Who should aim for ISO 9001 certification, and on what scope?
Any organisation that must prove to a customer that it controls the quality of its products or services, whatever its size or activity. The real question is not “should we be certified?” but “certified for what?”. The scope, decided in the first month, is printed on the certificate, is the basis of the audit time calculation and determines what your customer will accept.
In Morocco, as for many suppliers in West Africa or the Middle East, the request usually comes from outside: a European buyer who includes it in a supplier questionnaire, an industrial group that makes it a condition for listing, a main contractor that adds it to its specifications when a contract comes up for renewal. That customer should therefore review your draft scope. A certificate that covers “trading” when the customer buys an installation service does not answer its request, even if it is perfectly valid.
Six scoping questions come up in every project we support. The audit time rules of Global ACI, the body that took over the work of the International Accreditation Forum (IAF), show why each one matters: see document Global ACI-TECH-3-004, version 1.0, applicable since 28 August 2026.
Scoping question | Why it matters | Good practice |
|---|---|---|
Which activities? | The scope statement appears on the certificate; your customer will read it | Use the customer’s vocabulary: “design and installation of…” rather than a vague heading |
Which permanent sites? | Each site enters the calculation and the audit programme; a site outside the scope is not covered | Include every site that serves the customer requiring the certificate |
Any construction projects or temporary sites? | They belong to the system and are included in the audit programme, sampled according to risk | Make sure at least one project or field job is in progress at the time of the audit |
Any outsourced activities? | The certification body audits your control over them, not the provider’s system; outsourcing can lengthen the audit | List critical providers and their evaluation criteria |
Any requirements not applicable? | They must be justified; the absence of design can reduce audit time | Only declare as not applicable what truly is |
How many people? | The headcount retained, including permanent, temporary and part-time staff and shift teams, is the basis of the calculation | Prepare an honest, documented count |
Two examples show how far apart two scopes can be. An electrical equipment distributor in Tangier that buys, stores and delivers without manufacturing anything has neither design nor production in the industrial sense; its system covers purchasing, storage, order picking and delivery. A boilermaking workshop in Kenitra that draws its tanks from its customers’ specifications does have a design process, which the auditor will examine in detail.
What are the main phases of a first certification?
Five phases, in this order: scope, build, run and prove, get certified, maintain. Each ends with a gate that conditions the next. The detailed method of our support is on our ISO 9001 certification page; the table below follows the project from the company’s point of view.
Phase | What is done | Main deliverable | Gate |
|---|---|---|---|
1. Scope | Management decision, project manager, provisional scope, gap analysis | Prioritised gap report and project plan | Management approves the scope, the schedule and the time allocated |
2. Build | Processes and owners, context, risks and opportunities, policy, objectives, documented information | Process map, process sheets, useful documents | Each process owner can explain their process and its indicators |
3. Run and prove | Daily application, indicators, complaints, nonconformities, internal audit, management review | Records, internal audit reports, review minutes | One full cycle completed, findings addressed with root cause analysis |
4. Get certified | Choice of certification body, application, stage 1, stage 2, response to findings | Certification decision and certificate | No major nonconformity left open |
5. Maintain | Internal audits, management review, improvement, annual surveillance | Certificate maintained over three years | Surveillance audits with no major nonconformity |
Phase 3 is the one everybody wants to shorten. It is also the one that makes stage 2 succeed or fail: a system that is written but not lived shows from the first interviews with operators. Our ISO 9001 certification steps checklist details the evidence expected at each step, from the gap analysis to stage 2.
How do you frame the project before writing a single document?
By settling four points: management commitment, project leadership, the gap analysis and the reference text. Documentation started before these decisions almost always has to be redone.
Visible management commitment
ISO 9001:2026 states it more clearly than the previous edition. According to the Global ACI transition document, clause 5.1.1 adds to top management’s commitments the promotion of quality culture and ethical behaviour (item i), and clause 7.3 requires staff to be aware of them (item e). For a company starting out, this is not a novelty to graft on: it is the foundation. In practice, management opens the project in front of supervisors, signs a policy it has actually discussed, chairs the management review and decides when quality conflicts with a deadline.
A project manager and protected time
A designated quality manager, with protected weekly time, and a named owner for each main process. In a small or medium-sized enterprise (SME), the quality manager often holds other roles too: purchasing, methods, human resources. If nobody can hold the role over time, it can be covered on a shared-time basis with a designated deputy: see our outsourced QHSE service.
A gap analysis on the shop floor
The gap analysis compares your practice with every requirement clause of the standard, following an order, a complaint and a purchase from end to end. It separates what is missing, what exists without evidence and what is already solid. It sets the realistic project schedule; without it, any timeline is a guess.
The official text of the standard
Buy ISO 9001:2026 before you start. The ISO/TC 176/SC 2 committee announced its publication on 16 September 2026. Summaries, ours included, do not replace reading the requirements, nor Annex A, which explains their intent.
How do you build a system that holds up at the audit?
By starting from how the company serves its customers, from enquiry to delivery and invoice, then checking that every requirement of the standard finds its place. A system modelled on the organisation chart or on the standard’s table of contents is hard to defend at audit, because the auditor follows the real work, not the clauses.
Starting from scratch with the 2026 edition has one advantage: there is no existing system to rework. The points that Global ACI flags as changed simply become building blocks of the first system:
- the context, including the question of climate change, relevant or not to your system, which has been in the standard since the 2024 amendment;
- a quality policy that takes the context into account and supports the company’s strategic direction (clause 5.2.1, item e);
- risks and opportunities, determined (6.1.1) then addressed separately: actions on risks (6.1.2), actions on opportunities (6.1.3);
- the planning of changes, with monitoring of their effectiveness, their communication and the review of their results (6.3, items e to g);
- awareness, including quality culture and ethical behaviour (7.3);
- the management review, which must include each of its inputs, among them changes in the needs and expectations of interested parties (9.3.2).
These clauses are explained in detail in our article on what changes in the ISO 9001:2026 transition, written for certified sites but useful for any new project.
What the standard does not require matters just as much. It does not impose a quality manual, nor a procedure for every activity. It requires the documented information needed for the system to be effective, and the records that prove the work was done. In an engineering consultancy in Rabat, the process “from proposal to delivery of the report” fits on one sheet, a traced contract review, a pre-dispatch verification checklist and a log of customer comments. Nothing more is needed if this evidence exists for every file. Work instructions are written in the language of the people who apply them: in Moroccan companies, French or Arabic.
How long should the system run before the audit?
Long enough for every process to produce evidence, and for a full cycle of internal audits and a management review to have taken place. The standard sets no minimum duration; it is the certification body that judges, at stage 1, whether your system is ready for stage 2.
In practice, before requesting stage 1, you must be able to show:
- indicators measured over several months, with comments and actions, not tables filled in the day before;
- complaints, nonconformities and customer feedback recorded and handled, with root cause analysis where needed;
- suppliers evaluated against written criteria;
- a cycle of internal audits covering all processes, carried out by trained auditors who are independent of the work audited, following the ISO 19011 guidelines;
- a management review held, with decisions, owners and dates.
Internal auditors are often the weak link in a first certification: a colleague trained in two hours does not dare raise a finding against their own manager. Our ISO 9001:2026 internal auditor training is run on your own processes, with assessment of learning.
A mock audit, run under certification audit conditions, is not required. It is justified when the commercial stakes are high, when the customer’s deadline is tight or when the team has never been audited. It leaves time to correct before stage 1.
How does certification work, from application to certificate?
In four steps: choosing the certification body and applying, stage 1, stage 2, then the certification decision. The certification body is independent of the consultancy that supports you: a consultant cannot audit you, and a certification body cannot advise you.
Choose an accredited body that is ready for the 2026 edition
Morocco’s Ministry of Industry and Trade publishes, on its online documents and services page, the lists of management system certification bodies accredited by SEMAC (Service Marocain d’Accréditation, the Moroccan Accreditation Service) to NM ISO/IEC 17021-1, the Moroccan (NM) edition of the international standard for bodies that certify management systems. Bodies accredited abroad also operate in Morocco: in that case, check which accreditation body appears on their accreditation certificate. SEMAC is listed among the associate members of Global ACI: it is not yet a signatory of the mutual recognition arrangement (list checked in November 2026). If your customer requires international recognition, ask it in writing which accreditation bodies it accepts.
For a first certification in 2027, there is one more question. According to Global ACI, a certification body can issue an accredited ISO 9001:2026 certificate only after its accreditation body’s transition decision, expected by 30 September 2027 at the latest. Ask it in writing where it stands. The consequences for your schedule are detailed in our article on a first ISO 9001 certification since the 2026 edition.
The application and the audit time calculation
The certification body sends you a questionnaire: activities, sites, headcount, shift teams, outsourced activities, non-applicable requirements. Your answers feed the audit time calculation under Global ACI-TECH-3-004: a starting point set by a table according to headcount, adjusted for the risk level of the activity and for listed factors (multiple sites, construction projects to visit, outsourcing, regulation, several working languages…). The document requires the certification body to give you the audit time retained and its justification as part of the contract. It states that stage 2 normally lasts longer than stage 1, and that part of the audit can be carried out remotely if the certification body applies the Global ACI rules on the use of information technology. The mechanisms and their effect on your budget are detailed in our article on ISO 9001 certification cost in Morocco.
If your system covers several sites carrying out very similar activities under a central function, the certification body can audit a sample: according to document Global ACI-TECH-3-001, at least the square root of the number of sites for the initial audit, rounded up to the next whole number, with the central function always audited.
Stage 1, stage 2, decision
Step | What the certification body does | What you prepare |
|---|---|---|
Stage 1 | Reviews the documented information, the scope, site-specific conditions, and whether internal audits and the management review have been carried out; judges whether the system is ready for stage 2 | Up-to-date documents, evidence of the internal audit cycle and the management review, people available |
Between the two stages | Plans stage 2 | Handling of the points raised at stage 1, without waiting for the day before stage 2 |
Stage 2 | Checks on site that the system works and achieves its results: interviews, observations, samples of records, visits to projects or sites | Process owners present, workshops in operation, records accessible, a room and a guide for the auditor |
After stage 2 | Grades findings as major or minor nonconformities, reviews your corrections and corrective actions | Root cause analysis, actions, evidence, within the deadlines set |
Decision | A person at the certification body who did not take part in the audit decides on certification | Nothing: the decision rests on the audit file |
A major nonconformity blocks the decision until the certification body has verified the correction and the corrective action; for a minor nonconformity, it generally accepts a reasoned action plan.
The certificate and the three-year cycle
The certificate shows your organisation, your sites, the certified scope, the standard and its edition, and its validity dates. It opens a three-year cycle: a surveillance audit every year, then a recertification audit. According to Global ACI-TECH-3-004, annual surveillance time is about one third of the initial audit time, and recertification about two thirds of the time an initial audit would require at the time of recertification; neither is likely to last less than one day.
Communicate the certificate with its exact scope. ISO 9001 certifies a management system, not a product: a package or a test report does not carry the words “ISO 9001 certified”.
What should you check before launching your project?
Before the first gap analysis meeting, these points must be settled, or at least decided:
Funding follows a simple rule: consulting and the certification audit are paid by the company. In Morocco, training written into the training plan may fall under the special training contracts (contrats spéciaux de formation, CSF) of OFPPT (Office de la formation professionnelle et de la promotion du travail, the national vocational training office), and training engineering under the GIACs, the sector-based interprofessional groups that support companies with training engineering, under the rules of their procedures manuals (CSF: May 2006, Amendment No. 2 of 2 June 2014; GIAC: March 2003, Amendment No. 1 of 2 June 2014) and with no guaranteed amount. Details are on our page on OFPPT special training contracts (CSF) and GIAC funding.
To see the journey applied to a real subcontracting situation, read our case study of a construction SME supplying a major contractor.