ISO 9001 for Construction Companies: What a Contractor's Quality Management System Actually Needs

It usually arrives as one line in an email. A main contractor's prequalification questionnaire wants your quality manual. A framework application wants ISO 9001 or a plan to get it. A client's auditor is coming in three weeks and wants to see your procedures. This article explains what ISO 9001:2015 actually asks of a construction contractor, which documents an auditor expects to find, and what a bought-in system can and cannot do for you.

Why contractors are asked for ISO 9001

ISO 9001:2015 is the international standard for quality management systems. It does not tell you how to build anything. It tells you how to organise a business so that what you deliver reliably meets the requirements of the customer and the law, and so that you can prove it. In UK construction it has become the common currency of prequalification: Tier 1 contractors, frameworks and public-sector clients ask for it because it is the simplest way to screen for a contractor who controls their work rather than one who hopes.

Two things are worth stating plainly before going further. First, ISO 9001 certification can only be granted by a certification body, and in the UK the ones your clients will recognise are accredited by UKAS. Buying a set of documents does not make you certified, and any seller who implies otherwise should be avoided. Second, the standard is deliberately generic. It was written to apply equally to a foundry, a software house and a groundworks contractor, which is why most templates read as though they were written for a factory. The work in a construction QMS is translating the generic requirements into the records a site actually produces.

The structure of ISO 9001:2015

The standard has ten clauses. Clauses 1 to 3 are scope, references and terms. The requirements are in clauses 4 to 10:

• Clause 4 - Context of the organisation. Who your interested parties are, what they need from you, and what the scope of the system is.
• Clause 5 - Leadership. Management commitment, the quality policy, and who is responsible for what.
• Clause 6 - Planning. Risks and opportunities, quality objectives, and how change is planned.
• Clause 7 - Support. Resources, competence, awareness, communication, and control of documented information.
• Clause 8 - Operation. The clause that does the work: tender and contract review, design, control of external providers, control of production, identification and traceability, release, and nonconforming outputs.
• Clause 9 - Performance evaluation. Monitoring, customer satisfaction, internal audit and management review.
• Clause 10 - Improvement. Nonconformity and corrective action, and continual improvement.

Clause 8 is where a construction auditor spends most of the day, because it is where the standard meets the site.

What the standard means on a construction site

Each generic requirement has a construction equivalent. The translation below is what a competent auditor is looking for, whether or not your procedures use these words.

• 8.2 Requirements for products and services is tender and contract review: the record that shows you read the specification, understood the inspection and test schedule, priced the handover deliverables and confirmed you could meet the programme before you signed.
• 8.3 Design and development applies to any contractor-designed portion, including temporary works and specialist subcontract design. If you design nothing, say so in the scope and be ready to defend it.
• 8.4 Control of externally provided processes, products and services is subcontractor and supplier control: an approved supplier list with the basis of approval, purchase orders that state the specification, and goods receipt inspection with the delivery ticket and certificates checked before the material goes into the work.
• 8.5.1 Control of production and service provision is the inspection and test plan, the method statement, the task briefing and the check sheet. The standard requires documented information defining what is to be done and the results to be achieved, suitable monitoring and measuring resources, and competent people.
• 8.5.2 Identification and traceability is the batch number on the concrete ticket, the reinforcement mill certificate, the cable drum number and the board serial number, recorded so that any installed item can be traced back to its certificate.
• 8.6 Release of products and services is the signed hold point and the handover certificate: evidence of conformity against the acceptance criteria, traceable to the person who authorised release.
• 8.7 Control of nonconforming outputs is the nonconformance report, quarantine and the concession. Only the party that set the requirement can accept a nonconformity as-is, in writing.
• 7.1.5 Monitoring and measuring resources is the calibration register for your test instruments, torque tools, levels and thermometers, with certificates and due dates.
• 7.2 Competence is the training matrix and the card check, with evidence that the person who signed the test certificate was competent to do so.
• 9.2 Internal audit and 9.3 Management review are the parts most small contractors have never done and the first thing a certification auditor asks for. Both need a programme, records and evidence of action taken.

The documents an auditor expects to see

ISO 9001:2015 is lighter on mandatory documents than its predecessors, but "documented information" is still required for the scope, the quality policy, the quality objectives, and a long list of records. In practice a construction contractor going for certification needs the following, and a client's quality reviewer will ask for most of them at prequalification:

1. A quality manual, or an equivalent top-level description, mapped clause by clause to the standard so that the auditor can find each requirement.
2. A quality policy signed by the person who runs the business.
3. Procedures for the processes that carry risk: document control, tender review, design where applicable, procurement and supplier approval, materials control, planning and method statements, inspection and test planning, calibration, traceability, nonconforming output, corrective action, handover and defects, internal audit and management review.
4. The forms those procedures generate: NCR, corrective action request, inspection and test record, concession, submittal, goods receipt, method statement, inspection request, handover certificate, toolbox talk record.
5. The registers that hold the evidence: documents, standards, ITPs, NCRs, audit programme, corrective actions, risks, calibration, approved suppliers, records retention, training matrix, KPIs, submittals, design changes, defects, lessons learned and complaints.
6. An internal audit checklist and an audit programme with at least one completed audit before the certification body arrives.
7. A management review record.

That is a lot of documents, and it is why most contractors either buy a system or pay a consultant to write one. The difference between a good bought-in system and a bad one is not the number of documents. It is whether each procedure produces a construction record, and whether the acceptance criteria in the forms can be measured.

What a bought-in QMS can and cannot do

A well-written system gives you the documented information the standard requires, structured so that the certification audit is about your business rather than your paperwork. It saves the months it would take to write from a blank page, and if it comes with worked examples it shows your staff what "good" looks like before they fill in their first form.

It cannot make you certified. It cannot run itself: someone has to own it, brand it, cut what does not apply, and make sure the records it describes are actually produced on site. And a system nobody opens fails its first audit, because the auditor will ask for a completed NCR, a signed ITP and an internal audit report, and there will not be one.

A realistic timeline for a contractor with no full-time quality manager is two weeks to brand and tailor, six weeks to get the system in use on a live job, and a further month of records before a certification audit is worth booking. A gap analysis at the start tells you which clauses you already satisfy and which need work; do not book the audit until the gaps are closed.

Choosing between templates

If you are comparing bought-in systems, the questions to ask are these:

• Was it written for construction, or adapted from manufacturing? Look for words like "batch", "production line" and "shipping" in the procedures. Look for the absence of "ITP", "hold point", "concession" and "handover".
• Does every procedure name the record it produces, and is that form in the pack?
• Are the acceptance criteria in the forms measurable, or do they say "satisfactory"?
• Are there worked examples, so you can see what a completed NCR or a completed ITP looks like?
• Has it been audited against the standard by someone other than the author before release?
• Is it native Word and Excel that you own, or a portal you rent?