ISO 9001 usually enters an Australian business one of two ways. A customer makes it a condition of the next contract, or the business grows past the point where the informal systems that got it here still hold together. Both are legitimate reasons to certify, and they lead to quite different projects.
The standard is ISO 9001:2015, published locally by Standards Australia as AS/NZS ISO 9001:2016. The requirements are identical. Certification is issued by a certification body accredited by JAS-ANZ, the accreditation authority appointed jointly by the Australian and New Zealand governments.
Nathan ISO Consulting builds quality management systems for Australian organisations across every state and territory. We handle the gap analysis, the system design, the documentation, your internal audit and management review, and we sit with you through Stage 1 and Stage 2. This page covers what the standard requires, the legal obligations it sits alongside in Australia, how we work, and where first-attempt audits tend to go wrong.
What ISO 9001 actually requires
The standard runs from Clause 4 to Clause 10, and it is shorter and less prescriptive than most people expect. There is no mandatory quality manual. There are no six mandatory procedures. Those went out with the 2008 edition, and a surprising number of consultants still sell documentation packs built around them.
Clause 4 asks you to understand the context you operate in and who your interested parties are. Clause 5 puts accountability on top management, not on a quality manager working alone. Clause 6 introduces risk-based thinking, which in practice means you have thought about what could go wrong in your key processes and done something about it. Clauses 7 through 10 cover resources, operations, performance evaluation and improvement.
Running through all of it is the process approach. An auditor is not looking for a shelf of binders. They want evidence that you know how work flows from an enquiry to a delivered job, where the handovers are, what you measure, and what happens when something goes wrong.
Legal and regulatory obligations ISO 9001 supports in Australia
ISO 9001 is voluntary. Several of the obligations a quality management system helps you discharge are not, and this is the part most consultants skip entirely.
| Obligation | What it requires | How a QMS helps |
|---|---|---|
| Australian Consumer Law (Competition and Consumer Act 2010) | Consumer guarantees of acceptable quality, fitness for purpose and correspondence with description | Documented specification control, inspection and test records, and a traceable nonconformance process |
| Commonwealth Procurement Rules | Agencies must assess supplier capability and value for money | Certification is accepted evidence of capability at prequalification |
| Modern Slavery Act 2018 (Cth) | Reporting entities must report on supply chain due diligence | Supplier evaluation and re-evaluation records under Clause 8.4 |
| National Construction Code and state building laws | Conformance of materials and workmanship, documented evidence of suitability | Product conformity records, subcontractor control, inspection and test plans |
| FSANZ Food Standards Code | Food safety programs and traceability for food businesses | Traceability, recall procedures and process control (usually with ISO 22000 or HACCP) |
| Heavy Vehicle National Law | Chain of responsibility duties across the transport supply chain | Documented operational controls, competence records and incident management |
| Therapeutic Goods Act 1989 | Quality systems for medical devices and therapeutic goods | Foundation for ISO 13485, which builds on the ISO 9001 structure |
Your obligations depend on your sector, state and contract terms. We build the compliance obligations register around what actually applies to you, not a generic list.
How Nathan ISO Consulting assists
We are a consultancy. We do not issue certificates and no legitimate consultancy does, because a body that both implements and certifies has an impartiality conflict JAS-ANZ does not permit. Your certificate comes from an accredited certification body. Our job is to get you there and keep you there.
| Service | What we deliver |
|---|---|
| Gap analysis | Your existing processes mapped against ISO 9001:2015, with a written gap register naming owners, effort and priority |
| Scope definition | Agreeing what appears on your certificate. Scope wording matters more than most realise, because your clients read it |
| QMS design and documentation | Quality policy, measurable objectives, process maps, risk register and only the documented information the standard requires |
| Compliance obligations register | Legislation, licence conditions, contractual and industry requirements applying to your operations and states |
| Implementation and staff training | Rollout to the team, toolbox and role-based training, and support while real records start accumulating |
| Internal audit | A full audit against every clause, conducted the way an external auditor would, with findings raised and closed |
| Management review facilitation | A properly minuted review covering all Clause 9.3 inputs and outputs |
| Certification body selection | Shortlisting JAS-ANZ accredited bodies against your scope, sector and budget, and managing the quote process |
| Stage 1 and Stage 2 attendance | We are in the room. Findings are managed and closed out by us, not handed back to you |
| Post-certification support | Surveillance audit preparation, annual internal audits, and system maintenance so the certificate does not lapse |
Why organisations choose Nathan over other providers
Australia has no shortage of ISO consultants. Most of them fall into one of two camps. Some sell a documentation pack, email it over, and leave you to work out how to make it real. Others charge for a long project and produce a system so heavy that nobody uses it once the auditor leaves. We have been called in to fix both.
| What most providers do | What we do |
|---|---|
| Sell a generic template pack with the client name swapped in | Build the system around how your business actually runs, so the evidence generates itself |
| Write documentation the auditor will accept and nobody will use | Write the minimum documented information the standard requires and no more |
| Hand over at the door of the Stage 2 audit | Attend Stage 1 and Stage 2 with you and close out findings ourselves |
| Treat every state the same | Build the compliance register around the legislation applying in each state you operate in |
| Recommend one certification body they have a relationship with | Shortlist accredited bodies on your scope and sector, and tell you when the cheapest quote is the wrong one |
| Disappear after the certificate is issued | Stay on for surveillance audits, internal audits and system maintenance |
| Quote the same scope regardless of what you need | Tell you when a narrower scope, or a different standard entirely, is the better answer |
Our implementation process
| Stage | What happens | Duration |
|---|---|---|
| 1. Gap analysis | Existing processes mapped against the standard. Written gap register with owners and effort estimates. | 1–2 weeks |
| 2. Scope and planning | Certification scope, sites and exclusions agreed and worded for the certificate. | 1 week |
| 3. System design | Policy, objectives, process maps, risk register and required documented information built. | 3–5 weeks |
| 4. Implementation | Rollout and training. Real records begin accumulating. | 4–6 weeks |
| 5. Internal audit | Full internal audit against every clause. Findings raised and closed. | 1–2 weeks |
| 6. Management review | Minuted review with top management covering all required inputs. | 1 week |
| 7. Certification audit | Stage 1 documentation review, then Stage 2 on site. We attend both. | 2–4 weeks |
How long ISO 9001 certification takes
Ten to twenty weeks is the honest range for most Australian SMEs. We have taken a well-organised ten-person consultancy from kickoff to certificate in eight weeks. We have also seen a fifty-person manufacturer take nine months, because the project kept losing to production.
The biggest variable is not company size. It is whether someone internally owns the project and has protected time for it. Two hours a week from a nominated person will get you there. Nothing scheduled will not, however good the consultant is.
One structural constraint worth planning around: the standard expects a full cycle of internal audit and management review before Stage 2, plus records showing the system has actually been running. That cannot be compressed into a fortnight.
ISO 9001 certification services across Australia
We deliver nationally. Work is a mix of on-site attendance at the points where it matters and remote delivery for the documentation and review stages, which keeps regional projects viable without loading them with travel time.
| State / Territory | Cities and regions we serve |
|---|---|
| New South Wales | Sydney, Parramatta, Western Sydney, Newcastle, Wollongong, Central Coast, Wagga Wagga, Dubbo, Albury, Tamworth, Port Macquarie |
| Victoria | Melbourne, Dandenong, Geelong, Ballarat, Bendigo, Shepparton, Traralgon, Warrnambool |
| Queensland | Brisbane, Gold Coast, Sunshine Coast, Ipswich, Toowoomba, Townsville, Cairns, Mackay, Rockhampton, Gladstone, Bundaberg |
| Western Australia | Perth, Fremantle, Joondalup, Bunbury, Geraldton, Kalgoorlie, Karratha, Port Hedland, Albany |
| South Australia | Adelaide, Port Adelaide, Mount Gambier, Whyalla, Port Augusta, Murray Bridge |
| Australian Capital Territory | Canberra and the wider ACT region |
| Tasmania | Hobart, Launceston, Devonport, Burnie |
| Northern Territory | Darwin, Palmerston, Alice Springs, Katherine |
Where first certification audits go wrong
After enough of these you see the same findings repeatedly. Five account for most of them.
Industries we work with
Construction and civil contracting, manufacturing and fabrication, engineering and professional services, transport and logistics, facilities management, labour hire, food processing, mining services, waste management, and technology firms selling into government. Sector matters less than most assume, because the standard is deliberately generic. What changes is where the evidence lives and what the auditor will want to see.
FAQ'S
No. We are an implementation consultancy. Certificates are issued by independent certification bodies accredited by JAS-ANZ. Accreditation rules prevent a body from certifying a system it helped build, so the consulting and certification roles must stay separate.
A JAS-ANZ accredited certification body of your choosing. We shortlist accredited bodies against your scope and sector, manage the quote process, and attend both audit stages with you. The certificate and the audit decision rest entirely with them.
Check the JAS-ANZ register and confirm the body is accredited for the specific standard and scope you need. Unaccredited certificates are widely available, inexpensive and routinely rejected by procurement teams, which means paying twice and starting over.
No consultancy honestly can, because the decision belongs to an independent auditor. What we can do is run your internal audit the way an external auditor would, close findings before assessment, and attend both stages so issues get resolved in the room.
Requirements sit in vendor prequalification systems and vary by operator and work category. Quality certification appears commonly, particularly for fabrication, engineering and maintenance scopes. Send us the vendor pack and we will identify what is genuinely required.
By designing formats that get completed as part of the task rather than as separate paperwork. Records reconstructed after a swing do not read as contemporaneous, and assessors test that directly by comparing dates and sequences.
Somewhere between ten and twenty weeks for most operations. Roster patterns and mobilisation windows drive the schedule far more than staff numbers, and we fit implementation work around those rather than fighting them.
Yes, and smaller operations frequently move faster because scope is narrower and decisions happen quickly. Assessment tests whether the system fits your organisation, not whether you employ a dedicated quality manager.
It commonly features in supplier capability requirements, though the position varies by scheme and category. The specific requirements document is the reliable answer rather than a general assumption about government work in this state.
Contractors on operator vendor systems almost always end up holding the full set. A single build removes duplicated governance, and assessors charge less for a combined audit than for three visits booked apart.
Yes, and we plan for it. Implementation activity, internal audit and assessment are all scheduled around shutdowns and swings, since a system built without regard to those realities does not survive a busy campaign.
It gives you the data to see them, which is usually the first time anyone has. In remote delivery the significant cost is the mobilisation to rectify rather than the defect itself, and that becomes visible once nonconformances are recorded consistently.
Yes, through a single system with sampled auditing. The scope statement describes what is covered, and we word it carefully because operators and prequalification schemes read it literally when assessing eligibility.
Yes, across the Pilbara, Goldfields, South West, Mid West and Great Southern, planned around shutdowns and rosters. Documentation and review stages run remotely so travel budget goes where it adds value.
Tell us which vendor systems you are on
The operator prequalification systems you participate in, and the ones you want to join, shape scope more precisely than turnover or headcount ever will.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving