Start free checkFree check Book a demo

ISO 9001:2015

ISO 9001, run as one system. Not a folder of binders.

For the quality manager whose customers or contracts ask for ISO 9001. Work through all 61 requirements, close non-conformities with 5 Whys and CAPA, and keep controlled documents current.

Book a demoSee the non-conformity register
Requirements view for a demo company with ISO 9001:2015 QMS selected: a compliance bar at 69 % (42 of 61 applicable) and clauses 4.1 to 4.3, on the organisation’s context, interested parties and the scope of the quality management system, each marked Compliant.
Open nonconformities card for a demo company: 4 open findings to close, listing NC-2026-001 (Major) on access reviews for OT accounts and two Minor findings.
ISO 9001:2015 in Fidureon: every requirement with its status, and the open non-conformities on the dashboard. Product screens show a fictional demo company.Open non-conformities on the Fidureon dashboard, by severity. Product screens show a fictional demo company.

What the standard asks

Seven clauses, one improvement loop.

ISO 9001:2015 describes a quality management system in clauses 4 to 10. Fidureon carries all 61 requirements, each with guidance, and shows where the work for each clause gets done.

61 requirements Clauses 4–10

ISO 9001 is voluntary, but customers and tenders often require it. A certification body, usually an accredited one, audits you in two stages and issues the certificate, followed by surveillance audits each year and recertification every three years.

  1. Clause 4: Context of the organisation

    Know who you serve, set the scope and define the processes your system is built from.

    In Fidureon Processes drawn on the process canvas, each step with a responsible role and the records it uses 4.4

  2. Clause 5: Leadership

    Top management owns a quality policy and makes roles and authorities clear.

    In Fidureon Approved policies and business roles 5.2 · 5.3

  3. Clause 6: Planning

    Address risks and opportunities, and set measurable quality objectives.

    In Fidureon Risk register, and quality objectives linked to processes, controls and risks 6.1 · 6.2

  4. Clause 7: Support

    Keep people competent and documented information under control.

    In Fidureon Competence matrix, training, and documents with versions and approvals 7.2 · 7.5

  5. Clause 8: Operation

    Plan and control how you deliver, including what you buy in.

    In Fidureon Processes, supplier register and supplier questionnaires 8.1 · 8.4

  6. Clause 9: Performance evaluation

    Monitor and measure, run internal audits and review the system at management level.

    In Fidureon Internal audits as gap engagements with PDF reports; any finding can be raised as a non-conformity 9.2

  7. Clause 10: Improvement

    When something goes wrong, fix the cause and check the fix worked.

    In Fidureon Non-conformity register with 5 Whys, CAPA and an effectiveness check 10.2

How Fidureon covers it

The records your auditor asks for.

The parts of a quality system that take the most time, in one place, each tied to the clause it answers. These are the real screens, from a fictional demo company.

10.2Non-conformities

Every non-conformity, to closure.

Log what went wrong, where it came from and how serious it is. Find the root cause with a structured 5 Whys, plan immediate, corrective and preventive actions, and close only after you have verified that the fix worked.

  • Sources such as internal and external audit, management review, incidents and control testing
  • Link each finding to the controls, risks and documents it touches
Non-conformity register for a demo company: one open, three in progress, one overdue and one closed; filters by status and severity; and findings NC-2026-001 to NC-2026-003, such as access reviews for OT accounts not performed in Q2, each with a severity (Major, Minor), a status (Corrective Action, Under Investigation, Open) and a source (Internal Audit, Observation).
  1. Every finding moves through the same stages: open, under investigation, corrective action, verification, closed.
  2. Major, minor or observation, so the findings that put a certificate at risk come first.
  3. Internal audit, observation, control testing and more: each finding keeps its source.
The non-conformity register: every finding with its severity, status and source.Findings in the non-conformity register, each with what was found.

7.5Document control

Documents under control.

Procedures, policies and standards with versions and sign-off by every approver you name. Compare any two versions, restore an earlier one, and export to PDF or Markdown.

Policy library for a demo company: policies such as the Information Security Policy, Access Control Policy and Acceptable Use of AI, each with a category, a status of Published (v1) or Pending Approval, and an owner role.
  1. Each document shows the version that is published, or that a new one is waiting for approval.
  2. A new version is published once every approver you named has signed it off.
  3. Each document is owned by a role, so someone is answerable for keeping it current.
  1. Version and status. Each document shows the version that is published, or that a new one is waiting for approval.
  2. Pending approval. A new version is published once every approver you named has signed it off.
Policies with a version, an approval status and an owner.Policies with a category and a version or approval status.

4.3 · 9.2 · 9.3Management system documents

The documents an auditor reads first.

Keep the scope, the context of the organisation, interested parties, management review records and the internal audit programme as controlled documents, each with a category, a status and an owner.

Management system documents for a demo company: scope statement, context of the organisation, interested parties register, management review 2026-H1, risk treatment plan and the internal audit programme 2026–2028, each with a category, a status and an owner role such as Quality Manager.
  1. Inputs, decisions and actions from each management review, kept as a controlled document.
  2. The audit cycle as a document with its owner, here the quality manager.
  3. The auditor sees which version is in force.
  1. Management review. Inputs, decisions and actions from each management review, kept as a controlled document.
  2. Internal audit programme. The audit cycle as a document with its owner, here the quality manager.
Management system documents, shared by every ISO standard you run.

4.4 · 8.1Processes

Draw how your processes run.

Map each process on a canvas, step by step, with the role responsible for each step. Steps link to the real assets, information types and suppliers they use; create a missing record right on the canvas, and the links are saved with the diagram.

Process diagram for a demo company’s Meter-to-cash process: Start, Collect hourly readings and Validate and estimate gaps, both owned by the Quality Manager role, an “Anomaly?” decision and a Field inspection step, linked to an input (Meter reading), an asset (Smart meter head-end), an information type (Hourly consumption data, Confidential), an AI system (Meter anomaly detection, Minimal Risk) and a supplier (Mätpunkt Data AB).
  1. Each step names the role responsible for it, here the quality manager.
  2. This node is the asset in your register, not a drawing of it. The links are saved with the diagram.
  1. A role on every step. Each step names the role responsible for it, here the quality manager.
  2. Real register records. This node is the asset in your register, not a drawing of it. The links are saved with the diagram.
A process on the canvas, each step with a role and the records it uses.
Objectives register of a demo company: objectives such as 100 % phishing-resistant MFA, AI Act readiness for high-risk AI and ISO 27001 certification by Q2 2027, each marked Active.

Objectives you can track.

Set quality objectives with an owner role and a target date, and link each to the processes, controls, risks and requirements it depends on (6.2).

Assessment engagements for a demo company: an ISO 27001 readiness assessment 2026 in progress, with its lead assessor and start date, and the completed ISO 27001 gap analysis 2025 it is compared against.

Internal audits that feed the loop.

Run each internal audit as an engagement with its own findings, scores and branded PDF report, and raise any finding as a non-conformity (9.2). Shown: an ISO 27001 assessment.

Also in the workspace

  • Any other document (7.5) Write and keep the documents that are not policies or procedures, such as exercise reports and terms of reference, beside the controlled ones.
  • Competence and training (7.2, 7.3) Set the competence each role needs, assess people against it and raise an action for every gap. Schedule recurring training, such as on your quality policy, with assignments and reminders.
Documents page for a demo company, “Write and keep any document your organization needs”: three documents, a tabletop exercise report, the terms of reference of an AI council and a security analysis summary in Swedish, each with who last edited it and when.
Free-form documents, with who last edited them and when.Free-form documents, kept beside the controlled ones.

Integrated management system

ISO 9001 and ISO 27001. One management system.

Both standards are built on the same clauses 4 to 10. In Fidureon the shared parts are the same records, so a company running quality and information security does the work once.

Clauses shared by ISO 9001 and ISO 27001, and the Fidureon record that serves both
Clause ISO 9001 ISO 27001 In Fidureon
5.2 Quality policy Policy Policies with versions and approvals
6.1 Same in both: Actions to address risks and opportunities One risk register with treatment plans
6.2 Quality objectives Information security objectives Objectives linked to requirements in both
7.2 Same in both: Competence One competence matrix and training plan
7.5 Same in both: Documented information Document control: versions, approvals, compare
9.2 Same in both: Internal audit Gap engagements with PDF reports
10.2 Same in both: Nonconformity and corrective action One register; each names its standard and clause

One control, many requirements.

  • Link once, count in both Link a control such as supplier evaluation to clause 8.4 in ISO 9001 and A.5.19 in ISO 27001, and its status and evidence count toward both. You make the links; Fidureon suggests them when you import controls from documents or spreadsheets.
  • Quality and security, side by side Requirement and control status come from the actions your teams complete, so work on a shared control moves ISO 9001 and ISO 27001 at the same time.

Running information security too? See ISO 27001 in Fidureon.

Framework readiness card on the dashboard of a demo company, with progress rings: ISO 27001:2022 ISMS at 77 % and ISO 9001:2015 QMS at 69 %, each across one entity.
Readiness per framework on the dashboard, ISO 27001 and ISO 9001 side by side.

FAQ

ISO 9001 questions.

Does Fidureon certify us for ISO 9001?

No. An ISO 9001 certificate is issued by a certification body, usually an accredited one, after its own audit. Fidureon is where you run your quality management system and keep the records that show it works, so that you are ready when the auditor arrives.

Which version of ISO 9001 does Fidureon cover?

ISO 9001:2015: all 61 requirements across clauses 4 to 10, each with guidance and room for evidence. ISO has published a revised edition, ISO 9001:2026, and certified organisations get a transition period to move across; your certification body will tell you when your audits change edition. Ask us in a demo about the 2026 edition.

How are non-conformities handled?

Each non-conformity records its source, such as an internal or external audit, management review, incident, risk assessment or control testing, a severity of major, minor or observation, and the clause it breaks. You find the root cause with a structured 5 Whys, plan immediate, corrective and preventive actions, then verify the fix and confirm that it was effective before you close it. Non-conformities link to controls, risks and documents.

How does document control work?

Policies, standards and management documents such as procedures are versioned. A new version goes to the approvers you name and is published once all of them have approved; you can compare any two versions and restore an earlier one, and documents export to PDF and Markdown.

Can we run ISO 9001 and ISO 27001 as one management system?

Yes. Both standards share the same structure in clauses 4 to 10, so policies, the risk register, objectives, the competence matrix, documents and internal audits are the same records for both. A control can be linked to requirements in both standards, so its status and evidence count toward each. You make the links yourself, and Fidureon suggests them when you import controls from documents or spreadsheets.

Where is our quality data kept?

Fidureon is built and operated by CShift AB in Göteborg and hosted on Google Cloud in the EU: europe-north1 (Finland) is the primary region, and evidence files are replicated every day to europe-north2 (Stockholm). The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company. The security page has the details.

How do we get started with ISO 9001?

Book a demo and we will walk through your own quality management system with you.

Show your auditor the whole loop.

Book a demo on your own ISO 9001 scope. Running ISO 27001 as well? The free readiness check covers ISO 27001 and the EU AI Act.

Book a demoStart free readiness check