Skip to main content

The 6 Mandatory Procedures Under ISO 9001:2008

  • Author:
  • Updated date:

I am a trainer and consultant in lean manufacturing, Six Sigma, quality management, and business management.

ISO 9001 Standard and Quality Procedures

ISO 9001:2008 is an international standard that defines the requirements for a quality management system: the system by which your company guarantees that all of your processes are controlled and repeatable to ensure the quality of your products and services.

Your processes are normally controlled through the presence of and the audit of written quality ISO 9001 procedures which define what has to be done. ISO 9001:2008 defines the best practice for each process within your organization to ensure control. However, the standard defines just 6 mandatory procedures that you must have;

6 Mandatory Procedures for ISO 9001:2008

  1. Control of Documents (4.2.3)
  2. Control of Records (4.2.4)
  3. Internal Audits (8.2.2)
  4. Control of Non-Conforming Products (8.3)
  5. Corrective Action (8.5.2)
  6. Preventive Action (8.5.3)
ISO 9001 Procedure Flowchart

ISO 9001 Procedure Flowchart

ISO 9001 Procedure Flowchart

ISO 9001 Procedure Flowchart

What Is a Quality Procedure?

A procedure is a statement of what will be done, when it will be done, and by whom. It is a set of instructions and intent that anyone in the company can follow (Not a top secret company document for management eyes only as one quality manager once told me!) It is a specific way to carry out a process, a set of clear instructions that the staff can reference to help them understand and conduct their daily work in an efficient and repeatable manner.

ISO 9001 says that only certain requirements within your quality management system have to have a documented procedure. Other procedure requirements depend on the size and complexity of the processes and the overall system as well as the competence of the staff.

Simple ISO 9001 Procedure

Simple ISO 9001 Procedure

Flowchart: ISO 9001 Procedures vs Word Documents

Flowchart: ISO 9001 Procedures vs Word Documents

Writing an ISO 9001 Procedure

An ISO 9001 procedure does not have to be a hundred page document telling the individual how and when to pick up a pen, check that there is ink of the correct hue before forming letters in the specifically highlighted box on form no.XYZ. Too many people and organizations over-complicate their ISO 9001 procedures.

If you split your procedures and work instructions, then the procedures themselves can be very simple, remember that they only have to contain the right amount of information for the people doing the job to do it efficiently and in the best proscribed way. If your people are of high quality, well trained, experienced, or the process is very simple and obvious then there may be no need for a procedure at all.

I prefer to use simple flow charts to create procedures, use software such as Visio in the office suite of programs. They need to be just a simple step by step instructions saying what is to be done, then the next step in the sequence. They do not have to be overly complex.

For work instruction level, there is also the opportunity to clarify the process using things like photographs to highlight and clarify specific things.

Far too many organizations go over the top with regard to their ISO 9001 procedures, thinking that the weight of their procedure manual is a reflection of the effectiveness of their system. Too many, too complicated procedures just lead to confusion and the likely hood that the system will never be read and followed.

ISO 9001 Procedures Video

Scroll to Continue

Read More From Toughnickel

Mandatory ISO 9001 Procedures

Within ISO 9001 there are only six procedures that are mandatory. You must document these six. This does not mean that you can get away with just these six; the procedures you need will very much depend on the size and complexity of your organization. However, these six are the ones that you must have.

4.2.3 Control of Documents

A written procedure to control the approval and re-approval of procedures prior to issue as well as ensuring that the current revision status is displayed. To ensure that documents are legible and that the current versions are available at point of use. Also ensure that obsolete documents are controlled and documents from external parties such as your customers.

4.2.4 Control of Records

A procedure to control the identification, storage, protection, retrieval, retention and disposal of records.

8.2.2 Internal Audits

A procedure to define a planned program of audits to ensure that your processes meet both ISO 9001 requirements and your own requirements. Also for the reporting, follow up and records of these audits.

8.3 Control of Non-Conforming Product

A procedure to ensure that non-conforming product is not used and action is taken.

8.5.2 Corrective Action

A written procedure to ensure that the root causes of problems are identified and actions taken to correct them, actions must be verified to ensure effectiveness

8.5.3 Preventive Action

A written procedure similar to that for corrective action, but the organization should take steps to identify POTENTIAL problems and eliminate them before a problem occurs.

Implementing ISO 9001 Procedures

Quality Procedure Structure

A procedure can come in many different forms. It can be an overview of a process stating purely what is to be done, by whom and when or it can be specific detailed instructions. Most companies try to separate the two levels of documentation for the sake of clarity, having procedures and then standard operating instructions, work instructions, or other detailed documents at a lower “local” level in the system with the detailed “how to” instructions.

A procedure should detail out a few simple sections before the actual detail of what the procedure actually is, so that you can maintain control of the specific procedure.

  • Scope: What is the area covered by the procedure, i.e. Incoming delivery of consumable items, not including intercompany items.”
  • Responsibility: Who is the owner and responsible person for this procedure, after all, these are process specific documents so the quality manager is not responsible for approving and creating the purchasing procedures for example, that would be the place of the head of purchasing!
  • Control or Issue: What is the issue date, approval, etc. You have to maintain control of your procedures, they need to be approved, people must be able to be sure that this is the current revision etc.
  • References or Related Documents: List out the other documents and forms that may be related and relevant to this procedure.

After these sections would come the actual body of the procedure.

Generic, Off-the-Shelf Procedures

If you are going to develop your ISO 9001 quality management system procedures you might want to consider an alternative to producing everything from scratch. There are many systems that you can buy that have generic procedures and forms already designed and formatted. By entering your company name and other information they can create basic documents that meet the requirements of ISO 9001.

These systems are OK as a starting point to save you the effort of designing from nothing, they will also ensure that you cover all ISO 9001 procedural requirements including the mandatory procedures. Most consultants experienced in installing ISO 9001 systems will use something like this, either a purchased package or something home made.

Beware of companies that advertise to create all of your procedures and provide you with a certificate to say that you meet the requirements of ISO 9001, many of these companies are scams and the certificates are worthless. Unless they are registered with UKAS (link below) then they are not an accredited body that can issue an ISO 9001 certificate.

Additional Help With Your Procedures

The following are some useful links that will help you gain additional information regarding the ISO 9000 standards;

International Organization for Standardization; ISO website where you can find out about other international standards and monitor changes and developments in the standards.

British Standards Institute; British Standards Institute is another well established certification body operating globally, they too can offer certification audits and training to help you implement your ISO 9001:2008 procedures.

The American Standards Organization; (ANSI) American Standards Organization can help you implement your ISO 9001 procedures in much the same way as Lloyds and BSI above.

International Register of Certified Auditors (IRCA); The International Register of Certified Auditors is where you go to check the qualifications of an individual trainer or auditor.

UKAS; The United Kingdom Accreditation Service is responsible for accrediting the certification bodies to be able to conduct ISO 9001 audits. They have a list of all accredited bodies that are able to provide valid ISO 9001 certification of your ISO 9001 procedures.

Chartered Quality Institute (CQI); The Chartered Quality Institute (Formerly the Institute of Quality Assurance.) They are able to provide much support in all quality related areas, if you are a quality professional I would recommend membership.

American Society for Quality (ASQ); The American society for quality can help you in the same way as the CQI can help you in the UK.

The above links can help with ISO 9000 Standards, ISO 9001, ISO 9004, Certification, auditing, Training, quality management systems, procedures, continuous quality improvement, etc.

This article is accurate and true to the best of the author’s knowledge. Content is for informational or entertainment purposes only and does not substitute for personal counsel or professional advice in business, financial, legal, or technical matters.


Tony (author) from At the Gemba on May 26, 2016:

Hi Nani, if you really have no idea about what to do with your procedures you are best off getting help from someone local to you. Hire a consultant or visit another local company that already has ISO to see what they do and what they have.

Nani on May 26, 2016:

Thank you for your reply. And one more doubt last auditor informed me to add mandatory procedures ( purchase, marketing,quality, production and two more totally 6 procedures ) how can i added this procedures. please reply soon.

JOSH on January 15, 2016:

For the six elements described above, how would provide evidence for an auditor to demonstrate compliance?

Could you let me know, Thanks

Mastermind Bhavesh on December 12, 2015:

Thanks. Very informative

Tony (author) from At the Gemba on September 26, 2015:

Hi Nani,

Just write the procedure as you would any other procedure in your company according to your own procedures for writing and numbering procedures. As to what the procedure content should be that is down to what your company wants to include.

Nani on September 25, 2015:

i want to include current welding procedure and special process validation welding procedure with ( qualification, personal qualification and katiria) how i do it? please help me.

Tony (author) from At the Gemba on September 15, 2015:

Zil, it all depends in what your local procedure says you should do. It is the local procedure that is going to say what should be done with the list and when.

zil on September 11, 2015:

i have one question to ask. You are a new clerk at faculty. every week you have to consolidate the attendance list. should the attendance list be filed as per standard procedure? or should be kept in the instructor's drawer?

Tony (author) from At the Gemba on September 10, 2015:

Attendance lists for what Zil? There are no specific requirements for attendance lists for anything within ISO9001, I think you are talking about a company specific procedure and you will have to look at what the company is doing and why they are doing it. Often procedures are made purely for the sake of making procedures and are unnecessary.

Zil on September 10, 2015:

Should the attendance lists be filled as per standard procedure? or should it kept in the instructor drawer? if yes why?

Tony (author) from At the Gemba on July 20, 2015:


The answer is that it depends if they are needed to actually achieve the job. For most companies they have company wide procedures that cover every project that is run within the business. However if there are specifics about the project that need to be handled differently then there may be a need for project specific procedures - but only if actually required to ensure that the project runs smoothly.

Prakash on July 20, 2015:

We are working on a project. Mandatory procedures are available in Company's corporate procedures. But not specific to the project. In this case, Please let me know "Whether Project specific Procedures are required?

Tony (author) from At the Gemba on August 31, 2014:

Hi Kris, what you call a procedure is up to you - SOP or procedure - as long as you have fully documented your approach to the six mandatory clauses it is fine. However talk to your auditing body before your document review stage as some auditors can be a little "funny" about things!

kris on August 31, 2014:

can we substitute quality procedures with SOP? ours is a pharma company and follows the GMP norms. From the ISO auditors point of view is QP mandatory! what i infer from net is that SOP if comprehensive can be Valid. please throw some light ,would appreciate

Tony (author) from At the Gemba on August 24, 2014:

Thank you for Auditing and finding the error Ahmad Khan, slip of the finger I guess. Corrected in the list.

Confused on August 24, 2014:

Control of Documents (4.2.3)

Control of Records (8.2.4)

Internal Audits (8.2.2)

Control of Non-Conforming Products (8.3)

Corrective Action (8.5.2)

Preventive Action (8.5.3)

In which have one wrong reference #....

Control of Record correct reference is 4.2.4

Ahmad Khan

Tony (author) from At the Gemba on January 01, 2014:

Hi Davis,

A procedure is very much what will be done and by whom, if the details of how it will be done are slightly different between companies this can be covered in a "lower level" work instruction specific to the individual company if written procedures are really necessary.

Davis on December 19, 2013:

Hi LeanMan

I'm just wondering, how to approach procedure/policy for departments (accounting, administration, finance, HR) that are shared by 2 or more companies?


thirumaran on October 22, 2013:

Thanks for sharing the procedure of ISO 9001

Tony (author) from At the Gemba on October 18, 2013:

Hi Ghana,

Good luck on your procedures, let us know how you do with passing your ISO9001

Zeesan on October 01, 2013:

thanks Sir Mr. LeanMan you sheared free information thanks again keep it up

Tony (author) from At the Gemba on June 27, 2013:

Faraz, I think you need to have a read of the standard and the various hubs here so that you understand why what you have asked is of no use to you at all. Your procedures are specific to your processes not a different company. You can buy ready made procedures but you still have to work hard to adapt them to match your specific processes.

Faraz on June 25, 2013:

I need ISO 9001:2008 Quality procedure sample for a Power Management Company at my email address at

Tony (author) from At the Gemba on May 01, 2013:

Hi Harpal

All procedures, instructions, manuals etc are specific to your own company and situation. Each has to be developed for your unique situation. Read the standards and bring in help in the form of a consultant if you need it.

harpal on April 30, 2013:

Dear sir,

i want the QUALITY MANUAL ,WORK INTRUCTIONS & SEFETY INSTRUCTION 9001&14000 so please send the detail regarding that,




9215137313 __email

Tony (author) from At the Gemba on March 26, 2013:

It would be difficult to advise without fully understanding the purpose and scope of what you require. I would suggest that you contact similar companies to yourself and see what they have or even speak to a consultant local to you.

michael Mukopi on March 24, 2013:

Great information for better society. I have a question;

I need to prepare a procedure on cascading responsibility and authority, kindly advise or share with me a sample to guide me.



Tony (author) from At the Gemba on July 30, 2012:

Hi Gesso,

This is one article in a whole series of articles, if you follow the various links within the text you will be able to find out much more about ISO 9001 in general and about writing procedures. If you need more information feel free to email using the "contact" button on my profile page (click the link beside my picture top right.)

gesso on July 30, 2012:

documented procedures,quality objectives, please give ideas how prepare them. thank you in advance

Meerambi on November 26, 2010:

Thank you so much LEanMAn.. You have explained about ISO (9001:2008) in a very simple and understandable way. Thanks for sharing it :)

Tony (author) from At the Gemba on September 30, 2010:

Thank you for your kind comments about ISO 9001 procedures Jeddex.

jeddex on September 30, 2010:

Great Hub LEanMAn! You've discussed things well. Your article is very informative especially regarding the six mandatory procedures. :)

Tony (author) from At the Gemba on September 23, 2010:

Thanks for your comments and having read about ISO 9001:2008 Procedures Smart Rookie.

Smart Rookie on September 23, 2010:

Good info about ISO 9001 procedures.

Tony (author) from At the Gemba on September 18, 2010:

Thanks for commenting PDH, Those companies who have correctly applied their ISO 9001:2008 procedures and policies will be certified and be able to use the ISO 9001 logo on their products to indicate the fact that they have a certified quality management system in place.

Tony (author) from At the Gemba on September 18, 2010:

Hi Humagaia, thanks for your comments, I am happy to give away all of my very limited knowledge, the more companies that start to correctly implement their ISO 9001 Procedures and other improvement initiatives the better for all of us!

prettydarkhorse from US on September 17, 2010:

Excelente! I understand it now, they always put it in theri logo -- companies, ISO certified, now I know, Maita

Charles Fox from United Kingdom on September 17, 2010:

Be careful - don't give too much info away for free.

Tony (author) from At the Gemba on September 17, 2010:

Nice to hear that you already have your ISO 9001 procedures in place and have been certified. Thanks for stopping by Mutiny.

Mutiny92 from Arlington, VA on September 16, 2010:

Very nice! We got ISO 9001 designated at our engineering facilities.

Related Articles