---
title: "ISO 9001 Certification: What It Does and Does Not Cover"
description: "ISO 9001 certifies a shop's quality system, not your parts. How to verify a certificate, why the scope statement matters most, and what to ask instead."
canonical: https://openspindle.com/blog/iso-9001-certification
author: "Bryan Petro"
datePublished: 2026-08-28T00:00:00.000Z
dateModified: 2026-08-28T00:00:00.000Z
category: "Quality & Compliance"
---

# ISO 9001: What the Certificate Actually Covers

ISO 9001 certifies that a shop has documented a quality management system and follows it. It does not certify your parts, your tolerances or your inspection results, and it does not mean the shop has ever made a part like yours. The field that matters most is the scope statement, which names the activities and the sites the certification actually covers. A certificate scoped to sheet metal fabrication tells you nothing about the same company's machining cell.

## What ISO 9001 actually certifies

ISO 9001 is a management system standard. An accredited auditor visits the company, samples its procedures and records, and confirms that the business has documented how it controls quality and is genuinely operating that way.

That covers real things. A certified shop has a documented process for reviewing your order before accepting it, for controlling which revision of your drawing is on the shop floor, for calibrating its measuring equipment on a schedule, for handling nonconforming parts instead of quietly reworking them, and for investigating problems rather than repeating them. Those are the habits that separate a shop that catches its own mistakes from one that ships them to you.

What you are buying with an ISO 9001 requirement is a floor on process discipline. That is worth something. It is just not what most buyers think they are buying.

## What it does not certify

It does not certify the part. No auditor looked at your drawing, checked a dimension, or verified that the shop can hold your tolerance. Certification says the shop has a system for controlling quality, not that the output of that system meets your requirement.

It does not imply capability. A certified shop with three manual mills is still a shop with three manual mills. The certificate says nothing about machine list, tolerance capability, material experience or whether they have ever made anything resembling your part.

It does not mean inspection reports come with your parts. Inspection happens because you asked for it in the purchase order, not because the shop is certified. This surprises people regularly.

And it does not survive neglect. Certificates expire, get suspended, and get withdrawn. A PDF someone emailed you in 2023 proves nothing about today.

| Buyers often assume | What is actually true |
| --- | --- |
| The parts will meet spec | The shop has a system for controlling quality. Conformance is still your purchase order's job |
| The shop can hold tight tolerances | Capability is a machine and process question, unrelated to certification |
| Inspection data comes as standard | Only if you specify it. Ask for a dimensional report or FAI explicitly |
| Material certs are included | Only if required on the order. Ask for mill test reports by heat number |
| The certificate applies company wide | It applies only to the scope and sites listed on the certificate |
| It is current because they sent it | Certificates lapse and get suspended. Check the expiry and the registry |

## The scope statement is the field people skip

Every certificate carries a scope statement: a sentence describing the activities and locations covered. It is the single most useful line on the document and almost nobody reads it.

A company can hold a certificate scoped to "manufacture of sheet metal enclosures" at one site while running an uncertified machine shop at another. Everything they say is true. The certificate is real, it is current, and it covers nothing you are buying.

Read the scope against your part. If you are ordering machined components, the scope should mention machining. If you are ordering from a second facility, that site should be named or the certificate should cover multiple sites explicitly. If the scope is vague, ask for the site address and the covered processes in writing.

## How to verify a certificate in five minutes

A certificate is a claim until you check it. All the information you need is on the document itself, and the check takes minutes.

The accreditation point is the one people miss. Certification bodies are themselves accredited by a national body, and an accredited certificate carries that mark. An unaccredited certificate means someone was paid to issue a document with limited independent oversight behind it. It is not automatically worthless, but it is a different thing, and you should know which one you are holding.

| Field | What to check | Why it matters |
| --- | --- | --- |
| Certificate number | Present, and searchable in the issuing body's public registry | Confirms the certificate exists outside the PDF you were sent |
| Certification body | Named, and accredited by a recognized national accreditation body | An unaccredited certificate carries little independent oversight |
| Accreditation mark | Logo of the accreditation body, not just the certifier's own logo | Distinguishes an audited certificate from a purchased one |
| Scope statement | Names the processes you are actually buying | A certificate can be real and still not cover your work |
| Site address | Matches the facility that will make your parts | Multi site companies frequently certify only one location |
| Issue and expiry dates | Current, within a three year cycle with annual surveillance | Lapsed and suspended certificates circulate for years |

## What this costs you

Requiring ISO 9001 narrows your supplier pool, and the cost of that is real. Certification runs into the thousands of dollars a year in audit fees before counting the internal time to maintain the system, which is why plenty of excellent small shops never bother. If you filter on the certificate alone you will exclude capable suppliers and pay more for the ones that remain.

The cost shows up in price and lead time rather than as a line item. On a low volume job the practical effect is often a longer search and a higher quote for no measurable quality difference.

The defensible position is to require certification where something downstream requires it, and to require evidence everywhere else. If your customer, your regulator or your own quality system mandates a certified supply chain, the requirement is not negotiable. If it does not, asking for the right documents on the order buys you more real protection than the certificate does.

## What to ask for when a shop is not certified

An uncertified shop can give you nearly everything certification implies, if you ask on the purchase order. The requests below are ordinary and any competent shop will meet them without drama.

Ask how they control drawing revisions, and how they will confirm which revision they built to. Ask whether their measuring equipment is on a calibration schedule and whether they can produce the certificates. Ask for a first article inspection on the first run, and a dimensional report against your critical dimensions. Ask for material certification traceable to a heat number. Ask what they do when a part is out of tolerance, and listen for whether the answer includes telling you.

Those five answers tell you more about a shop than a certificate does, because they are specific to your part and cannot be bought.

## ISO 9001 against the standards built on top of it

Most industry quality standards are ISO 9001 plus sector requirements, which is why a shop pursuing AS9100 or IATF 16949 is meeting the ISO 9001 requirements as well. Match the standard to what your product actually has to satisfy rather than requesting the most impressive acronym.

| Standard | Sector | Adds to ISO 9001 | When to require it |
| --- | --- | --- | --- |
| ISO 9001 | General | Baseline quality management system | Default for commercial and industrial parts |
| AS9100 | Aerospace and defense | Risk management, configuration control, counterfeit part prevention, first article inspection per AS9102 | Flight hardware, or when your customer mandates it |
| IATF 16949 | Automotive | APQP, PPAP, MSA and SPC as mandatory disciplines | Automotive production supply, rarely for prototypes |
| ISO 13485 | Medical devices | Design controls, risk management, sterile and traceability requirements | Devices and components in a regulated submission |
| ISO 14001 | Environmental | Environmental management, not quality | Corporate sustainability requirements, not part quality |

## What to send, and what to ask

Send the drawing with critical dimensions identified, your annual volume, and any standard your end customer imposes on you. A shop cannot tell you whether its certification is relevant to your job if it does not know what the job has to satisfy.

Then ask four questions. What is the scope on your certificate, and does it cover machining at the site that will run this part? Can you send the certificate and the certification body's registry entry? Will you provide a first article inspection and a dimensional report on the critical dimensions? Can you supply material certification traceable to heat number?

If the answers are yes, the certificate has stopped being the thing you are relying on, which is the correct place for it to end up.

## Related reading

- [PPAP submission levels](https://openspindle.com/blog/ppap-levels-explained.md)
- [First article inspection](https://openspindle.com/blog/first-article-inspection.md)
- [How to read a mill test report](https://openspindle.com/blog/mill-test-report.md)
- [CNC machining tolerance chart](https://openspindle.com/reference/cnc-machining-tolerance-chart.md)

## Frequently asked questions

### Does ISO 9001 certification mean my parts will be good?

No. It means the shop has a documented quality management system and an auditor confirmed they follow it. Nobody audited your part. Conformance to your drawing comes from what you specify on the purchase order: a first article inspection, a dimensional report on critical dimensions, and material certification. Certification raises the odds that a shop catches its own mistakes. It does not guarantee your dimensions.

### How do I check whether a shop's ISO 9001 certificate is real?

Take the certificate number and the certification body from the document and search the certification body's public registry. Confirm the certificate is current, that the accreditation mark of a recognized national accreditation body is present, and that the scope statement covers the processes and the site making your parts. An unaccredited certificate is a different product from an accredited one.

### What is the difference between ISO 9001 certified and ISO 9001 compliant?

Certified means an accredited third party audited the shop and issued a certificate. Compliant is a self declaration with nobody checking. Plenty of good shops are genuinely compliant and never paid for certification, particularly small shops where the audit cost is hard to justify. Treat compliant as a reasonable starting point that you verify with your own questions, not as an equivalent claim.

### Do I need an ISO 9001 shop for a prototype?

Usually not. Prototype work is about turnaround, communication and manufacturability feedback, and the certification adds cost and narrows your options without adding much at quantities of a few parts. The exception is when prototype parts feed a regulated submission or your customer's quality system reaches down to your suppliers. Then the requirement comes from downstream and is not yours to waive.

### What does the scope statement on a certificate mean?

It is the sentence naming the activities and sites the certification covers. It is the field that decides whether the certificate is relevant to you. A company can hold a genuine certificate scoped to one process at one facility while running uncertified operations elsewhere. Read the scope against the work you are placing, and confirm the site address matches the plant that will actually run the job.

### Is AS9100 better than ISO 9001?

It is not better, it is aerospace specific. AS9100 contains the ISO 9001 requirements and adds risk management, configuration control, counterfeit part prevention and first article inspection per AS9102. If you are not making flight hardware and your customer does not require it, AS9100 mostly buys you a smaller supplier pool and a higher price. Match the standard to what your product must satisfy.