What your customer is actually asking for when they say the words — and what the standard does and doesn't require of a twelve-person shop.
This trips people up. The standard doesn't tell you how good your welds have to be, what tolerance to hold, or which materials to use. You decide that. Your customer decides that.
What the standard asks is narrower and, honestly, harder: can you do it the same way every time, prove that you did, and catch it when you didn't?
A shop can make excellent parts and fail an ISO audit. A shop can make mediocre parts and pass one. That sounds backwards until you realize what the customer is buying — not your best day, but the promise that every day looks like it.
Is the way work actually gets done written down somewhere a new hire could follow — or does it live in one person's head?
Does the crew actually follow it, or is the written version a fiction that comes out for audits?
When someone asks what happened on a job eighteen months ago, can you show them — with records, not memory?
Every clause in the standard is one of these three questions, asked about a different part of your business. That's the whole thing.
ISO 9001 is organized into ten clauses. The first three are definitions and scope. The real requirements are in clauses 4 through 10. Here they are without the language.
Who are your customers, what do they require of you, who else has a say (regulators, insurers, primes), and what part of your business does this cover?
Does the owner actually back this, is someone named as responsible, and does everyone know who decides what?
What could go wrong, what are you doing about it, and what are you trying to improve this year?
Do you have the people, training, equipment and calibration to do the work — and do you control your documents so the crew isn't building from a superseded drawing?
The actual work. How jobs get reviewed before you accept them, how you control your suppliers and subs, how you inspect, and what happens to nonconforming work.
What do you measure, do you audit yourself, and does management sit down and look at it on a schedule?
When something goes wrong, do you fix the cause or just the part?
When a customer says "we need you ISO 9001," they mean one of two very different things:
An accredited registrar audits you and issues a certificate. Some contracts genuinely require it, and nothing else will do — defense work, regulated industries, and most prime supplier agreements.
You build and run a system that meets the requirements, and you show it to the customer directly. No registrar, no certificate, far less cost. This satisfies a surprising number of the people asking.
Call and ask which one they mean before you spend anything. The difference is thousands of dollars and several months, and the person who sent the packet usually knows.
A half-day walkthrough and a written report tells you which of these you already have, which you don't, and what it takes to close the gap. $750, and the report is yours either way.