Quality & Compliance
ISO 9001: What the Certificate Actually Covers
The short answer
ISO 9001 certifies that a shop has documented a quality management system and follows it. It does not certify your parts, your tolerances or your inspection results, and it does not mean the shop has ever made a part like yours. The field that matters most is the scope statement, which names the activities and the sites the certification actually covers. A certificate scoped to sheet metal fabrication tells you nothing about the same company's machining cell.
What ISO 9001 actually certifies
ISO 9001 is a management system standard. An accredited auditor visits the company, samples its procedures and records, and confirms that the business has documented how it controls quality and is genuinely operating that way.
That covers real things. A certified shop has a documented process for reviewing your order before accepting it, for controlling which revision of your drawing is on the shop floor, for calibrating its measuring equipment on a schedule, for handling nonconforming parts instead of quietly reworking them, and for investigating problems rather than repeating them. Those are the habits that separate a shop that catches its own mistakes from one that ships them to you.
What you are buying with an ISO 9001 requirement is a floor on process discipline. That is worth something. It is just not what most buyers think they are buying.
What it does not certify
It does not certify the part. No auditor looked at your drawing, checked a dimension, or verified that the shop can hold your tolerance. Certification says the shop has a system for controlling quality, not that the output of that system meets your requirement.
It does not imply capability. A certified shop with three manual mills is still a shop with three manual mills. The certificate says nothing about machine list, tolerance capability, material experience or whether they have ever made anything resembling your part.
It does not mean inspection reports come with your parts. Inspection happens because you asked for it in the purchase order, not because the shop is certified. This surprises people regularly.
And it does not survive neglect. Certificates expire, get suspended, and get withdrawn. A PDF someone emailed you in 2023 proves nothing about today.
| Buyers often assume | What is actually true |
|---|---|
| The parts will meet spec | The shop has a system for controlling quality. Conformance is still your purchase order's job |
| The shop can hold tight tolerances | Capability is a machine and process question, unrelated to certification |
| Inspection data comes as standard | Only if you specify it. Ask for a dimensional report or FAI explicitly |
| Material certs are included | Only if required on the order. Ask for mill test reports by heat number |
| The certificate applies company wide | It applies only to the scope and sites listed on the certificate |
| It is current because they sent it | Certificates lapse and get suspended. Check the expiry and the registry |
The scope statement is the field people skip
Every certificate carries a scope statement: a sentence describing the activities and locations covered. It is the single most useful line on the document and almost nobody reads it.
A company can hold a certificate scoped to "manufacture of sheet metal enclosures" at one site while running an uncertified machine shop at another. Everything they say is true. The certificate is real, it is current, and it covers nothing you are buying.
Read the scope against your part. If you are ordering machined components, the scope should mention machining. If you are ordering from a second facility, that site should be named or the certificate should cover multiple sites explicitly. If the scope is vague, ask for the site address and the covered processes in writing.
How to verify a certificate in five minutes
A certificate is a claim until you check it. All the information you need is on the document itself, and the check takes minutes.
The accreditation point is the one people miss. Certification bodies are themselves accredited by a national body, and an accredited certificate carries that mark. An unaccredited certificate means someone was paid to issue a document with limited independent oversight behind it. It is not automatically worthless, but it is a different thing, and you should know which one you are holding.
| Field | What to check | Why it matters |
|---|---|---|
| Certificate number | Present, and searchable in the issuing body's public registry | Confirms the certificate exists outside the PDF you were sent |
| Certification body | Named, and accredited by a recognized national accreditation body | An unaccredited certificate carries little independent oversight |
| Accreditation mark | Logo of the accreditation body, not just the certifier's own logo | Distinguishes an audited certificate from a purchased one |
| Scope statement | Names the processes you are actually buying | A certificate can be real and still not cover your work |
| Site address | Matches the facility that will make your parts | Multi site companies frequently certify only one location |
| Issue and expiry dates | Current, within a three year cycle with annual surveillance | Lapsed and suspended certificates circulate for years |
What this costs you
Requiring ISO 9001 narrows your supplier pool, and the cost of that is real. Certification runs into the thousands of dollars a year in audit fees before counting the internal time to maintain the system, which is why plenty of excellent small shops never bother. If you filter on the certificate alone you will exclude capable suppliers and pay more for the ones that remain.
The cost shows up in price and lead time rather than as a line item. On a low volume job the practical effect is often a longer search and a higher quote for no measurable quality difference.
The defensible position is to require certification where something downstream requires it, and to require evidence everywhere else. If your customer, your regulator or your own quality system mandates a certified supply chain, the requirement is not negotiable. If it does not, asking for the right documents on the order buys you more real protection than the certificate does.
What to ask for when a shop is not certified
An uncertified shop can give you nearly everything certification implies, if you ask on the purchase order. The requests below are ordinary and any competent shop will meet them without drama.
Ask how they control drawing revisions, and how they will confirm which revision they built to. Ask whether their measuring equipment is on a calibration schedule and whether they can produce the certificates. Ask for a first article inspection on the first run, and a dimensional report against your critical dimensions. Ask for material certification traceable to a heat number. Ask what they do when a part is out of tolerance, and listen for whether the answer includes telling you.
Those five answers tell you more about a shop than a certificate does, because they are specific to your part and cannot be bought.
ISO 9001 against the standards built on top of it
Most industry quality standards are ISO 9001 plus sector requirements, which is why a shop pursuing AS9100 or IATF 16949 is meeting the ISO 9001 requirements as well. Match the standard to what your product actually has to satisfy rather than requesting the most impressive acronym.
| Standard | Sector | Adds to ISO 9001 | When to require it |
|---|---|---|---|
| ISO 9001 | General | Baseline quality management system | Default for commercial and industrial parts |
| AS9100 | Aerospace and defense | Risk management, configuration control, counterfeit part prevention, first article inspection per AS9102 | Flight hardware, or when your customer mandates it |
| IATF 16949 | Automotive | APQP, PPAP, MSA and SPC as mandatory disciplines | Automotive production supply, rarely for prototypes |
| ISO 13485 | Medical devices | Design controls, risk management, sterile and traceability requirements | Devices and components in a regulated submission |
| ISO 14001 | Environmental | Environmental management, not quality | Corporate sustainability requirements, not part quality |
What to send, and what to ask
Send the drawing with critical dimensions identified, your annual volume, and any standard your end customer imposes on you. A shop cannot tell you whether its certification is relevant to your job if it does not know what the job has to satisfy.
Then ask four questions. What is the scope on your certificate, and does it cover machining at the site that will run this part? Can you send the certificate and the certification body's registry entry? Will you provide a first article inspection and a dimensional report on the critical dimensions? Can you supply material certification traceable to heat number?
If the answers are yes, the certificate has stopped being the thing you are relying on, which is the correct place for it to end up.