How to obtain ISO 9001? When I was first asked to lead the implementation of ISO 9001 at Digital Works Group, my honest reaction was a mix of uncertainty as this was something I had no experience of.  I had no real previous ISO experience at all, apart from being on the periphery of an ISO 27001 audit some years ago.  Beyond a general understanding of what “quality management” ought to mean, I didn’t really know what ISO 9001 involved in practice. 

What followed over the next nine months was a journey that was part research exercise, part delivery programme, and part organisational learning experience. This is my reflection on how we approached ISO 9001 at Digital Works Group, not as a textbook exercise, but as a practical attempt to build something proportionate, usable, and genuinely valuable to the business. 

The initial driver for ISO 9001 at Digital Works Group was, quite frankly, commercial.  As a consultancy, the government and public sector is very important to us, and this has increased over the last eighteen months.  To support and strengthen this element of our Go-To-Market approach we signed up to join several government procurement frameworks such as TS4, BoE and JOSCAR (which act as pre-qualification mechanism for suppliers bidding for public sector work).

One of the consistent requirements across these frameworks is ISO 9001 certification, or demonstrable quality management compliance. In simple terms, ISO 9001 was becoming a prerequisite for participating in the markets we wanted to operate in. 

Alongside the external drivers, there were internal ones too. We wanted greater consistency in how we delivered consulting engagements. We wanted to scale without relying on heroics or tribal knowledge. And we wanted to mature the business, both operationally and culturally, so that quality wasn’t something implicit, but something visible and repeatable. 

There was also a longer-term strategic consideration. One of the potential exit paths for Digital Works Group over the coming years is a sale.  A business that can demonstrate mature governance, repeatable delivery, and embedded quality practices is simply more attractive, and less risky, to a buyer. 

So, while ISO 9001 started as a commercial necessity, it quickly became clear that, if done properly, it could be a lever for broader business maturity rather than just a compliance badge. 

When I say I started from zero, I genuinely mean that. Back in April 2025, I was asked to “get us ISO 9001 certified” with a target of early 2026. At that point, I had no direct experience of ISO 9001 itself. I’d encountered other standards, like ISO 27001, but this felt different. Broader and less obviously technical. 

My initial perception, if I’m honest, was that ISO 9001 was going to be bureaucratic, document-heavy, and potentially quite painful. I imagined large volumes of policy documents and processes that no one would ever read. The first challenge was simply knowing where to start. 

The obvious starting point was the ISO 9001 standard itself. One of the first things I did was to purchase the standard from the ISO website (https://www.iso.org/home.html). If you’ve never read it, ISO 9001 is surprisingly short. Once you strip out the introductory material, it’s around 20 pages of actual requirements, structured into a series of clauses.  What struck me almost immediately was how non-prescriptive it is. The standard tells you what you should do, but not how you should do it. The clauses are deliberately vague, leaving a lot of room for interpretation. That’s both a strength and a challenge, especially when you’re new to it. 

Reading the standard didn’t give me a clear “step one, step two, step three” roadmap. So, I widened the research. I spent time reading blogs, guidance articles, and examples online. I used Google extensively, but also tools like ChatGPT to help interpret clauses and explore how others had approached similar problems. That proved surprisingly useful, not as a source of answers, but as a way of accelerating understanding and structuring thinking. 

One of the most valuable things I did early on, though, was talk to people. Through internal conversations, I realised that a couple of our delivery partners were also on the ISO 9001 journey. I set up calls with them to compare notes, understand their approaches, and share what little I’d learned so far. Unsurprisingly, they were grappling with many of the same questions. 

These partners were kind enough to invite me to join vendor calls that they had setup with quality management system (QMS) software providers.  Even though I wasn’t convinced we would buy a tool, those conversations were incredibly informative. Vendors have a way of implicitly teaching you the shape of the problem, even when you don’t buy the solution.  Some of them had software you could try free for a week, and some of the material on these tools was also really helpful in shaping my understanding.  For example, one even had a draft outline of a Quality Manual. I also spoke to individuals who had been through ISO 9001 before – including a contact of one of our consultants. Those real-world conversations were, without doubt, the most valuable learning of all. 

“The biggest takeaway from this phase was that ISO 9001 isn’t really about documents. It’s about having a management system that works, is followed, and can be evidenced”.  Jason Hill 

After a couple of months of research, I finally felt confident enough to move from theory to execution. I built a high-level project plan that would take us to certification by the end of 2025 or early 2026. That plan wasn't complex, but it was structured. It broke ISO 9001 down into manageable workstreams rather than treating it as a single monolithic task. One of the earliest deliverables was a Quality Policy, which we put in place relatively quickly. The more time-consuming work came next. 

One of the most important things I learned early on was the value of a clause-by-clause gap analysis. ISO 9001 is structured into a series of clauses covering different aspects of organisational management. I went through each clause in detail, interpreted what the standard was asking for, and then assessed where Digital Works Group currently stood. For each clause, I asked three questions: 

• Where are we now? 

• Where does the standard expect us to be? 

• What's the gap? 

Those gaps then became concrete actions that fed directly into the project plan. This exercise took time, a good couple of months which was longer than I expected, but it was transformational. It turned a vague standard into a tangible set of tasks. It also forced me to confront where we were strong, where we were inconsistent, and where we were simply relying on unwritten knowledge. By August, I had a complete gap analysis and a growing concern that I might have over-engineered the solution. 

That concern prompted one of the best decisions I made during the project: bringing in an external ISO 9001 consultant to sanity-check our approach. I sourced the consultant through discussions with a couple of the ISO certification bodies, asking them for recommendations. The brief was simple: validate the plan, review the gap analysis, and tell me whether what we were building was proportionate for a boutique consultancy. 

The feedback was invaluable. We adjusted the scope, removed elements that weren't relevant, clarified others where my interpretation of the standard had been imperfect and, most importantly, aligned what we were building with what auditors expect to see. The consultant also reviewed our emerging Quality Manual, helping ensure it wasn't too light, too heavy, or filled with unnecessary content.  This was also useful as there was some repetition in there which I was able to remove. That external perspective gave me confidence that we were building something credible, realistic, and certifiable. 

Alongside all of this, I was evaluating whether we should buy an off-the-shelf quality management system. I looked at four products in detail, attended vendor demos, and trialled a couple of systems. While they offered some structure, I wasn’t convinced they represented good value for Digital Works Group, especially at £5,000–£8,000 per year per standard.  That cost would increase should we add in additional ISO standards in the future. Ultimately, I decided to build our own QMS using tools we already had: Microsoft 365 (SharePoint) and Monday.com. The division was simple: 

• SharePoint became our controlled document repository — housing the Quality Manual, policies, processes, templates, audit reports, and evidence. 

• Monday.com became our operational control hub — managing logs, non-conformities, corrective actions, risks, audits, improvements, and automation.

This approach worked because we already had organisational capability in both tools. It avoided additional cost, reduced training overhead, and allowed us to tailor the system to how we work. Importantly, it didn’t require coding. Everything was configured using native features and simple automation. 

I think the commercially available tools certainly have a place, especially for larger organisations or people looking to implement several standards concurrently. Ultimately, each organisation needs to make that decision based on their current situation 

Technology alone doesn't embed quality. Alongside the tooling, we developed the required policies early, partly driven by government framework requirements and then focused heavily on training and awareness. I ran multiple sessions with staff explaining what ISO 9001 is, why we're doing it, how we're implementing it, and what it means for them day to day. We reinforced this in regular team meetings and leadership forums. 

One realisation I had during this phase was that training isn't a one-off event. Certification creates a moment of focus, but maintaining ISO requires ongoing reinforcement. You can't relax once the certificate arrives. Senior leadership support was critical here. Having leaders actively reinforce quality expectations made a noticeable difference.

The turning point for many people was the internal audit. We ran a three-day internal audit with our external consultant acting as auditor. It was deliberately structured as a dry run for the real thing – thorough, challenging, but safe. About eight people were involved across different areas of the business. The experience of having to explain processes to someone completely new and then evidence that those processes were being followed really helped make it real, putting this all into context. 

We identified six non-conformities and a couple of opportunities for improvement. More importantly, we exposed where practice and documentation didn’t quite align. That process made ISO real. It stopped being abstract and became something tangible, understandable, and relevant. 

My best analogy for describing ISO 9001 simply during training, was being like a recipe for baking a cake. ISO 9001 isn’t the cake. It doesn’t tell you what to make or how creative to be. Instead, it’s the recipe: a shared, written way of working that helps you achieve consistent results. 

When everyone follows the same recipe, you’re not relying on memory, heroics, or who happens to be in the kitchen that day. You know what ingredients you need, how the process works, and how to check the outcome before it reaches a customer. 

Most importantly, ISO 9001 expects you to improve the recipe over time.  If something doesn’t work, you fix the process — not the people. At its core, ISO 9001 is about consistency, learning, and continuous improvement. 

We attained our ISP 9001:2015 QMS certification in January 2026 and it’s fair to say that ISO 9001 has changed how we think about the business. Not because of the certificate, but because of the discipline it forced us to apply. 

Key Lessons from Our ISO 9001 Journey 

• ISO 9001 is a management discipline, not a documentation exercise. The paperwork only matters if it reflects how the business runs. 

• Start with understanding, not tools. Talking to people who’ve done it before taught me far more than any template or software demo. 

• A clause-by-clause gap analysis is worth the effort. It turns a vague standard into a concrete, deliverable plan. 

• Proportionate beats perfect. A QMS that fits a boutique consultancy is very different from one designed for a global enterprise. 

• Off-the-shelf QMS tools aren’t automatically the answer. Building on systems your people already use can be cheaper, more flexible, and more likely to stick. 

• Internal audits make ISO real. Nothing embeds understanding faster than having to explain — and evidence — how you work. 

• Certification is a milestone, not the finish line. The real work starts after you pass, when you have to keep the system alive. 

• Finally, for those who are thinking of starting an ISO journey or those early in the process, have confidence. It is achievable if you are open to advice and approach it in a structured manner. 

ISO 9001 isn’t about paperwork. It’s about clarity. If you approach it as a box-ticking exercise, that’s exactly what you’ll get. If you approach it as an opportunity to make implicit practices explicit, to improve consistency, and to build something scalable, it can be genuinely valuable. Fundamentally it can help mature your business. 

“We didn’t aim for perfection. We aimed for something proportionate, usable, and improvable. That, I’ve learned, is very much in the spirit of ISO 9001 itself.” Jason Hill