The short answer
An ISO 9001 consultant helps you build a quality management system (QMS) that meets clauses 4 to 10 of ISO 9001, then prepares you for the Stage 1 and Stage 2 certification audits. Most small and medium-sized organisations are ready in three to six months. The consultant never issues the certificate: an independent certification body does.
On this page
- What does an ISO 9001 consultant do?
- How to get ISO 9001 certification in the UK
- Which edition of ISO 9001 applies?
- How much does ISO 9001 certification cost?
- ISO 9001 for small businesses
- How long does ISO 9001 certification take?
- ISO 9001 consultant vs certification body
- Running ISO 9001 alongside ISO 27001
- ISO 9001 consultants in Manchester, Lancashire and across the UK
- Why Sovereign Secure
- Get a fixed ISO 9001 quote
An ISO 9001 consultant helps you design, document and run a quality management system (QMS) that meets ISO 9001, then gets you ready for the certification audit. Sovereign Secure provides the consultancy. An independent certification body, our partner MQA International, carries out the Stage 1 and Stage 2 audits and makes the certification decision.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy and an IASME-licensed Cyber Essentials certification body, headquartered in Accrington, Lancashire. ISO 9001 sits within our wider ISO certification service, alongside ISO 14001, 45001, 22301, ISO 22000 for food safety, ISO 13485 for medical devices and more.
What is ISO 9001? It is the international standard for a quality management system: the processes, responsibilities and records that make sure you deliver what customers asked for and keep improving. If you are new to it, our guide explains what ISO 9001 is, its seven quality principles and what the 2026 edition changed.
What does an ISO 9001 consultant do?
An ISO 9001 consultant turns the standard into a system that fits how you already work, so the certification audit tests your real processes rather than a template pack.
| Service | What you get | When |
|---|---|---|
| Gap analysis | Processes rated against clauses 4 to 10, with a prioritised plan | First; it sizes the project |
| QMS design | Process map, scope, risks and opportunities, quality objectives | Before documents are written |
| Documentation | Quality policy and only the procedures and records you need | Replacing a template pack |
| Training | Staff awareness; coaching for process owners and top management | Before go-live |
| Internal audit | Impartial clause 9.2 audit with corrective actions | Before Stage 2, then yearly |
| Management review | Inputs and minutes that meet clause 9.3 | Before Stage 2, then yearly |
| Audit support | Help at Stage 1 and Stage 2, and with closing findings | Every certification body visit |
How to get ISO 9001 certification in the UK
You get ISO 9001 certification in the UK by building and running a QMS, then passing a two-stage audit by an independent certification body.
- Agree scope. Which sites, products and services must the certificate cover, and for which customers or tenders?
- Gap analysis. Measure current practice against every clause of ISO 9001.
- Design and document the QMS. The standard requires far fewer documents than most template packs contain.
- Run it. Produce the records auditors sample: customer feedback, supplier evaluations, nonconformities, objectives tracked.
- Internal audit and management review. Both must be complete before Stage 2.
- Stage 1 audit (MQA International). Documentation review and readiness check.
- Stage 2 audit (MQA International). Interviews and record sampling to confirm the QMS works. The certificate is issued once any major nonconformities are closed and the certification body has accepted your plan for any minor ones.
What does ISO 9001 require?
| Clause | What it requires | Common gap |
|---|---|---|
| 4 Context | Internal and external issues (including climate change, added in 2024), interested parties, scope | Design excluded without justification |
| 5 Leadership | Top management accountability, customer focus, quality policy | Policy never used to set objectives |
| 6 Planning | Risks and opportunities, measurable quality objectives | Objectives with no measure, owner or date |
| 7 Support | Resources, measuring equipment, competence, awareness, document control | No evidence of competence |
| 8 Operation | Customer requirements, design, suppliers, service delivery, nonconforming outputs | Long-standing suppliers never evaluated |
| 9 Performance evaluation | Monitoring, customer satisfaction, internal audit, management review | No customer satisfaction data |
| 10 Improvement | Nonconformity, corrective action, continual improvement | Complaints fixed, root causes never recorded |
Which edition of ISO 9001 applies?
ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015. Certificates to the 2015 edition stay valid during a three-year transition period that ends in September 2029, and the clause 4 to 10 structure is unchanged, so a QMS built to the 2015 edition carries forward rather than starting again. Our guide to ISO 9001:2026 covers what changed and what certified organisations need to do.
How much does ISO 9001 certification cost?
ISO 9001 certification cost has three parts: certification body audits across a three-year cycle, any consultancy you buy, and your team’s time. Headcount, sites and complexity set both the auditor days and the consultancy effort, so there is no single price.
| Cost item | Who you pay | When | What drives it |
|---|---|---|---|
| Copy of ISO 9001 | ISO or a national standards body | Once | Fixed publication price |
| Consultancy | Consultant | Mostly year 1 | The gaps found, and how much you want done for you |
| Stage 1 and Stage 2 audits | Certification body | Year 1 | Auditor days, set from people in scope, complexity and sites |
| Surveillance audits | Certification body | Years 2 and 3 | Shorter audits, same drivers |
| Recertification audit | Certification body | Before expiry | Same drivers |
| Staff time | Your organisation | Throughout | Documents, training and audit days |
Design work, regulated products and heavy outsourcing widen the audit; documented processes and a realistic deadline cut consultancy days.
Be wary of very cheap certificates: check who issues the certificate and confirm your largest customers accept it. We can quote our consultancy and MQA International’s audits together, so you see the three-year cost up front. Pricing information security too? See ISO 27001 certification cost.
ISO 9001 for small businesses
ISO 9001 works well for small businesses because its requirements describe outcomes, not paperwork. A ten-person firm can meet them with a few short documents and the tools it already uses.
| Documented information | What ISO 9001:2015 asks for |
|---|---|
| Documents you must maintain | QMS scope (4.3), quality policy (5.2), quality objectives (6.2), and whatever you need to run processes consistently (4.4) |
| Main records you must retain | Measuring equipment checks (7.1.5), competence (7.2), review of customer requirements (8.2.3), design and development (8.3), supplier evaluation (8.4.1), release (8.6), nonconforming outputs (8.7), monitoring results (9.1.1), internal audit (9.2), management review (9.3), corrective actions (10.2) |
| Everything else | Optional: write it down only if it helps people do the job consistently |
These are the ISO 9001:2015 requirements. ISO 9001:2026 keeps the clause 4 to 10 structure but updates the wording on documented information, clarifying that it “shall be available”, so check this list against the 2026 text when you plan your transition.
Two shortcuts help small firms. If you do not design products or services, clause 8.3 can be justified as not applicable. And because internal auditors must be objective and impartial (clause 9.2.2), which is hard when everyone owns a process, outsourcing the internal audit is often simpler than training someone.
How long does ISO 9001 certification take?
Most small and medium-sized organisations are ready for certification in three to six months; those with written processes or an existing ISO 27001 system tend to be quicker.
The certificate lasts three years. MQA International returns for a surveillance audit in each of years two and three, then a recertification audit before expiry.
ISO 9001 consultant vs certification body
A consultant helps you build the QMS; a certification body audits it. The roles must stay separate.
| Aspect | ISO 9001 consultant (Sovereign Secure) | Certification body (MQA International) |
|---|---|---|
| Role | Designs, documents and embeds the QMS with you | Audits the QMS and decides on certification |
| Advises on fixes? | Yes, that is the job | No: ISO/IEC 17021-1 requires impartiality |
| Issues the certificate? | No | Yes |
| Required for certification? | Optional | Yes |
Certification or accreditation? People often say “ISO 9001 accreditation”, but organisations are certified; certification bodies are accredited. Our partner certification body, MQA International, is accredited for ISO 9001 by IAS, the International Accreditation Service. If a tender specifies a particular accreditation body, tell us at the start and we will confirm how your certificate will be issued before you commit.
Running ISO 9001 alongside ISO 27001
Both standards share the same clause 4 to 10 structure, so quality and information security can run as one integrated management system, with one risk register, one internal audit programme and one management review. Our comparison of ISO 9001 vs 27001 sets out the differences and how to run both, and our ISO 27001 consultancy covers the information security half. Manufacturers often face customer security questionnaires alongside quality audits; our page on manufacturing cyber security covers that side.
The same shared structure lets ISO 9001 run with environment and health and safety. ISO 9001, ISO 14001 certification and ISO 45001 certification are often built as one integrated system with one set of policies, internal audits and management reviews, and asset-intensive organisations add ISO 55001 asset management to cover the plant and infrastructure their services depend on.
ISO 9001 consultants in Manchester, Lancashire and across the UK
We work across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka. We support ISO 9001 clients across Lancashire, Manchester and the North West, and remotely across the rest of the UK. See our pages on cyber security in Manchester and cyber security in Lancashire for the security services we provide locally.
Why Sovereign Secure
- We hold ISO 27001 ourselves, so we go through the same surveillance audits we prepare clients for.
- One enquiry, independent audit. We consult; MQA International certifies.
- Tender-ready. If a bid also asks for Cyber Essentials certification, we issue it directly as an IASME-licensed certification body.
- Established and UK-based. A UK company since 2012 (Companies House 08334453), headquartered at 16 Whalley Road, Accrington, Lancashire.
Get a fixed ISO 9001 quote
Tell us how many people and sites are in scope, what you do (including any design work or outsourced processes), any certificates you already hold and your deadline. We will send a fixed quote for the consultancy and can include MQA International’s certification audits, so the full cost is clear before you commit. Request your ISO 9001 quote or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
