ISO 9001:2015 · Free self-assessment
Thirty-one questions in plain English. You get a score by clause, the gaps most likely to be raised as findings at a certification audit, and three things to fix first.
Your answers never leave your device. Everything runs in your browser. Nothing is uploaded, stored, or sent anywhere — close the tab and it's gone.
Overall
Likely audit findings
By clause
Start here
Question by question
This is a self-assessment, not an audit. It is based entirely on your own answers and cannot verify evidence, judge severity, or predict how a particular auditor would read your system. "Major" and "minor" are used here as plain-language indicators of risk, not formal audit classifications. This tool is not affiliated with UKAS or any certification body, and completing it does not move you towards certification. Treat it as a starting point for a conversation.
Take it with you
Everything above is yours to read, print or screenshot right now — nothing is held back. If it's more useful in your inbox, we'll send your priorities and clause scores through as a written action list, plus a formatted PDF pack you can hand to your management team or a consultant.
A gap analysis compares how your business actually works against what ISO 9001:2015 requires, so you can see the distance between the two before anyone else does. It is normally the first thing a consultant does on arrival, and the first thing worth doing yourself if you are considering certification, have a customer asking for it, or want to know how exposed you are before a surveillance visit.
Most small manufacturers are further along than they expect. The work usually gets done properly on the shop floor — parts are checked, bad ones are pulled, customers get told. What is missing is the evidence: the record that shows it happened, who decided, and what changed as a result. An auditor cannot certify what you cannot show them, so the gap is more often about proof than about practice.
| Clause | Title | What it asks of you |
|---|---|---|
| 4 | Context of the organisation | Know what your business does, who depends on it, what could disrupt it, and how your processes connect. |
| 5 | Leadership | The people running the business own the quality system, not one nominated person. |
| 6 | Planning | Identify risks, set measurable objectives, and control changes rather than absorbing them. |
| 7 | Support | Resources, calibration, competence, and control of documents and records. |
| 8 | Operation | Order review, suppliers, traceability, release of product, and handling nonconforming output. |
| 9 | Performance evaluation | Measure what is happening, audit yourself, and review the system at management level. |
| 10 | Improvement | Find root causes, correct them, verify the correction worked, and look across findings for patterns. |
Three areas account for a large share of findings in small manufacturing businesses. The first is the internal audit programme — either it does not exist, or it covers the easy parts of the system and never the awkward ones. The second is management review, which is often a conversation rather than a recorded meeting with the inputs the standard asks for. The third is corrective action: the immediate problem gets fixed, the customer gets a replacement, and nobody records why it happened or checks whether it happened again.
That last one compounds. When nonconformities live in a spreadsheet that one person maintains, the individual records may be fine but the pattern across them is invisible — so the same supplier, the same operation, or the same drawing keeps causing trouble and nobody can prove it. Clause 9.1.3 asks you to analyse and evaluate that data, not merely to hold it, and clause 10.2 asks whether similar nonconformities exist or could occur. Both are hard to answer from a list of free-text notes.
The full question set is below, grouped by clause, so you can see what you are walking into before you start — or use it as a checklist on its own.
For a small manufacturer starting from a reasonable base, three to six months from first gap analysis to certification audit is a realistic run. Businesses starting from nothing documented should plan for closer to nine months, mostly because the standard expects records to exist over a period — you cannot demonstrate an internal audit programme or a management review cycle that started last week.
Costs fall into two separate buckets that are easy to confuse. The certification body's fee is unavoidable and is based on your headcount and the complexity of your scope; a UKAS-accredited body will quote for an initial two-stage audit plus annual surveillance visits. Consultancy support to get you ready is entirely optional and priced separately. Getting quotes from more than one accredited body is worth the afternoon it takes, as is checking that the body is genuinely UKAS-accredited rather than self-declared — an unaccredited certificate may not satisfy the customer who asked you for one in the first place.
Not necessarily. A small business with an organised owner and a genuine willingness to write things down can get to certification alone, and doing so leaves you with a system you actually understand rather than one that arrived in a binder. The trade is time: expect to spend considerably more of your own hours on it.
Where a consultant earns their fee is in knowing what "enough" looks like. Left alone, most people either over-document — building procedures nobody follows, which then become findings in their own right — or under-document and get caught at stage two. If you do engage one, arrive with a completed gap analysis. It shortens the diagnostic phase you would otherwise be paying for, and it gives you a way to judge whether their read of your business matches your own.
Take the three lowest clauses and deal with them in order rather than trying to close everything at once. Fix the evidence gaps before the process gaps: writing down what you already do is faster than changing how you work, and it usually moves the score further. If you are heading towards certification, an independent consultant will get you there faster than doing it alone — a completed self-assessment makes that first conversation considerably more productive, because you are discussing specifics rather than paying someone to discover them.
Re-run the assessment after each round of work. The score matters less than the direction, and a clause that stays low across two or three attempts is usually telling you something structural rather than something you forgot.
No. This tool records what you tell it and cannot inspect a single record. A real auditor will ask to see the evidence behind every answer you gave, and evidence is where self-assessments and audits usually diverge.
No. It is a voluntary standard. Most small manufacturers pursue it because a customer has made it a condition of supply, or because they want access to tenders that require it.
If you genuinely carry out no design or development — you make strictly to customer drawings and specifications — clause 8.3 can be excluded, but the exclusion has to be stated and justified in your scope. Be careful here: designing your own tooling, fixtures or process routings can count.
Far fewer than the older 2008 version, which is where a lot of outdated advice comes from. The 2015 standard asks for "documented information" where it is needed for the operation of your processes, rather than mandating a fixed set of six procedures. In practice this means you have more latitude than you may have been told — and more responsibility for justifying what you chose to leave undocumented.
Nowhere. The assessment runs entirely in your browser and your answers are never transmitted. If you choose to enter your email address for the action list, only your email and the summary scores are sent — never your individual answers.