ISO certification is worth it when it helps a business win contracts, meet customer requirements, prove compliance, reduce risk, or improve how work is managed. It may not be worth it when there is no buyer demand, no internal commitment, or the company only wants a certificate for appearance. The real question is not whether ISO certification is “good.” The better question is whether certification will create enough business value to justify the cost, audit effort, documentation, training, and ongoing maintenance. For many companies, the answer is yes. For others, it is better to wait, choose a different standard, or improve internal processes before starting certification. The Real Decision: Certificate Value vs Business Need ISO certification is a business decision, not just a compliance label. The value depends on why the company needs it. A certificate can support tender eligibility, supplier qualification, enterprise customer trust, quality control, risk management, and operational discipline. But if certification is not connected to a real business need, it can become an expensive document with limited practical value. A company should start with three questions: Who is asking for ISO certification? What business problem will it help solve? Will the company maintain the system after certification? If the answer is clear, certification may be worth pursuing. If the answer is vague, the business may need a readiness review before spending money on certification. When ISO Certification Is Worth the Cost ISO certification is usually worth considering when it supports a clear commercial, operational, or compliance objective. When Customers or Tenders Require It ISO certification often becomes worth it when a customer, tender, enterprise buyer, government-related contract, or supplier approval process requires it. A company may be capable of doing the work but still lose the opportunity if it cannot show the required certificate. In procurement-heavy industries, certification can act as a qualification filter. Examples include: A contractor needing ISO 9001 to qualify for tenders. A technology company needing ISO/IEC 27001 because clients expect information security controls. A food-chain business needing ISO 22000 to show food safety management. A construction or industrial supplier needing ISO 45001 for workplace safety expectations. A manufacturer needing certification to enter larger supply chains or export markets. When real buyers require it, ISO certification can move from “nice to have” to “needed for business access.” When Supplier Qualification Matters Many large organizations screen suppliers before approving them. ISO certification can help show that a supplier has a controlled management system, not just informal procedures. This is useful when buyers want confidence in quality, information security, environmental management, workplace safety, food safety, or other management controls. The certificate does not guarantee perfect performance. It shows that the organization’s management system has been assessed against a defined standard within a defined scope. When Process Problems Are Costly ISO certification can also be worth it when internal problems are creating cost, risk, or customer dissatisfaction. Common examples include: Repeated customer complaints. Inconsistent service delivery. Rework or product defects. Poor document control. Unclear staff responsibilities. Supplier performance issues. Safety incidents. Weak audit readiness. Poor corrective action tracking. Compliance gaps. A relevant ISO management system can help the business define responsibilities, control documents, train staff, review risks, track performance, investigate problems, and improve processes over time. This value is strongest when the company actually uses the system, not when it treats ISO as paperwork for an audit. When Certification Supports Market Access ISO certification can support market access when clients, supply chains, foreign buyers, or industry sectors expect recognized management practices. This matters for companies that want to sell beyond local networks, compete with certified suppliers, or enter industries where documentation and audit history matter. Certification can make the company easier to evaluate. It can reduce buyer uncertainty and support a more structured procurement review. When ISO Certification May Not Be Worth It ISO certification is not automatically worth it for every business. In some cases, certification should be delayed or avoided until the business case is stronger. When There Is No Buyer Requirement If no customer, tender, regulator, or supplier approval process requires certification, the company should look carefully at the return. Certification may still help internally, but the case becomes weaker if there is no external demand and no clear operational problem to solve. A business should not pursue ISO only because competitors mention it on their websites. The decision should connect to revenue, risk, compliance, process control, or customer expectations. When Leadership Is Not Ready to Maintain the System ISO certification requires leadership involvement. Management must approve scope, assign responsibilities, review performance, support audits, make decisions about corrective actions, and keep the system active after certification. If leadership only wants the certificate but does not want to maintain the management system, the value will be limited. When the Business Only Wants a Certificate or Logo A certificate-only approach often leads to weak documentation, poor staff adoption, superficial audits, and little real improvement. ISO certification loses value when the company only wants a logo, certificate, or marketing claim. The certificate may look useful at first, but it may not help with serious buyer checks, tender reviews, or operational improvement. ISO is worth more when it changes how the company works. When Cost Outweighs Realistic Business Value ISO certification involves cost and effort. A small low-risk business with no tender requirements, no customer demand, and no major process issues may not need certification immediately. In that case, it may be smarter to improve basic processes first, stabilize operations, and pursue certification later when the business case is stronger. What ISO Certification Actually Proves ISO certification shows that an organization’s management system has been assessed against the requirements of a specific ISO standard within a specific scope. For management system standards such as ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, or ISO 22000, certification usually means an external certification body has audited the company’s management system and found that it conforms to the applicable standard requirements. The scope matters. A certificate may apply to

ISO 27001 for startups is about building a practical information security management system that can protect customer data, support enterprise sales, and prepare the company for certification when buyers, investors, or partners ask for stronger security proof. For a startup, ISO 27001 should not be treated as paperwork only. It is a structured way to define security responsibilities, assess information security risks, select controls, collect evidence, and show that security is managed as part of the business. The key is to keep the scope realistic. A startup does not need to copy the security program of a large enterprise. It needs an ISMS that fits its product, team, cloud systems, customer data, suppliers, and risk profile. What Is ISO 27001? ISO/IEC 27001 is the international standard for information security management systems. An ISMS is the management system a company uses to protect information through policies, risk assessment, controls, responsibilities, monitoring, audits, and continual improvement. For startups, ISO 27001 usually matters because customers want proof that the company can handle sensitive data responsibly. This is especially common for SaaS startups, fintech startups, healthtech companies, AI products, B2B platforms, cloud service providers, and companies selling to enterprise buyers. ISO 27001 is not just a cybersecurity checklist. It asks the company to manage security risks in a structured way. That includes identifying information assets, understanding threats, assessing risk, choosing controls, assigning responsibilities, reviewing performance, and improving the system over time. Why Startups Need ISO 27001 Startups usually begin thinking about ISO 27001 when security becomes a sales, partnership, or trust requirement. A founder may hear from a potential customer: “We need your ISO 27001 certificate before procurement can approve you.” Or: “Please complete our security questionnaire and provide evidence of your information security controls.” At that point, security is no longer only a technical issue. It becomes a business-readiness issue. ISO 27001 can help startups with: Enterprise customer trust Vendor onboarding Security questionnaire responses Procurement reviews Data protection expectations Investor or partner confidence Internal security discipline Risk ownership across the team Clearer cloud and access control practices Evidence-based security operations Certification does not guarantee that a startup is breach-proof. It shows that the startup has implemented and maintained an information security management system against ISO 27001 requirements and passed an external certification audit. Is ISO 27001 Mandatory for Startups? ISO 27001 is not automatically mandatory for every startup. Many early-stage companies can operate without certification for a period of time, especially if they serve small customers, do not handle sensitive information, or are still testing product-market fit. However, ISO 27001 can become commercially necessary when the startup sells to larger organizations, regulated sectors, government-related buyers, financial services, healthcare, enterprise SaaS customers, or security-conscious international clients. A practical rule is this: If security questionnaires, vendor risk reviews, enterprise procurement, or customer due diligence are slowing down sales, ISO 27001 may be worth considering. Startups should avoid pursuing ISO 27001 only because competitors mention it. The better reason is clear business need, customer requirement, or risk maturity. ISO 27001 Compliance vs ISO 27001 Certification Startups often confuse compliance and certification. Term Meaning ISO 27001 compliance The startup has implemented an ISMS aligned with ISO 27001 requirements ISO 27001 certification An external certification body audits the ISMS and issues a certificate if requirements are met ISMS readiness The startup has prepared policies, risk assessment, controls, evidence, internal audit, and management review before external audit Certificate scope The part of the startup, product, location, system, or service covered by certification A startup should not say it is “ISO certified” unless it has a valid certificate issued by a certification body. It should also avoid saying it is “certified by ISO,” because ISO develops standards but does not issue certificates. What ISO 27001 Requires From a Startup ISO 27001 asks the startup to build a working ISMS. The exact details depend on scope, business context, risks, and selected controls. At a practical level, a startup will usually need: Requirement Area What the Startup Needs ISMS scope Define which products, teams, systems, locations, and services are included Context and interested parties Identify customer, legal, contractual, investor, and operational requirements Leadership and responsibilities Assign ownership for information security and ISMS operation Risk assessment Identify information security risks linked to assets, systems, people, suppliers, and data Risk treatment Decide how risks will be reduced, accepted, transferred, or avoided Statement of Applicability Explain which Annex A controls apply and why Policies and procedures Document rules for access, assets, incidents, suppliers, HR, change management, and more Evidence Prove that controls are actually operating Internal audit Check whether the ISMS meets requirements before external audit Management review Show leadership review of ISMS performance, risks, audit findings, and improvements Corrective actions Fix nonconformities and improve the ISMS over time The hardest part is rarely writing policies. The harder part is proving that the startup actually follows them. What Should Startups Include in the ISO 27001 Scope? Scope is one of the most important decisions for a startup. A startup should not make the ISMS scope too broad just to look impressive. A broad scope can make certification slower, more expensive, and harder to maintain. A startup-friendly ISO 27001 scope may focus on: The core SaaS product Cloud infrastructure used to deliver the service Product engineering and operations teams Customer data processing systems Key support and administrative processes Security-relevant suppliers and tools The scope should match what customers care about. If customers are buying a cloud software product, the ISMS scope should not only cover the office laptop policy. It should cover the systems and processes that protect the product and customer data. Key ISO 27001 Documents Startups Usually Need Startups do not need bloated documentation. They need clear documents that match how the company actually works. Common ISO 27001 documents include: Document Why It Matters ISMS scope Defines certification boundaries Information security policy Sets the company’s security direction Risk assessment methodology Explains how risks are identified and evaluated Risk register Records identified risks and

What Is ISO 27001? ISMS, Requirements, and Certification Explained ISO 27001 is the common name for ISO/IEC 27001, an international standard that defines requirements for an Information Security Management System, or ISMS. The standard helps organizations manage information security risk through policies, risk assessment, controls, monitoring, evidence, audits, and continual improvement. In simple terms, ISO 27001 helps an organization answer one serious question: How do we protect sensitive information in a structured, repeatable, and auditable way? That information may include customer data, financial records, employee information, intellectual property, supplier details, contracts, system access, and business records. ISO 27001 does not make an organization “hack-proof.” It gives the organization a management system for identifying security risks, treating those risks, and improving security controls over time. What Organizations Should Know About ISO/IEC 27001 ISO/IEC 27001 is an information security management standard that sets requirements for building, maintaining, and improving an ISMS. An ISMS is not just software, a firewall, or a cybersecurity checklist. It is a management system that connects people, processes, policies, technology, risk decisions, control evidence, and leadership responsibility. A company may use ISO 27001 to show customers, partners, regulators, or procurement teams that information security is being managed through a recognized system rather than informal security habits. Is ISO 27001 the same as ISO/IEC 27001? ISO 27001 is the common shorthand for ISO/IEC 27001. The official name is ISO/IEC 27001 because the standard is published jointly by ISO and IEC. In everyday business use, people often say “ISO 27001 certification,” “ISO 27001 audit,” or “ISO 27001 compliance.” Those phrases usually refer to the same standard. The precise wording matters in formal documents, contracts, certificates, audit reports, and certification scopes. What is ISO/IEC 27001:2022? ISO/IEC 27001:2022 is the current edition of the ISO 27001 standard. Its full title is Information security, cybersecurity and privacy protection — Information security management systems — Requirements. The 2022 edition replaced the earlier 2013 version and aligns the standard with updated information security management and control language. Older articles, templates, archived certificates, or outdated internal documents may still mention ISO/IEC 27001:2013. For current accredited certification activity, organizations should confirm ISO/IEC 27001:2022 requirements, applicable transition status, certification scope, and whether ISO/IEC 27001:2022/Amd 1:2024 has been addressed where relevant. What is an information security management system? An Information Security Management System is the structured system an organization uses to manage information security risks. A useful ISMS usually includes: information security policies; risk assessment and risk treatment processes; assigned roles and responsibilities; asset and access controls; employee awareness and training; supplier and third-party security controls; incident management processes; internal audits; management review; corrective actions; evidence that controls are working. The keyword is system. ISO 27001 does not ask for random security documents. It expects an organization to define how information security is governed, operated, monitored, reviewed, and improved. What is ISO 27001 used for? ISO 27001 is used to manage information security risk and give interested parties confidence that an organization protects information through a controlled management system. That confidence matters because most organizations handle sensitive information every day. A SaaS company stores customer data. A hospital handles patient records. A bank processes financial information. A government contractor may handle restricted project details. A logistics company may rely on supplier and customer records. ISO 27001 gives those organizations a structure for identifying what needs protection, what could go wrong, which controls are needed, and how security performance will be reviewed. What information does ISO 27001 help protect? ISO 27001 helps organizations manage risks to information assets, such as: customer data; employee records; financial information; intellectual property; contracts; supplier data; passwords and access credentials; business records; system logs; cloud data; operational documents; sensitive emails and files. The standard is not limited to IT systems. Information can exist in cloud platforms, databases, laptops, paper records, shared drives, mobile devices, physical offices, vendor systems, and employee workflows. That is why ISO 27001 covers more than cybersecurity tools. It connects technical security with governance, process, accountability, and evidence. Who uses ISO 27001? ISO 27001 can be used by organizations of different sizes, sectors, and risk profiles. Common examples include: SaaS and technology companies; healthcare organizations; banks and financial service providers; government contractors; IT service providers; cloud service providers; data centers; manufacturers; consulting firms; logistics companies; education providers; organizations handling customer or employee data. A small software company may need ISO 27001 because enterprise buyers request it during vendor approval. A larger organization may use ISO 27001 to standardize security governance across departments, regions, or service lines. Why do customers and procurement teams ask for ISO 27001? Customers and procurement teams ask for ISO 27001 because they need evidence that information security is managed, reviewed, and independently assessed. Without a recognized framework, vendor security review can become vague. A supplier may say, “We take security seriously,” but that does not tell a buyer how risks are assessed, controls are selected, incidents are handled, or access is managed. ISO 27001 gives procurement teams a clearer assurance signal. It does not remove the need for due diligence, but it gives buyers a structured basis for evaluating information security maturity. How does ISO 27001 manage information security risk? ISO 27001 manages information security risk by requiring an organization to identify risks, evaluate them, choose treatment actions, apply controls, monitor performance, and improve the ISMS over time. The standard follows a management-system logic. It does not simply ask, “Do you have security tools?” It asks whether the organization understands its risks and manages them in a controlled way. Risk assessment Risk assessment identifies what could harm the confidentiality, integrity, or availability of information. A practical risk assessment may ask: What information assets do we need to protect? What threats could affect them? What vulnerabilities exist? What would the impact be if the risk happened? How likely is the risk? Which risks are acceptable? Which risks require treatment? For example, a SaaS company may identify unauthorized access to customer data as a major risk. The risk assessment

How to Get ISO 13485 Certification for a Medical Device QMS To get ISO 13485 certification, an organization must define its scope, build a medical-device QMS, complete gap analysis, documentation, training, internal audit, and management review, then pass Stage 1 and Stage 2 audits by an external certification body. That short answer hides a lot of work. ISO 13485 certification is not a form you buy or a badge you download. It is the result of preparing a quality management system, proving that the system works, and passing an independent certification audit. For medical-device companies, suppliers, contractors, and service providers, the process usually starts long before the external auditor arrives. Important: ISO does not issue ISO 13485 certificates. ISO publishes the standard. External certification bodies audit organizations and issue certificates when the QMS meets the applicable requirements. What Is ISO 13485 Certification? ISO 13485 certification is third-party confirmation that an organization’s medical-device quality management system has been audited against ISO 13485:2016 requirements. The certified object is the organization’s QMS, not the medical device itself. That distinction matters because ISO 13485 is often misunderstood as product approval. It is not. ISO 13485:2016 is the current certification version. It is designed for quality management systems used by organizations involved in medical devices and related services, including design, development, production, installation, servicing, storage, distribution, and outsourced activities where applicable. ISO 13485 Certification Is Not Product Approval ISO 13485 certification shows that the organization has a quality management system assessed against ISO 13485 requirements. It does not automatically approve a medical device for sale. The table below separates QMS certification from product approval, so the roles stay clear. Item ISO 13485 Certification Product Approval / Market Authorization Main focus The organization’s medical-device QMS A specific medical device or device family Reviewed by External certification body Regulatory authority, notified body, or applicable market pathway Outcome ISO 13485 certificate for the defined QMS scope Clearance, approval, conformity assessment, registration, or authorization, depending on the market What it proves The QMS was audited against ISO 13485 requirements The product met applicable regulatory pathway requirements Common mistake Treating QMS certification as device approval Assuming product approval replaces QMS obligations ISO 13485 certification is not the same as FDA clearance, FDA approval, EU MDR conformity, CE marking, or market authorization. A certified QMS can support regulatory readiness, customer trust, and supplier qualification. It does not replace product-specific regulatory work. ISO 13485:2016 Is the Current Certification Version ISO 13485:2016 is the current version used for ISO 13485 certification. Older references may still appear in templates, supplier documents, or outdated web pages. Before preparing for an audit, the organization should confirm that its QMS, documentation, audit plan, and certification scope align with ISO 13485:2016. This is especially important for companies using older quality manuals, inherited procedures, or documents copied from ISO 9001 systems. Who Needs ISO 13485 Certification? ISO 13485 certification is relevant for organizations involved in medical-device design, production, installation, servicing, supply, outsourced processes, or related services. Not every company in the medical-device supply chain needs certification for the same reason. Some need it for customer approval. Some need it for tender requirements. Some need it to prepare for regulatory expectations. Others need it because buyers will not qualify them without a recognized medical-device QMS. The table below shows common organization types and why ISO 13485 may matter. Organization Type Why ISO 13485 Certification May Matter Medical-device manufacturer Supports QMS control for design, production, traceability, complaints, CAPA, and regulatory expectations Contract manufacturer Helps prove quality-system control to device companies that outsource production Component or material supplier May be required by customers when the supplied product affects device quality Sterilization, installation, or servicing provider Supports control of quality-impacting services Medical-device startup Helps build a QMS before supplier qualification, investor due diligence, or market-entry planning Distributor or importer May support quality responsibilities depending on role, region, and customer requirements Quality manager or regulatory lead Provides a framework for audit readiness and QMS discipline Medical-Device Manufacturers Medical-device manufacturers often pursue ISO 13485 certification because their QMS must control product realization, design, where applicable, production, supplier quality, traceability, complaints, nonconforming product, and corrective actions. For manufacturers, ISO 13485 is not just an audit target. It becomes the operating structure for how quality is managed across the device lifecycle. Suppliers, Contractors, and Service Providers Suppliers and contractors may need ISO 13485 certification when their work affects medical-device quality. A contract manufacturer producing device components, a sterilization provider, a calibration service, or an installation provider may be asked to show QMS control before becoming an approved supplier. The exact need depends on the customer, product risk, outsourced activity, and regulatory environment. Startups and New Medical-Device Companies Startups often need ISO 13485 before they feel “ready” for it. A young company may still be finalizing design, suppliers, documentation, or manufacturing routes. Waiting too long can create rework. Building the QMS early helps the team control design changes, supplier decisions, risk records, validation evidence, complaints, and regulatory documentation from the start. Can Individuals Get ISO 13485 Certified? Individuals do not receive ISO 13485 company certification. A person can take ISO 13485 training, lead auditor training, internal auditor training, or consultant training. Those certificates show training completion or auditor competence. They are not the same as an organization receiving ISO 13485 certification after an external QMS audit. How to Get ISO 13485 Certified Step by Step An organization gets ISO 13485 certified by defining its scope, preparing and implementing the QMS, completing internal readiness checks, selecting a certification body, passing Stage 1 and Stage 2 audits, closing nonconformities, and maintaining the certificate. This is the core roadmap. The table below shows the main ISO 13485 certification steps, why each step matters, and the evidence usually prepared. Step Purpose Evidence to Prepare Common Mistake 1. Define scope Set QMS boundaries Scope statement, sites, products/services, processes Making the scope too vague or too broad 2. Perform gap analysis Compare the current QMS to ISO 13485 Gap report, action plan Treating

How to Get ISO 9001 Certification: Step-by-Step Process for Businesses To get ISO 9001 certification, a business must prepare and run a Quality Management System, define its certification scope, complete a gap analysis, organize documents and records, train employees, perform internal audit and management review, choose an external certification body, complete Stage 1 audit and Stage 2 audit, close nonconformities, and maintain certification through surveillance and recertification. ISO 9001 certification applies to an organization’s Quality Management System, also called a QMS. It does not certify an individual person. A company is also certified to ISO 9001, not “by ISO,” because ISO develops standards but does not issue certificates. To get ISO 9001 certification, build a working QMS, complete internal audit and management review, choose a certification body, pass Stage 1 and Stage 2 audits, close nonconformities, and maintain the certificate through ongoing audits. Detailed explanation below: What ISO 9001 Certification Means for a Business ISO 9001 certification means an external certification body has audited an organization’s QMS and confirmed that the system meets ISO 9001 requirements within a defined scope. The certificate is not just proof that documents exist. The certificate shows that the organization has processes, roles, controls, records, review methods, and improvement actions in place. ISO 9001 Is a Quality Management System Standard ISO 9001 is a quality management system standard for organizations that want to control work, meet customer expectations, satisfy applicable requirements, and improve performance over time. ISO describes ISO 9001 as a standard that helps organizations establish, implement, maintain, and continually improve a QMS. A QMS is the way a business manages quality. It includes process controls, responsibilities, policies, objectives, training, supplier controls, customer feedback, internal audits, corrective actions, and performance review. In simple terms, ISO 9001 asks one main question: Can the organization consistently deliver what the customer and applicable requirements expect? Companies Are Certified to ISO 9001, Not by ISO Companies are certified to ISO 9001 by an external certification body. ISO does not perform certification, does not issue ISO certificates, and does not allow the ISO logo to be used in connection with certification. That wording matters. “Certified by ISO” is not correct. The cleaner wording is: Certified to ISO 9001 ISO 9001 certified organization ISO 9001 certified quality management system ISO 9001 certificate issued by a certification body This distinction protects the organization from weak certificate claims, wrong marketing language, and buyer confusion. ISO 9001 Certification Applies to Organizations, Not Individuals ISO 9001 certification applies to an organization’s QMS. An individual can complete ISO 9001 awareness training, internal auditor training, or lead auditor training, but that is not the same as organization-level ISO 9001 certification. A person may hold a training certificate or an auditor qualification. A business holds ISO 9001 certification when its QMS has been audited and certified within a defined scope. What Is the Process for ISO 9001 Certification? The ISO 9001 certification process moves from preparation to audit to certificate maintenance. Each step builds evidence that the QMS is not only written, but also used. Step 1: Understand ISO 9001 Requirements The first step is to understand what ISO 9001 expects from the organization. ISO 9001 covers major QMS areas such as: Context of the organization Leadership Planning Support Operation Performance evaluation Improvement These areas help the organization define business context, assign responsibilities, set quality objectives, control work, monitor performance, check results, and improve the system. ISO’s own ISO 9001 overview lists these core topic areas. Step 2: Define the Certification Scope The certification scope defines what the ISO 9001 certificate covers. The scope should state the activities, locations, products, services, departments, or process boundaries included in certification. A vague scope creates problems later because buyers, auditors, and internal teams need to know exactly what the certificate applies to. A single-site service company may have a simple scope. A multi-site manufacturer, contractor, or logistics company usually needs a more detailed scope because audit planning changes when locations and processes change. Step 3: Conduct a Gap Analysis A gap analysis compares the current QMS against ISO 9001 requirements. The gap analysis should identify: Missing documents Weak records Unclear responsibilities Uncontrolled processes Training gaps Supplier control gaps Missing internal audit evidence Missing management review evidence Corrective-action weaknesses A gap analysis is useful because it turns a broad certification goal into a clear action plan. Without a gap analysis, teams often prepare documents randomly and miss the evidence auditors actually need. Step 4: Build or Update the Quality Management System The organization must build or update the QMS before the certification audit. A working QMS includes: Quality policy Quality objectives Process controls Roles and responsibilities Risk-based thinking Supplier control Customer feedback handling Document control Record control Corrective action Performance monitoring The QMS should fit the business. A small service company does not need the same system as a multi-site manufacturer. The system needs to be controlled, documented, used, and measurable. Step 5: Prepare Documents and Records ISO 9001 uses the term documented information for the documents and records needed to run and prove the QMS. Documents describe what should happen. Records prove what happened. The organization should prepare controlled documents and real records before the external audit. Written procedures with no records usually show that the system is not fully implemented. Step 6: Train Employees and Implement the System Employees need to understand the parts of the QMS that affect their work. Training should cover: Process responsibilities Quality objectives Documented procedures Customer requirements Risk controls Recordkeeping Nonconformity reporting Corrective-action steps ISO 9001 certification requires implementation. A company cannot rely on a manual sitting in a folder. Auditors look for evidence that people know the process and use the process. Step 7: Conduct an Internal Audit An internal audit is the organization’s own check before the external certification audit. The internal audit checks whether the QMS meets ISO 9001 requirements and whether the organization is following its own processes. Internal audit evidence can include audit plans, checklists, audit notes, findings,