Many companies start pursuing ISO 9001 for one very specific reason: a major customer requires it, a bidding dossier demands the certificate, or a foreign partner asks for it. The difficult part is not “getting the paper” — it is making sure the system genuinely runs, with people responsible, records kept and data tracked, so the certification body can actually assess it.
Short answer: to obtain ISO 9001 certification, a company needs a quality management system that matches how it actually works, that has operated long enough to generate records, that has been through an internal audit and management review, and only then invites a certification body to assess it. This article goes straight into what each department must prepare.
What is ISO 9001, and what is new in 2026?
ISO 9001 is the international standard setting out requirements for a quality management system. The standard does not specify what parameters a product must meet; it requires a company to control how it produces goods or delivers services so as to consistently satisfy customers and continually improve.
On 16 September 2026, ISO issued ISO 9001:2026, replacing the 2015 version. According to ISO’s announcement, the new version:
- clarifies the wording so companies of all sizes can more easily understand the requirements;
- brings quality culture and ethical behavior into the requirements, tied to leadership’s role and employee awareness;
- separates risks and opportunities, each with its own required actions;
- places greater emphasis on managing change within the system.
The clause structure from 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement) remains the main framework. Under the transition notices published by certification bodies, the transition period is three years; ISO 9001:2015 certificates will no longer be valid after 30 September 2029.
Which version should be followed? A company just starting out should ask its intended certification body about its audit schedule for the 2026 version. If the body is ready, build to the 2026 version to avoid a second transition. A company that already holds a 2015 certificate should plan its transition within its next surveillance cycle.
Before starting: three decisions for leadership
- Certification scope. Which products or services, which factories or branches. A scope that is too broad makes the system heavy; a scope that is too narrow may not meet customer requirements. Ask customers what scope they need.
- A focal point. One person with enough authority to coordinate across departments, not just a “person who keeps the ISO files.”
- Real objectives. For example: reducing returned defective goods, on-time delivery, or shortening complaint-handling time. Measurable objectives give the system meaning and are also a requirement of the standard.
What each department specifically needs to do
This is the part companies most often miss. The table below is an example for a manufacturing company; a service company should adapt it to its own process.
| Department | What it needs to be able to do | Records typically required |
|---|---|---|
| Leadership | Set quality policy and objectives; assign responsibilities; conduct periodic management review | Policy and measurable objectives; management review minutes |
| Sales | Review customer requirements before accepting an order; handle order changes; receive feedback | Reviewed orders/contracts; complaint and feedback log |
| Purchasing | Select and evaluate suppliers; control incoming goods | List of approved suppliers; evaluation results; goods receipt records |
| Production / operations | Follow work instructions; control production conditions; identify and trace batches | Production plan; work instructions at the workstation; batch records |
| Quality control | Inspect incoming materials, in-process and finished products; handle non-conforming products | Inspection sheets; records of defective goods and how they were handled |
| Engineering / maintenance | Maintain equipment; calibrate measuring devices | Maintenance plan; calibration certificates for measuring devices |
| Human resources | Determine the competency needed for each position; provide training; evaluate training effectiveness | Competency descriptions; training records |
| Warehouse | Store, identify, and manage inbound/outbound goods correctly by batch | Stock cards; inbound/outbound records |
The standard does not require writing a thick “quality manual” or dozens of procedures. It requires a company to maintain and retain documented information wherever needed to control and demonstrate compliance. A few forms that are genuinely used are far better than many forms left blank.
Roadmap from start to certificate
| Step | Task | Who does it |
|---|---|---|
| 1 | Define scope, focal point and objectives | Company leadership |
| 2 | Gap assessment: current practice against each clause | The company, possibly with a consulting firm |
| 3 | Build or standardize procedures and forms based on actual practice | Departments, with support from a consulting firm |
| 4 | Awareness training for employees, training of internal auditors | Consulting or training provider |
| 5 | Operate and generate genuine records | Departments |
| 6 | Internal audit, management review, corrective action for gaps | Company |
| 7 | Select a certification body and sign a contract | Company |
| 8 | Stage 1 audit (document review, readiness) and Stage 2 audit (on-site assessment) | Certification body |
| 9 | Correct any non-conformities (if any), obtain the certificate | Company; the certification body decides on issuance |
| 10 | Periodic surveillance, recertification at the end of the cycle | Certification body |
The length of time operating before assessment depends on scale and readiness; the certification body will review whether the records provide sufficient evidence at Stage 1.
Choosing a certification body: what to check
- Registered to operate in Vietnam. Certification services are a conditional business line; certification bodies must register their field of activity under Decree No. 107/2016/NĐ-CP, as amended by Decree No. 154/2018/NĐ-CP.
- Accreditation. Ask which accreditation body backs the certificate. Export customers and foreign corporations often accept only accredited certificates.
- Scope and transition schedule. Can this body assess the company’s field, and is it ready to audit against ISO 9001:2026?
Common pitfalls and how to handle them
- Buying a template document set and just changing the company name. During the on-site audit, employees don’t follow what is written in the documents. How to handle it: rewrite procedures based on actual practice, dropping what isn’t used.
- Only one person handles ISO. The system stalls when that person leaves. How to handle it: assign responsibility by department as in the table above.
- Generic quality objectives. “Improve quality” cannot be measured. How to handle it: set indicators with measurable figures and a tracking period.
- Getting the certificate, then letting it lapse. Surveillance audits will detect this. How to handle it: put internal audits and management review on the annual calendar.
- Treating it separately from other obligations. Fire safety, food safety and labor requirements are legal obligations; the ISO system should track these obligations too. See Fire Safety for Factory Buildings and Which Establishments Need a Food Safety Eligibility Certificate?.
What Thái Tín supports
Thái Tín receives the request, works with the company to identify the reason for pursuing ISO, the appropriate scope and current readiness; connects the company with a suitable consulting firm, training provider and certification body matching the industry and customer requirements; and tracks progress within the agreed scope. Building the system is carried out by the consulting firm; the audit and issuance of the certificate are decided by the certification body. Large companies, those with many departments, or foreign-invested companies are advised on how to organize a suitable focal point.
Costs include consulting and training fees (if engaged) and the certification body’s audit fee; a quotation follows once the scope, headcount and number of locations are clear. See also the ISO, standards and certification services.
Keeping the system alive after certification
- Hold management review meetings on a fixed schedule, using real data (defective goods, complaints, on-time delivery).
- Conduct an internal audit before each surveillance cycle.
- Update documents when procedures change — this is also a point ISO 9001:2026 emphasizes.
- Plan the transition to the 2026 version before the 30 September 2029 deadline if currently using the 2015 version.
If your company is considering ISO 9001, send your field of activity, headcount, number of locations and customer requirements to be advised on scope and roadmap.
Questions and answers
Is ISO 9001 mandatory?
Not mandatory under general law. A standard is a voluntary regulation, unlike a technical regulation, which is mandatory (Law on Standards and Technical Regulations 2006, as amended by Law No. 70/2025/QH15). Companies usually pursue ISO 9001 because customers, bidding dossiers or supply chains require it, and because they want a structured internal management system.
Should we follow ISO 9001:2015 or ISO 9001:2026?
ISO 9001:2026 was issued on 16 September 2026. A company just starting out should ask its intended certification body whether it is ready to audit against the 2026 version; if so, build the system to the 2026 version to avoid a later transition. Certificates under the 2015 version remain valid during the transition period, until 30 September 2029, according to notices from certification bodies.
Can a small company with a few dozen staff obtain ISO 9001?
Yes. ISO 9001 applies to organizations of any size and type. For a small company, the system should be lean: few forms, tied to actual work, with clear responsibility.
How long is an ISO 9001 certificate valid for?
Under common practice for management system certification (ISO/IEC 17021-1), the certification cycle is usually three years, with periodic surveillance audits during the cycle and a recertification audit at the end. The specific schedule is set by the certification body in the contract.
How do we know if a certification body is reliable?
Check two things: whether the body has registered its certification activities with the managing authority in Vietnam (Decree No. 107/2016/NĐ-CP, as amended by Decree No. 154/2018/NĐ-CP), and whether the certificate is backed by an accreditation body. Foreign customers often require an accredited certificate.
Legal basis · verification date
Verified 29 September 2026 · next review 29 December 2026. The content is general guidance and does not replace advice for a specific case.
- ISO 9001:2026 Quality management systems — Requirements, issued 16 September 2026 (iso.org/standard/88464.html; ISO page: iso.org/quality-management/iso-9001-2026). ISO 9001:2015 and TCVN ISO 9001:2015 (the equivalent Vietnamese standard).
- Three-year transition period, ISO 9001:2015 certificates invalid after 30 September 2029: per certification body notices (DNV, ISO 9001 revision page, accessed 29 September 2026).
- Law on Standards and Technical Regulations No. 68/2006/QH11, amended and supplemented by Law No. 70/2025/QH15 (effective 1 January 2026): standards are voluntary, technical regulations are mandatory (Article 3).
- Decree No. 107/2016/NĐ-CP on conditions for conformity assessment service business, amended by Decree No. 154/2018/NĐ-CP.
- ISO/IEC 17021-1: requirements for bodies providing audit and certification of management systems (certification cycle, stage 1 and stage 2 audits, surveillance).
