit by a certification body, followed by surveillance audits across a three year cycle.

Asked for ISO 9001 and starting from nothing? The ISO 9001:2026 Document Templates Toolkit gives you 202 editable documents covering clauses 4 to 10, so your team implements instead of authoring from a blank page.

Browse the ISO 9001:2026 toolkit Start with the Introduction course

What is ISO 9001, in plain terms?

ISO 9001 is published by the International Organization for Standardization. It describes the requirements for a quality management system, which is the set of processes, records and decisions by which an organisation makes sure it delivers what it said it would.

It does not tell you how to make your product. It never mentions your machinery, your recipe or your line speed. What it does is require that you know what your customers and other interested parties need, that you have decided how your processes work and what “acceptable” looks like in writing, that you check whether you achieved it, and that you do something when you did not.

It is the most widely held management system certificate in the world. In South Africa you will find it on packaging converters, contract manufacturers, engineering firms, labs and food manufacturers who supply retail or export. That is exactly why a customer asks for it: one certificate answers a dozen questions on their supplier questionnaire.

Your food safety certificate does not cover this

This is the point most sites miss, and it is the reason a site with a clean FSSC 22000 certificate still loses a listing.

A food safety certificate says the product is safe. It is built around hazards: microbiological, chemical, physical, allergenic. It says nothing about the wrong sleeve on the pack, the low fill, the late delivery, or the complaint that has been sitting open for three weeks because nobody owns it. None of those makes anyone ill. All of them lose customers.

ISO 9001 is the standard that answers those. Here is the mapping, using the complaints South African manufacturers actually get.

The customer complaint	Why FSSC 22000 or BRCGS does not answer it	The ISO 9001 clause that does
“You shipped 4 800 units in the old sleeve. The promotion was on the new artwork.”	The product was safe and correctly labelled for allergens. There is no hazard here	8.5.1 control of production. Controlled conditions include the availability of the correct documented information defining the characteristics of the product, and the use of suitable infrastructure and monitoring. An artwork version that is not controlled at the line is an 8.5.1 failure
“We logged a complaint on 3 August. It is 24 August and nobody has come back to us.”	A food safety scheme will want complaints reviewed. It will not grade you on the 21 days it took to close one that raised no safety issue	10.2 nonconformity and corrective action. React to the nonconformity, evaluate whether the cause could recur, act, review effectiveness. The 2026 edition adds a note that customer complaints can be a source of nonconformities
“Who released that batch? It was 2 grams under declared weight on every pack.”	Underfill is a legal metrology and quality failure, not a food safety hazard	8.6 release of products. Release does not proceed until the planned arrangements have been satisfactorily completed, with traceability to the person authorising release. Plus 8.7 control of nonconforming outputs for what you do with the stock
“Our supplier questionnaire requires ISO 9001. You have ticked N/A three years running.”	No food safety certificate substitutes for it, because the buyer is asking a different question	Certification itself. The questionnaire wants a certificate number and an accredited certification body, not an explanation of why your HACCP plan is equivalent

None of this makes your food safety certificate less valuable. It makes it incomplete for a buyer who is judging you on service and consistency as well as safety. If you are deciding whether you need both, we have written that up separately in ISO 9001 vs FSSC 22000, do we need both.

What is actually in ISO 9001? Clauses 4 to 10 in plain English

Clauses 1 to 3 are scope, normative references and terms. The requirements you get audited against start at clause 4. Here is each one in a paragraph, in the order the standard uses.

Clause 4: Context of the organization

Work out what affects your ability to deliver. Internal issues such as an ageing extruder or a skills gap, external issues such as load shedding, the rand, or a customer consolidating its supplier base. Clause 4.1 also requires you to determine whether climate change is a relevant issue, which came in with Amendment 1:2024. Then list your interested parties, what they require, and in the 2026 edition, which of those requirements you will address through the quality management system. Finally you define your scope, in writing, and identify your processes.

Clause 5: Leadership

Top management has to be visibly accountable for the system, not delegate it to a quality officer and sign the minutes. The 2026 edition lists twelve commitments, including promoting quality culture and ethical behaviour, and promoting both risk-based and opportunity-based thinking. You need a quality policy that reflects your context and is actually implemented, and responsibilities and authorities assigned and communicated.

Clause 6: Planning

Determine your risks and plan what you will do about them, under 6.1.2. Separately, under the new 6.1.3, determine your opportunities and take them through the same discipline: analyse, evaluate, plan, integrate, implement, evaluate whether it worked. Set quality objectives that are measurable, with a named owner, a date and a way of evaluating results. Plan your changes, under 6.3, including communicating them, monitoring their effectiveness and reviewing the results.

Clause 7: Support

Resources: people, infrastructure, environment for the operation of processes, monitoring and measuring resources including calibration, and organizational knowledge, which the 2026 edition requires to be retained, applied and shared. Then competence, awareness, communication, and documented information, meaning your documents and records and how you control them.

Clause 8: Operation

This is the biggest clause and the one that looks most like your factory. Operational planning with acceptance criteria in writing. Requirements for products and services, including customer communication and, in the 2026 edition, telling the customer about contingency actions when supply is disrupted. Design and development, if you do it. Control of externally provided processes, products and services, which is your supplier approval and your outsourced work. Production and service provision, including identification and traceability, customers’ property, preservation, post-delivery activities and control of changes. Then release of products and services, and control of nonconforming outputs.

Clause 9: Performance evaluation

Monitor, measure, analyse and evaluate, including customer satisfaction. Run internal audits on a programme, with defined objectives, criteria and scope for each audit. Hold management reviews. In the 2026 edition the review has eight inputs, including changes in the needs and expectations of interested parties, and separate lines for the effectiveness of actions on risks and on opportunities.

Clause 10: Improvement

In the 2026 edition clause 10 has two sub-clauses instead of three. Clause 10.1 carries the improvement duty. Clause 10.2 is nonconformity and corrective action: react, contain, evaluate whether the cause could recur elsewhere, act, review effectiveness, and update your risks and opportunities if needed. A note confirms that customer complaints can be a source of nonconformities.

Clauses 4 to 10 already written, for a packaging and manufacturing site. 202 documents, 190 Word and 12 Excel, plus the proof-read and remediation report, about 553 000 words, plus 12 risk assessment workbooks with live 5×5 scoring and a 123-row internal audit checklist.

Get the toolkit at R5 480 Talk to an ISO 9001 consultant

What documents does ISO 9001 actually require?

Less than you think, and far less than most template packs sell you. ISO 9001 calls documents and records “documented information”, and it asks for it where a clause specifically says so. In practice, a certified site will hold:

The scope of the quality management system, in writing
Information needed to support the operation of processes
The quality policy and the quality objectives
Evidence of competence, and the results of monitoring and measurement
Calibration records, or a record of the basis of calibration where no standard exists
Records of the review of customer requirements and of changes to them
Design and development inputs, controls, outputs and changes, where design applies
Evaluation, selection, monitoring and re-evaluation of external providers
Traceability records where traceability is a requirement
Records of release, showing conformity to acceptance criteria and who authorised release
Records of nonconforming outputs and what was done about them
Internal audit programme and results, and management review results
Records of nonconformities and corrective actions

The three things ISO 9001 has never required

Kill these now, because they cost South African sites real money every year:

A quality manual. Not required by ISO 9001:2015 and not required by ISO 9001:2026. The requirement disappeared in the 2015 edition. Plenty of sites still keep one because a customer asks for it. That is a commercial decision, not a certification requirement.
Six documented procedures. Not required by either edition. That was ISO 9001:2008, which was withdrawn over a decade ago.
A management representative. Not required by either edition. Clause 5.3 requires that responsibilities and authorities are assigned and communicated. It does not require one person with that title on an organogram.

If a consultant or a template pack tells you otherwise, they are working from the 2008 edition, and you should ask what else in their material is eighteen years out of date.

What does ISO 9001 certification involve?

Certification is done by an independent certification body, accredited in South Africa by SANAS or by an equivalent accreditation body abroad. You do not certify yourself and ASC does not certify you. We are a consultancy, training provider and auditing firm, and the certification body has to be independent of whoever helped you build the system.

Build and run the system. Most sites need three to six months of the system actually operating before an audit is useful, because the auditor needs records to sample. You need at least one full internal audit cycle and one management review behind you.
Stage 1 audit. A readiness review. The auditor looks at your documented information, your scope, your context and interested parties work, your internal audit and management review, and tells you what is missing. It is usually short and often partly remote. Treat findings here as a gift, not a failure.
Stage 2 audit. The full certification audit, on site, across every clause and every shift pattern that matters. The auditor samples records, walks the floor and interviews people who are not in the quality department. Findings are raised as minor or major nonconformities with closure timeframes set by the certification body.
Certificate issued, valid for a three year cycle.
Surveillance audits, normally annually within that cycle, then a recertification audit before the three years end.

The certification body sets the dates, the audit duration and the closure timeframes, not you and not us. Ask them for the audit day calculation in writing before you sign, because it is the single biggest variable in the quote.

What does ISO 9001 certification cost in South Africa?

There are three separate costs and they are often confused with each other. The certification body’s fee, which is driven by audit days and your headcount and site count. The cost of building the system, which is either internal time, a consultant, a toolkit, or some combination. And the cost of training the people who will run it and be interviewed.

The toolkit end of that is the part we can put a number on immediately: R6 850, at a launch price of R5 480 until 30 November 2026, once-off, no subscription. All ASC prices on this page, for the toolkit and for the courses, are excluding VAT. For comparison, Advisera sells a 61-document ISO 9001 toolkit from US$897, roughly R16 000. For the certification body fees and the full budget, including what a first year realistically looks like for a mid-sized manufacturer, see ISO 9001 certification cost in South Africa.

Who actually needs ISO 9001?

Manufacturers whose retail or export customers ask for it. This is the most common trigger by a distance. A supplier questionnaire has an ISO 9001 line, and N/A is no longer being accepted.
Packaging converters. Flexible film, cartonboard, labels, rigid containers. Your customer’s complaints are almost all quality complaints: colour drift, registration, seal strength, dimension, the wrong artwork version. A food safety certificate does not speak to any of them, and BRCGS Packaging Materials does not cover your commercial delivery performance either.
Any site that keeps losing listings on quality rather than safety. If your last three lost lines went on complaints, underfill, short deliveries or artwork errors, and your food safety audit scores are fine, the gap is a quality management system.
Sites tendering into government, mining, automotive or large corporate supply chains, where ISO 9001 is frequently a gate rather than a preference.
Sites already certified to ISO 22000 or FSSC 22000 who want the two systems to run as one. Our integration matrix carries thirty-eight clause-level rows from 4.1 to 10.2, each marked SHARE, EXTEND or SEPARATE. 20 of its 38 clause rows are marked SHARE and 13 EXTEND, which means one context register, one interested parties register, one competence matrix, one calibration register, one document control system, one internal audit programme and one management review across both certificates.

How to get there, and who needs to learn what

Two things move this along faster than anything else: put the right people on the right course, and do not author 553 000 words from a blank page.

For the team, the Introduction to ISO 9001:2026 course at R1 495 is about six hours over 21 lessons. It is built for everyone who works inside the system but does not build it: supervisors, line leaders, QA staff, anyone an auditor will interview. Clause 7.3 awareness is tested by interview, and an operator who can answer in their own words is worth more at stage 2 than another signed attendance register.

For the person building it, ISO 9001:2026 Understanding and Implementation at R4 800 is about 24 hours over 75 lessons, with 7 interactive tools, 68 case packs, a marked workbook and a proctored final. If your site already holds a 2015 certificate and you only need to move it, the Transition to ISO 9001:2026 course at R1 950 is the right one instead. The usual pattern is one or two people on Implementation and everyone else on the Introduction. Five or more, ask us about a group arrangement. All three are self paced, with lifetime access, a 70 percent pass mark and three attempts.

For the documents, the ISO 9001:2026 Document Templates Toolkit for Food Contact Packaging Manufacturing is 202 documents, 190 Word and 12 Excel, plus the proof-read and remediation report, about 553 000 words. Part 1 covers clauses 4 to 10 as policies, procedures, work instructions and control forms. Part 2 adds ten packaging quality control modules covering artwork, print and colour, converting, laboratory and test methods, statistical process control and capability, measurement system analysis, customer specific requirements, identification, labelling and packing, warehousing and dispatch, equipment, tooling and maintenance, and cost of poor quality. Part 3 adds six enabler modules, including quality culture and ethical behaviour, climate change and sustainability, organizational knowledge, resilience and business continuity, risk and opportunity methodology, and transition from 2015 to 2026.

With it come 12 Excel risk assessment workbooks with live formulas, 5×5 scoring, inherent and residual scores, conditional formatting, drop-down lists and an action tracker on each; a 123-row internal audit checklist walking every sub-clause from 4.1 to 10.2; an integration matrix against ISO 22000:2018 and FSSC 22000 V7; and a master product and process specification that holds every parameter once, so no two documents can state a different limit. It is built on ISO 19011:2026, the fourth edition of the auditing guidelines, and was independently proof-read before release by an ISO 9001 lead auditor, a packaging technical manager and a document control specialist, with the proof-read and remediation report included.

We will be straight with you about the limit: the toolkit does not implement itself. It removes the authoring, which is most of the calendar time and almost all of the frustration, but somebody at your site still has to make the decisions, populate the registers, run the internal audits and chair the management review. That is what the courses and, where you want it, our ISO 9001 implementation consulting are for.

The fastest route from “our customer asked for ISO 9001” to a documented system. Editable Word and Excel, once-off price, delivered by email. Launch price R5 480 until 30 November 2026.

Get the ISO 9001:2026 toolkit Enrol your team on the courses

Where to go next

Already certified to ISO 9001:2015: read ISO 9001:2026 vs ISO 9001:2015, every change clause by clause for the full change table and what to build first.
Budgeting: see ISO 9001 certification cost in South Africa.
Already hold a food safety certificate: read ISO 9001 vs FSSC 22000, do we need both.
Want help in the room, in Gqeberha, Johannesburg, Cape Town or Durban: see our ISO 9001 implementation consulting.

Questions people ask

What is ISO 9001 in simple terms?

ISO 9001 is the international standard for a quality management system. It sets out what an organisation must have in place, across context, leadership, planning, support, operation, performance evaluation and improvement, so that customers consistently get what was agreed. It does not prescribe how you make your product. It requires you to define how you work, check whether it worked, and act when it did not. Current certifications are to ISO 9001:2026, the sixth edition, published on 16 September 2026.

Is ISO 9001 a food safety standard?

No. ISO 9001 is a quality management standard. Food safety is covered by ISO 22000, FSSC 22000 and BRCGS. A food safety certificate says the product is safe. It says nothing about the wrong sleeve on the pack, a short fill, a late delivery or a complaint that stayed open for 21 days. ISO 9001 sits beside a food safety certificate, it does not replace it.

Do I need a quality manual for ISO 9001?

No. A quality manual has not been required since the 2015 edition and is not required by ISO 9001:2026. Neither are six documented procedures, nor a management representative. Clause 5.3 requires responsibilities and authorities to be assigned and communicated, which is not the same as one named title. Some customers ask for a manual commercially, which is a separate matter from certification.

How long does ISO 9001 certification take?

For a site starting from nothing, allow six to twelve months for the system, nine to fifteen months to the certificate in hand once the certification body’s own scheduling is allowed for. Most of that is running the system long enough to generate records, because the auditor needs at least one full internal audit cycle and one management review to sample. The certification body then runs a stage 1 readiness audit and a stage 2 certification audit. The certification body sets the dates and the audit duration, so ask for its audit day calculation early.

Which edition of ISO 9001 should we certify to?

ISO 9001:2026, the sixth edition. It was published on 16 September 2026, cancels and replaces ISO 9001:2015 and incorporates Amendment 1:2024. Certified organisations have until 30 September 2029 to complete the transition, under the three year transition set by Global Accreditation Cooperation, known as Global ACI, which took over the work of the IAF when the IAF ceased operations on 1 January 2026. From 31 March 2028 new and initial accredited certifications may only be issued to the 2026 edition. Confirm the exact dates with your own certification body. Confirm the clause lettering against your own controlled copy of ISO 9001:2026.

Can ASC certify us to ISO 9001?

No, and neither can any consultancy. Certification must come from an independent certification body, accredited by SANAS in South Africa or by an equivalent accreditation body abroad. We build, train and audit internally. Keeping those roles separate is a requirement, and a certification body will look for it.

ISO 9001:2026 is published by the International Organization for Standardization. ASC Food Safety Consultants is an independent consultancy, training provider and auditing firm based in Gqeberha, with reach in Johannesburg, Cape Town and Durban. Our toolkits and courses are our own products and are not approved, endorsed or accredited by ISO or by any certification body.