ISO 9001 Requirements Across Clauses 4 to 10 (DSTU EN ISO 9001:2018 & ISO 9001:2026) and Accredited QMS Certification with Ekontrol

When a manufacturing plant, logistics operator, or engineering firm bids on a European supply contract or enters a Ukrainian public procurement tender, the very first qualification filter is an active Quality Management System (QMS, or СУЯ in Ukrainian) certified to ISO 9001. Here's the paradox we see in the field every week: the printed text of the standard spans barely thirty pages, yet unprepared companies regularly fail their external audit because they don't know what physical evidence, shop-floor records, and traceability trails a lead auditor actually inspects across Clauses 4 through 10.

If you want a high-level orientation without engineering terminology first, start with ISO 9001 explained in plain English or review our complete ISO 9001 certification guide. In this deep engineering breakdown, we examine the ISO 9001 requirements clause by clause through the lens of an accredited certification auditor: which exact documents and records are mandatory, how national Ukrainian editions map to the international text, what changes with the ISO 9001:2026 revision, and how the 3-year certification lifecycle operates under ISO/IEC 17021-1 and IAF MD 5.

How ISO 9001:2015, DSTU ISO 9001:2015, and DSTU EN ISO 9001:2018 Align in Ukraine

In Ukraine, the adoption of national standards is governed by the Law of Ukraine "On Standardization" No. 1315-VII, while third-party conformity assessment and accreditation fall under the Law of Ukraine "On Technical Regulations and Conformity Assessment" No. 124-VIII. Because tender specifications and foreign buyer questionnaires reference three slightly different designations, you need to know how they relate:

1. ISO 9001:2015 (Quality management systems. Requirements). The original fifth-edition international standard used worldwide by multinational buyers during Vendor Due Diligence and issued by international certification bodies.
2. DSTU ISO 9001:2015 (ДСТУ ISO 9001:2015). The national standard of Ukraine adopted as an identical translation (IDT degree of correspondence) of the 2015 international text.
3. DSTU EN ISO 9001:2018 (ДСТУ EN ISO 9001:2018). The national standard of Ukraine harmonized directly with the European regional standard EN ISO 9001:2015 as part of Ukraine's EU integration framework. This is the exact designation most frequently required in Ukrainian public procurement tenders and accreditation scopes today.

All three designations share the exact same 10-clause structure and word-for-word identical technical requirements. There is no separate "Ukrainian" quality system with different rules: when your QMS satisfies Clauses 4 through 10, it complies simultaneously with DSTU EN ISO 9001:2018, DSTU ISO 9001:2015, and ISO 9001:2015.

Annex SL High-Level Structure and the Engineering PDCA Loop

Every modern ISO management system standard is built on the Annex SL High-Level Structure (HLS) consisting of 10 clauses. The first three clauses (Clause 1 "Scope," Clause 2 "Normative References," and Clause 3 "Terms and Definitions" referencing the ISO 9000:2015 vocabulary) are introductory and contain zero auditable requirements. All mandatory requirements that an auditor checks on-site live in Clauses 4 through 10 and form a closed control loop driven by the PDCA cycle (Plan-Do-Check-Act):

• System Architecture and Planning (Plan): Clause 4 (Context of the Organization and QMS Scope), Clause 5 (Leadership, Policy, and Roles), and Clause 6 (Planning, Risk & Opportunity Management, Quality Objectives, and Change Control).
• Resource Provision and Operational Execution (Do): Clause 7 (Support: infrastructure, metrological calibration, staff competence, and documented information) and Clause 8 (Operation: contract review, design and development, supplier qualification, production control, release, and nonconforming output quarantine).
• Performance Verification and Audit (Check): Clause 9 (Performance Evaluation: KPI monitoring, customer satisfaction, internal audits per ISO 19011, and Management Review).
• Root-Cause Elimination and System Upgrade (Act): Clause 10 (Improvement: nonconformity handling, root-cause analysis, and Corrective Actions / CAPA).

The 2024 Climate Change Amendment (Amd 1:2024) and Alignment with ISO 9001:2026 (FDIS)

When designing or upgrading a QMS today, quality engineers must account for two regulatory shifts. First, in February 2024, the mandatory amendment ISO 9001:2015/Amd 1:2024 (Climate Action Changes) took effect immediately, adding explicit climate change evaluation requirements to Clauses 4.1 and 4.2. Second, the sixth edition ISO 9001:2026 (developed through Draft and Final Draft International Standard stages by subcommittee ISO/TC 176/SC 2) embeds those climate provisions directly into the core text and introduces four targeted engineering updates:

• Quality Culture and Ethical Behavior (Clauses 5.1.1 and 7.3): top management must now actively promote and demonstrate a quality culture and ethical conduct (zero tolerance for falsifying inspection logs, hiding batch defects, or pressuring QC inspectors to release out-of-spec goods), and employees must understand how their daily behavior supports that culture.
• Separation of Risks and Opportunities into Distinct Sub-Clauses (Clauses 6.1.1, 6.1.2, and 6.1.3): whereas companies under the 2015 text often lumped risks and opportunities into a single spreadsheet column, ISO 9001:2026 separates them into 6.1.1 (Determining risks and opportunities), 6.1.2 (Actions to address risks that threaten process stability), and 6.1.3 (Actions to pursue opportunities such as process automation, new testing capabilities, or market expansion).
• Strengthened Management of Change (Clause 6.3): organizations must not only plan QMS changes systematically, but also communicate changes clearly to affected staff and monitor post-implementation effectiveness.
• Supply Chain Continuity and Digitalized Operations (Clauses 7.1.3, 8.4, and expanded Annex A): clearer guidance on managing remote workforces, cloud software environments, automated decision tools, and supply chain disruption risks.

Clause 4 defines the engineering boundaries of your quality management system. If you define the scope poorly or map processes that don't match how your plant or office actually runs, the lead auditor will flag those gaps right at Stage 1.

Clauses 4.1 and 4.2: Organizational Context, Interested Parties, and the Climate Factor

Clause 4.1 requires you to determine external and internal issues that affect your ability to deliver consistent quality, while Clause 4.2 requires you to identify relevant interested parties and their specific requirements. An experienced auditor won't accept generic textbook statements about "macroeconomic trends." They look for concrete operational factors tied to your business:

• Internal factors: age and precision of CNC or packaging machinery, degree of ERP/WMS traceability, shortage of certified welders or laboratory analysts, multi-shift handoff discipline.
• External factors and interested parties: technical tolerances and delivery SLAs demanded by B2B customers, EU technical regulations, customs clearance timelines, statutory safety inspectors, and qualification rules in public procurement tenders.
• Climate change evaluation (Amd 1:2024 and ISO 9001:2026): you must document how climate-related factors and stakeholder expectations affect your QMS. In practice, that doesn't mean turning ISO 9001 into an environmental system. It means addressing concrete operational threats: backup diesel generators and UPS systems to keep thermal ovens or servers running during grid outages caused by extreme weather, HVAC and cold-chain temperature stability during +38 °C summer heatwaves, and carbon footprint data reporting (CBAM) requested by European industrial buyers.

Clause 4.3: Defining the QMS Scope and Permissible Clause 8.3 Exclusions

Your QMS Scope must be maintained as documented information. The exact wording you establish under Clause 4.3 is printed verbatim on your ISO 9001 certificate. When you bid on a Prozorro public tender or undergo onboarding with an EU buyer, compliance teams cross-check your certificate scope wording and economic activity codes (NACE / IAF / KVED) against the contract subject. Your Clause 4.3 Scope document must specify:

1. The exact types of products and services covered by the QMS.
2. The physical street addresses of all sites (head office, manufacturing workshops, warehouses, laboratories) included in the certification.
3. Documented justification for any requirement of the standard that your organization determines is not applicable.

When are you allowed to exclude a clause? ISO 9001 permits non-applicability claims strictly for requirements within Clause 8 (and in pure office/software services without physical measurement tools, Clause 7.1.5), provided that excluding the clause doesn't impair your ability or responsibility to ensure product and service conformity.

The classic engineering example is Clause 8.3 "Design and development of products and services." If your factory manufactures metal stampings or cable harnesses strictly to blueprints, CAD models, and technical specifications supplied by the customer, or if your company is a logistics distributor that doesn't alter product characteristics, you can legitimately exclude Clause 8.3. Fair warning: if your technologists modify structural geometry, formulate proprietary food or chemical recipes, or design custom software architecture, the auditor will reject a Clause 8.3 exclusion and require full design verification and validation records.

Clause 4.4: Process Map and Engineering Turtle Diagrams

Clause 4.4.1 requires you to determine the processes needed for the QMS and their interactions across the enterprise. During turnkey ISO 9001 implementation, we organize the process map into three clear layers:

• Management processes: strategic context & risk review, internal auditing, and Management Review.
• Core operational (value-stream) processes: commercial contract review, R&D / engineering design, procurement & vendor control, manufacturing or service delivery, quality control, warehousing, and dispatch.
• Support processes: HR & competence management, metrological calibration, preventive equipment maintenance (TPM / ППР), IT infrastructure, and documented information control.

To satisfy all eight sub-requirements of Clause 4.4.1 (a through h) on a single actionable sheet per process, quality engineers and lead auditors rely on the Turtle Diagram methodology:

• Head (Inputs): what triggers the process (e.g., signed customer specification, Revision 3 drawing, ERP production order, inspected raw material lot).
• Tail (Outputs): the tangible, verifiable output handed to the next process (finished batch with Certificate of Analysis, assembled unit, deployed software release).
• Front Left Leg (Resources & Equipment): machines, tooling, ERP/MES software, measuring instruments, and work environment parameters.
• Front Right Leg (Process Owner & Competence): the single accountable process owner, participating roles, and required skill levels under Clause 7.2.
• Back Left Leg (Methods & Controls): standard operating procedures (SOPs), routing cards, inspection checklists, and risk barriers.
• Back Right Leg (KPIs & Targets): measurable performance indicators (e.g., First Pass Yield $\ge 98.5%$, setup time $\le 25$ min, On-Time In-Full delivery $\ge 99%$).

While Clause 4 establishes system boundaries, Clauses 5 and 6 govern executive accountability and preventive planning. During Stage 2, the lead auditor verifies these clauses directly in interviews with the CEO, COO, and department heads.

Clause 5: Leadership Accountability, Quality Culture (5.1), Quality Policy (5.2), and RACI Matrix (5.3)

When ISO 9001:2015 was published, it deliberately eliminated the old "Management Representative" title from the 2008 edition. Why? Because too many CEOs signed an order appointing a junior quality engineer as "responsible for ISO" and ignored the system for the next 11 months. Clause 5.1.1 makes top management personally accountable for the effectiveness of the QMS.

Under the updated ISO 9001:2026 text, executive accountability goes even further: leaders must actively demonstrate quality culture and ethical behavior. We unpack the exact interview questions auditors ask executives in our guide to leadership and management commitment in ISO 9001:2026. On site, the auditor checks three concrete proofs:

1. Integration into business management (Clause 5.1.1): are scrap rates, customer claims, and supplier delays reviewed at weekly executive meetings alongside revenue and cash flow?
2. Quality Policy (Clause 5.2): this mandatory document must fit your business context, state a clear obligation to satisfy applicable requirements and continually improve the QMS, and provide a direct framework for quality objectives. Under Clause 5.2.2, it must be communicated and understood internally: a machine operator doesn't need to recite the policy word for word, but they must know what parameter tolerances they control and why they must never pass a defective part downstream.
3. Organizational roles, responsibilities, and authorities (Clause 5.3): who has the explicit authority to halt a production line or block a shipment when a quality deviation appears? To prevent finger-pointing between sales, procurement, and production, Ekontrol maps Clause 5.3 into a clear RACI Matrix (Responsible, Accountable, Consulted, Informed) across all QMS processes.

Clause 6: Risk & Opportunity Register (6.1), Measurable Quality Objectives (6.2), and Change Control (6.3)

Clause 6 replaced the old "preventive action" procedure with systematic risk-based thinking embedded at the planning stage of every process.

How to build an auditable Risk & Opportunity Register under Clause 6.1 (aligned with 6.1.1-6.1.3 in ISO 9001:2026): Although the standard doesn't mandate a full mathematical ISO 31000 or IEC 31010 FMEA model, auditors expect to see structured evidence linking process risks to preventive controls:

• For each process in your Clause 4.4 map, identify realistic failure modes (e.g., in procurement, single-source supplier delay or raw material moisture drift; in manufacturing, CNC tool wear or incorrect thermal curing profile).
• Score Probability ($P$) from 1 to 5 and Severity ($S$) from 1 to 5. Multiplying $R = P \times S$ gives the inherent risk score.
• For every medium or high risk ($R \ge 8$), assign concrete preventive barriers (e.g., qualifying a backup vendor on the AVL, installing Poka-Yoke mechanical stops, requiring barcode scan verification before machine startup) and re-score the residual risk.
• In a separate section (matching Clause 6.1.3 of ISO 9001:2026), document Opportunities and their action plans: deploying optical inspection cameras, accrediting an in-house test laboratory, or entering EU public tenders.

Measurable Quality Objectives and Action Plans (Clause 6.2): Clause 6.2.1 requires quality objectives to be measurable, monitored, and consistent with the Quality Policy, while Clause 6.2.2 requires a concrete plan specifying what will be done, what resources are required, who is responsible, when it will be completed, and how results will be evaluated. An auditor will immediately reject vague slogans like "Improve product quality in 2026." An engineering-grade objective looks like this: "Reduce internal stamping scrap on Press Lines #2 and #4 from 1.4% to 0.35% by Q3 2026 by replacing progressive die sets and introducing hourly first-article gauge checks (Owner: Chief Technologist; Budget: $10,500; Verification: monthly ERP scrap report)."

Planning of Changes (Clause 6.3): Whenever you relocate a workshop, migrate to a new ERP/MES system, add a night shift, or outsource an operation, Clause 6.3 requires you to evaluate the purpose and potential consequences of the change, preserve QMS integrity, allocate resources, and update responsibilities before the change goes live. A one-page Management of Change (MoC) checklist satisfies this requirement cleanly during an audit.

Clause 7 covers the physical, human, metrological, and informational backbone of the QMS. In practice, Clauses 7.1.5 (calibration), 7.2 (competence), and 7.5 (documented information) account for roughly 40% of all nonconformities recorded during industrial certification audits.

Clauses 7.1.1 to 7.1.4: Infrastructure Maintenance and Process Environment

Under Clause 7.1.3, you must maintain the buildings, production machinery, utilities, transport vehicles, and IT systems needed to achieve product conformity. On site, the auditor asks for your Preventive Maintenance Schedule (TPM / ППР) and equipment service logs. Running critical machinery solely on a "fix it when it breaks" basis triggers an immediate Clause 7.1.3 nonconformity.

Clause 7.1.4 covers the work environment: temperature, humidity, lighting, airflow cleanliness, electrostatic discharge (ESD) protection on electronics assembly lines, and hygiene zones in food or pharmaceutical plants. If your coating specification requires painting steel between +15 °C and +25 °C at relative humidity below 75%, the paint booth must have a calibrated thermo-hygrometer and daily log records.

Clause 7.1.5: Monitoring and Measuring Resources and ISO/IEC 17025 Traceability

Clause 7.1.5.2 establishes a strict metrological rule: wherever measurement traceability is a statutory requirement or essential for confidence in the validity of measurement results, measuring equipment must be calibrated or verified at specified intervals against measurement standards traceable to international or national standards.

Here are the four physical checks an auditor performs on the shop floor and in the QC lab:

1. Unique identification and calibration status: every caliper, micrometer, pressure gauge, load cell, thermocouple, or pH meter used to verify product conformity must carry a serial/inventory number and visible calibration status (a sticker showing the last and next calibration dates or a barcode linked to the metrology register). If an operator uses a personal, uncalibrated tape measure or micrometer from their toolbox to accept parts, that's an audit finding.
2. Traceability via ISO/IEC 17025 accredited laboratories: external calibration of reference weights, gauges, and test instruments should be performed by calibration providers accredited to ISO/IEC 17025. And if your enterprise operates its own in-house testing or calibration laboratories, implementing Clause 7.1.5 properly builds the foundation for full laboratory accreditation under DSTU EN ISO/IEC 17025:2019.
3. Protection from invalidation: instruments must be safeguarded from unauthorized adjustment, drop damage, or corrosion.
4. Retrospective impact assessment when an instrument is found out of tolerance (Clause 7.1.5.1): if periodic recalibration reveals that a scale or temperature sensor has drifted out of tolerance, you must formally assess and record the validity of previous measurement results since the last valid calibration, and take appropriate action on any affected product batches.

Clauses 7.1.6, 7.2, 7.3, and 7.4: Organizational Knowledge, Skill Matrices, and Communication

Clause 7.1.6 ("Organizational knowledge") protects the business from losing critical know-how when senior engineers retire or resign. Maintaining setup guides in Confluence, photo-illustrated defect catalogs, and project post-mortems satisfies this requirement.

Under Clause 7.2 ("Competence"), the auditor samples 5 to 7 employees across different functions (e.g., a welder, a CNC operator, a procurement specialist, a QC inspector, and an internal auditor) and verifies:

• Defined competence requirements for each role.
• Objective records of education, training, or experience.
• Evaluation of the effectiveness of training actions taken. Simply signing an attendance sheet isn't enough; you must show how competence was verified through practical testing, supervised trial shifts, or reduced error rates.

Clause 7.5: Complete Guide to Mandatory Documented Information in ISO 9001

ISO 9001:2015 (DSTU EN ISO 9001:2018) splits documented information into two precise categories: documents you must maintain (Maintain documented information), such as policies, scope, process maps, and SOPs, and records you must retain as evidence of results achieved (Retain documented information).

Clauses 7.5.2 and 7.5.3 require clear document identification, revision control, access permissions, withdrawal of obsolete drawings from workstations, and defined retention periods. The master engineering table below maps every requirement across Clauses 4 to 10 to its mandatory documents, records, and on-site audit checks.

Clause 8 ("Operation") generates the largest volume of operational records because it governs your core value stream. During a Stage 2 audit, the assessment team spends roughly 60% of its time walking operational areas to verify Clause 8 controls.

Clauses 8.1 and 8.2: Operational Planning and Customer Requirements Review (Contract Review)

Clause 8.1 requires you to establish acceptance criteria for processes and products (technical specifications, Inspection and Test Plans / ITPs, service SLAs). Before your company commits to supplying a product or service to a customer, Clause 8.2.3 mandates a documented Contract Review verifying:

• Requirements specified by the customer, including delivery and post-delivery activities.
• Requirements not stated by the customer, but necessary for the specified or intended use.
• Statutory and regulatory requirements applicable to the product or service.
• That any contract or order differences from previous quotes are resolved, and your plant has the physical capacity and tooling to meet the order.

Whenever a customer modifies an order mid-run (Clause 8.2.4), relevant documented information must be amended and all affected personnel notified immediately so production doesn't build to an outdated spec.

Clause 8.3: Design and Development Control (Verification vs. Validation)

For organizations that design products, machinery, formulations, or software, Clause 8.3 mandates a structured Stage-Gate process with five mandatory record sets:

1. Design planning (8.3.2): defining stages, review gates, responsibilities, and interfaces.
2. Design inputs (8.3.3): functional and performance specs, statutory standards, lessons from previous similar designs, and potential consequences of failure (Design FMEA).
3. Design controls (8.3.4): auditors strictly check the distinction between three engineering activities:
   • Design Review: cross-functional evaluation of design progress against targets and bottlenecks.
   • Design Verification: objective check that design outputs meet design input requirements (engineering stress calculations, 3D tolerance stack-up analysis, lab bench tests, peer code review).
   • Design Validation: testing the resulting product or pilot batch under real or simulated operating conditions to confirm it fulfills its intended use for the end user.
4. Design outputs (8.3.5): approved drawings, Bills of Materials (BOMs), formulations, production routing specs, and QC acceptance criteria.
5. Design changes (8.3.6): every engineering modification must go through an Engineering Change Order (ECO) with documented authorization, impact assessment on work-in-progress or delivered units, and re-verification.

Clause 8.4: Control of Externally Provided Processes, Products, and Services (AVL)

Clause 8.4.1 requires you to establish criteria for the evaluation, selection, performance monitoring, and re-evaluation of external providers. Here is how engineering teams implement Clause 8.4 cleanly:

• Classify vendors into risk tiers A, B, and C (where Tier A covers critical raw materials, components, primary packaging, calibration laboratories, and outsourced production steps).
• Maintain an Approved Vendor List (AVL). Configure your ERP so purchasing cannot issue a purchase order for Tier A materials to an unapproved vendor.
• Score Tier A suppliers quarterly or annually on objective metrics: incoming lot acceptance rate, On-Time In-Full delivery (OTIF), completeness of Certificates of Analysis (CoA), and responsiveness to quality claims.
• Control outsourced processes (such as external heat treatment, galvanizing, NDT inspection, or cloud infrastructure hosting): under Clause 8.4.2, an outsourced process remains within your QMS scope, requiring defined technical specs and incoming verification.

Clauses 8.5, 8.6, and 8.7: Controlled Production, Special Processes, Traceability, Release, and Quarantine

Clause 8.5.1 requires production and service provision to run under controlled conditions. Specifically, Clause 8.5.1 (f) mandates validation and periodic revalidation of "special processes" where the resulting output cannot be verified by subsequent non-destructive monitoring or measurement (for example, structural welding, heat treatment, protective coating application, sterilization, or pasteurization). For special processes, auditors verify qualified process procedures (such as WPS/WPQR in welding), certified operators, and continuous parameter logging.

Identification and Traceability (Clause 8.5.2): raw materials, work-in-progress, and finished goods must be labeled with both batch identification and inspection status ("Awaiting Inspection," "Passed / Released," "Hold / Nonconforming"). End-to-end traceability allows you to trace any finished lot number back to its raw material certificates, processing shift, machine parameters, and calibration records.

Release of Products (Clause 8.6) and Control of Nonconforming Outputs (Clause 8.7): no shipment may leave the facility until planned inspections are completed and signed off by an authorized person (Clause 8.6). When a material or product fails specification (Clause 8.7), it must be blocked in the ERP and physically segregated in a designated Quarantine / Red-Tag Isolation Area to prevent accidental dispatch. You then record one of four authorized dispositions under Clause 8.7.1:

1. Correction (rework or repair) followed by mandatory re-verification under Clause 8.6.
2. Segregation, containment, return to supplier, or scrap disposal.
3. Obtaining formal authorization for acceptance under concession from a relevant technical authority and, where applicable, the customer.
4. Informing the customer if the nonconformity is detected after delivery.

Industry execution of Clause 8 adapts to your sector: in the food industry and agriculture, operational controls integrate directly with HACCP critical control points and ISO 22000; in the defense industry, Clause 8 incorporates strict configuration management and serialized component traceability; and for IT companies, Clause 8 maps onto CI/CD pipelines, pull-request approvals, and staging sign-offs.

Documented procedures become a self-correcting management system only when you measure process performance, audit your own compliance, and eliminate root causes of defects. Clauses 9 and 10 govern that feedback loop.

Clause 9.1: Monitoring, Measurement, Analysis, and Evaluation of KPIs

Clause 9.1 requires you to determine what needs to be monitored and measured, the methods needed to ensure valid results, and when data must be analyzed. Instead of vanity metrics, mature QMS implementations track hard engineering KPIs:

• FPY (First Pass Yield): percentage of units that pass through the entire production and inspection cycle right the first time without rework.
• OTIF (On-Time In-Full): percentage of customer orders delivered on schedule and in complete quantity.
• COPQ (Cost of Poor Quality): total financial cost of internal scrap, rework labor, line downtime, warranty claims, and customer penalties.
• Process capability indices ($C_p$ and $C_{pk}$): statistical verification that process dispersion stays centered within specification limits.
• Customer satisfaction (Clause 9.1.2): tracked through claim rates per 1,000 shipments, repeat order retention, dealer reports, and structured customer feedback.

Clause 9.2: Internal Audit Program per ISO 19011

No accredited certification body will proceed to Stage 2 unless your company has completed a full internal audit cycle. Clause 9.2 requires an audit program planned according to the importance of processes, recent organizational changes, and results of previous audits. Running internal audits in line with ISO 19011 (DSTU ISO 19011:2019) requires three non-negotiable rules:

1. 100% scope coverage: before your certification audit, internal audits must verify every process in your QMS map and every applicable clause from 4 to 10.
2. Auditor objectivity and impartiality (Clause 9.2.2 c): auditors must never audit their own work or the department they manage. In practice, we train a cross-functional team of 2 to 4 internal auditors so the chief technologist audits procurement and warehousing while the logistics or quality manager audits production and sales.
3. Objective audit evidence: internal audit reports must record specific samples inspected (order numbers, batch dates, gauge serial numbers, staff interviewed), and any nonconformity must trigger a formal CAPA record.

Clause 9.3: Management Review Inputs and Outputs

Once internal audits are complete, top management conducts a formal Management Review of the QMS. Clauses 9.3.2 and 9.3.3 strictly prescribe what must appear in the Management Review minutes.

Mandatory Management Review Inputs (Clause 9.3.2):

• Status of actions from previous management reviews.
• Changes in external and internal issues relevant to the QMS (including climate, regulatory, and market shifts).
• QMS performance and effectiveness trends: customer satisfaction and interested party feedback, extent to which quality objectives (6.2) have been met, process performance (KPIs) and product/service conformity, nonconformities and corrective actions (CAPA), monitoring and measurement results, internal audit results (9.2), and performance of external providers (8.4).
• Adequacy of resources (staffing, equipment, metrology, budget).
• Effectiveness of actions taken to address risks and opportunities (6.1) and opportunities for improvement.

Mandatory Management Review Outputs (Clause 9.3.3): Your Management Review protocol cannot simply conclude "The QMS is functioning satisfactorily." It must record executive decisions and actions related to: (a) opportunities for improvement; (b) any need for changes to the QMS; and (c) resource needs (with budgets, owners, and deadlines).

Clause 10 (10.1 to 10.3): Nonconformity, Root-Cause Analysis, and CAPA

Clause 10.2 sets the rules for reacting to nonconformities, including customer complaints. Auditors pay close attention to whether your team distinguishes between two separate concepts:

• Correction: immediate action to eliminate a detected nonconformity (replacing a defective valve for a client, re-labeling a pallet, fixing a typo on a drawing).
• Corrective Action (CAPA): systemic action to eliminate the root cause of a nonconformity so it cannot recur in that process or occur elsewhere.

Instead of writing superficial fixes like "re-instruct the operator," engineering teams use the 5 Whys, Ishikawa (Fishbone 6M) diagram, or 8D methodology to find the systemic root cause. For example: why did the shaft diameter exceed tolerance? Because the CNC tool offset drifted. Why wasn't the drift caught? Because the operator checked only every 50th part instead of every 10th part. Why? Because the routing sheet lacked a mandatory in-process inspection frequency for tight-tolerance bores. The corrective action updates the routing template and adds an automated probe cycle on the CNC controller. After 30 to 60 days, the process owner verifies CAPA effectiveness by confirming zero recurrence before closing the record.

Legitimate third-party certification of a quality management system is governed worldwide by ISO/IEC 17021-1 (adopted in Ukraine as DSTU EN ISO/IEC 17021-1, specifying requirements for bodies providing audit and certification of management systems) and the mandatory document IAF MD 5 (Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems).

No accredited certification body is legally allowed to issue a certificate "in 48 hours without an audit," because national accreditation bodies (such as NAAU or DAkkS) inspect every certification file to verify that audit man-days were calculated and executed in strict compliance with IAF MD 5.

How Audit Duration (Auditor-Days) Is Calculated Under IAF MD 5

Under IAF MD 5, the baseline number of auditor-days required for initial certification (Stage 1 + Stage 2) depends on three engineering factors:

1. Effective Number of Personnel: includes full-time employees, part-time staff, and contractors operating within the QMS scope. However, when a large share of staff perform identical, repetitive tasks (such as packaging line workers, drivers, warehouse pickers, or multi-shift operators on identical lines), IAF MD 5 permits a documented reduction in effective headcount.
2. Process Complexity and Risk Category: whether Clause 8.3 (design & development) is included, and whether operations involve complex manufacturing, chemical/structural hazards, or off-site installation teams.
3. Number of Physical Sites (Multi-site sampling under IAF MD 1): whether operations run under one roof or across multiple regional branches and warehouses.

Stage 1 Audit (Readiness & Documentation Review)

Stage 1 typically accounts for 20% to 30% of the total initial audit time and may be performed on-site, remotely, or in a hybrid format. Under Clause 9.3.1.2 of ISO/IEC 17021-1, the Stage 1 lead auditor verifies your readiness for Stage 2:

• Reviews your core documented information (Clause 4.3 Scope, Clause 4.4 Process Map and Turtle diagrams, Quality Policy, measurable Quality Objectives, Risk & Opportunity Register, metrology records, and mandatory procedures) against every requirement of DSTU EN ISO 9001:2018 / ISO 9001:2015.
• Evaluates site-specific conditions and applicable statutory requirements.
• Verifies objective evidence that your company has completed at least one full cycle of internal audits (Clause 9.2) and held an executive Management Review (Clause 9.3).

At the close of Stage 1, the auditor issues a written Stage 1 Report listing any "Areas of Concern" that could become nonconformities during Stage 2. Companies typically have 2 weeks to 3 months between Stage 1 and Stage 2 (up to a maximum regulatory window of 6 months) to close any documentation or record gaps before the on-site assessment.

Stage 2 Audit (On-Site Certification Assessment)

Stage 2 represents 70% to 80% of the initial audit duration and takes place at your operational sites. The audit team follows end-to-end Audit Trails:

1. Opening Meeting: confirming the audit plan, scope wording, confidentiality rules, and finding classifications.
2. Top Management Interview: verifying Clauses 4, 5, 6, and 9.3 directly with the CEO and leadership team.
3. Operational & Shop-Floor Verification (Clauses 7 and 8): the auditor selects 3 to 5 completed or active orders and traces them end to end: contract review (8.2), purchasing from the AVL and incoming inspection (8.4), active drawing revisions at the workstation (7.5, 8.5), calibration certificates on gauges used for that batch (7.1.5), operator competence records (7.2), final QC release sign-off (8.6), and quarantine handling of nonconforming outputs (8.7).
4. Improvement Loop Audit (Clauses 9 and 10): reviewing KPI dashboards, internal audit files, customer complaint logs, and root-cause CAPA closures.
5. Closing Meeting & Classification of Findings:
   • Major Nonconformity: complete absence of a mandatory clause requirement or a systemic breakdown that creates a direct risk of shipping nonconforming product to a customer. A Major NC blocks certificate issuance until root-cause corrective actions are implemented and verified (typically within 90 days).
   • Minor Nonconformity: an isolated, single-instance lapse in following a procedure or recording data that doesn't compromise product quality (for example, one gauge out of twenty missing a physical calibration sticker while its valid calibration certificate is on file). Minor NCs don't block certification once the auditor approves your root-cause analysis and CAPA plan.
   • Opportunity for Improvement (OFI): a constructive observation that doesn't violate the standard and requires no mandatory CAPA filing.

Once the lead auditor approves your CAPA plan, an independent certification committee inside the certification body (staffed by impartial technical reviewers who did not participate in the audit, as required by ISO/IEC 17021-1) grants certification and issues your ISO 9001 certificate valid for 3 years.

Annual Surveillance Audits (Years 1 & 2) and Recertification (Year 3)

Receiving the certificate kicks off a 3-year maintenance cycle:

• First Surveillance Audit (Year 1): conducted no later than 12 months after the initial certification decision (taking roughly 1/3 of the initial audit duration under IAF MD 5).
• Second Surveillance Audit (Year 2): conducted at the 24-month mark.
• Recertification Audit (Year 3): conducted prior to the 36-month expiration date (taking roughly 2/3 of initial audit time), reviewing system performance across the full three-year cycle and renewing the certificate for another 3 years. For organizations certified to ISO 9001:2015, upgrading to ISO 9001:2026 can be scheduled directly during a regular surveillance or recertification audit within the 3-year transition period.

An ISO 9001 certificate carries legal and commercial weight only when the issuing certification body holds valid accreditation under ISO/IEC 17021-1 for your specific industry code. Unaccredited "2-day certificates without an audit" sold by private brokers have zero legal standing and lead directly to bid rejection.

How to Verify Certification Body Accreditation in 5 Minutes

Under the Law of Ukraine "On Technical Regulations and Conformity Assessment" No. 124-VIII, the sole national authority responsible for accrediting conformity assessment bodies in Ukraine is the National Accreditation Agency of Ukraine (NAAU). NAAU is a full signatory to the European co-operation for Accreditation Multilateral Agreement (EA MLA) for management system certification (DSTU EN ISO/IEC 17021-1).

Before signing a contract with any certification body, run three verification checks:

1. Check the official NAAU or European national accreditation registry: look up the certification body's accreditation certificate number on the official NAAU website (or in the registries of European EA MLA signatories such as DAkkS in Germany, PCA in Poland, UKAS in the UK, or CAI in the Czech Republic).
2. Verify the exact IAF / NACE industry scope code: a certification body might hold accreditation for wholesale trade (IAF Code 29) but lack accreditation for machinery manufacturing (IAF Code 18) or construction (IAF Code 28). In Prozorro public procurement tenders, contracting authorities and competing legal teams check the scope annex of the certification body's accreditation certificate: if your industry code isn't covered, your certificate is invalid and your tender bid is disqualified.
3. Validate global recognition in IAF CertSearch: for exporters supplying the EU, North America, or the Middle East, international buyers verify accredited certificates through the global IAF CertSearch database. Having your certificate listed there satisfies corporate vendor compliance immediately.

Integrating ISO 9001 with ISO 14001 (Environment) and ISO 45001 (OH&S)

Because all modern ISO management standards share the identical Annex SL 10-clause architecture, manufacturing, construction, agricultural, and logistics companies frequently build an Integrated Management System (IMS / ІСУ) combining ISO 9001 with environmental management under ISO 14001 and occupational health and safety under ISO 45001:

• Single documentation core: organizational context (4.1-4.2), document and record control (7.5), competence matrices (7.2), internal audit programs (9.2), Management Review minutes (9.3), and CAPA procedures (10.2) are maintained as a single unified set rather than three separate silos.
• Unified risk assessment: one integrated register tracks quality and process stability risks (ISO 9001), environmental aspects, waste, and emissions (ISO 14001), and workplace occupational hazards (ISO 45001).
• 20% to 30% reduction in external audit man-days (IAF MD 11): when an accredited certification body audits an integrated system simultaneously, mandatory rules under IAF MD 11 reduce combined audit duration by 20% to 30% compared to three standalone audits.

How long does ISO 9001 preparation take, and what drives the budget? The timeline and cost depend on your current process maturity, headcount, inclusion of Clause 8.3 design, and number of sites. For a detailed breakdown of certification body fees and consulting budgets, see our guide on how much ISO 9001 certification costs in Ukraine.

The costliest mistake companies make is downloading generic template binders two weeks before an audit. When an external auditor sees references to departments your company doesn't have and finds zero live records of incoming material inspection or gauge calibration on the shop floor, Stage 2 gets postponed and you miss your tender deadline.

How Ekontrol Engineers Deliver Turnkey ISO 9001 Preparation

At Ekontrol (Еконтроль), we engineer quality management systems that cut real operational rework and pass NAAU or European accredited audits on the first attempt:

1. Clause-by-Clause Diagnostic Audit (Gap Analysis): we start with a thorough QMS diagnostic audit. Our lead engineers inspect your current workflows, ERP/WMS records, metrology setup, and production lines against Clauses 4 through 10, delivering a concrete gap report, timeline, and fixed project budget.
2. Custom Process Architecture and Lean QMS Documentation: through our turnkey ISO 9001 implementation service, we build lean, practical documentation tailored to your operations: Clause 4.3 Scope, Clause 4.4 Process Map and Turtle diagrams, Risk & Opportunity Register (pre-aligned with Amd 1:2024 and ISO 9001:2026), 4-level Skill Matrices, one-page visual SOPs, and ERP record templates.
3. Staff Training, ISO 19011 Internal Audit, and Management Review: we train your process owners and internal audit team, execute a complete internal audit across all departments (Clause 9.2), help close real CAPA records (Clause 10.2), and prepare executive leadership for a compliant Management Review (Clause 9.3).
4. Full Engineering Support During Stage 1 and Stage 2 Audits: under our certification audit support service, we help you select the right accredited certification body (NAAU for Ukrainian Prozorro tenders or an European EA MLA / IAF CertSearch body for export), guide your team through Stage 1 and Stage 2, and resolve any auditor questions immediately.
5. Ongoing Post-Certification Support Across the 3-Year Cycle: to keep your QMS running smoothly between audits and pass Year 1 and Year 2 surveillance visits (plus your ISO 9001:2026 transition) without pulling your engineers off production, we provide annual management system support.

The matrix below compares implementation timelines, IAF MD 5 audit durations, and engineering priorities by company size. To get an exact timeline and cost calculation for your business scope, reach out via the Ekontrol contact page.

Below are concise, engineering-verified answers to the questions CEOs, plant directors, quality managers, and tender specialists ask most often about DSTU EN ISO 9001:2018 (ISO 9001:2015), the ISO 9001:2026 transition, and accredited certification audits.