ISO 9001 for Manufacturers: A Gap Analysis Checklist Built Around What Auditors Actually Check

The quality records are in three places. One folder on the production manager's desktop. A binder from 2019 sitting on a shelf in the office. And the way things are "supposed to be done" that everyone on the floor just knows. ISO 9001 certification is entirely possible from this starting point. But you need a map before you can navigate it.

This guide is that map. At Kaiso we run this exercise with manufacturers every week: the starting state is almost always messier than the client expected and the gap almost always smaller. What follows covers what the standard actually requires for a production environment, what you almost certainly already have without realising it counts, and the three gaps that regularly catch manufacturers out on Stage 2 day.

What ISO 9001 actually asks of a manufacturer

ISO 9001:2015 is a process standard, not a paperwork standard. It asks you to demonstrate that your operation runs consistently, that you know when something goes wrong, and that you fix the cause rather than just the symptom. For a manufacturer, the clauses that carry the most weight are the ones tied to production itself: how you control what gets made, what you measure it against, and whether your suppliers and equipment are reliable enough to trust.

The standard does not require a Quality Manual (that requirement was removed in the 2015 revision). It does not require an elaborate document hierarchy. What it requires is evidence that your processes are controlled and repeatable, at a level of detail proportionate to the risk of getting them wrong.

A one-page work instruction for each process line that actually matches what people do is enough. The auditor's question is not "is this beautifully formatted?" It is "does this reflect what happens, and can you show me that it happened on this job?"

What you already have without realising it counts

Most manufacturers coming to ISO 9001 for the first time assume the gap is enormous. It usually is not. The evidence of a functioning operation is already there. It just lives in twelve different places and nobody has called it by the right name yet.

• Production procedures and work instructions. Even informal, floor-level instructions count as documented information if they describe the process accurately. A laminated sheet on the machine, a step-by-step in the maintenance log, a supervisor's handwritten notes that everyone refers to: these are starting material, not disqualifications.
• Incoming inspection logs. If someone checks goods when they arrive and writes anything down, that is Clause 8.4 evidence in waiting. The format does not matter yet.
• Training and induction records. HR sign-offs, toolbox talk sheets, skills sign-offs from the team leader: all of this maps to Clause 7.2 (competence). If you have new employee checklists, you probably have more than you think.
• Supplier invoices and approved supplier lists. An informal "we only buy from these three suppliers for X" practice, even undocumented, can become formal supplier evaluation criteria with one afternoon's work.
• Customer complaint or return records. A complaints register, a returned-goods log, even a shared inbox thread: these feed directly into Clause 10.2 (corrective action).
• Equipment maintenance logs. Service records, maintenance schedules, the log the maintenance tech keeps: this is the foundation for Clause 7.1.5, even if calibration records are missing from it.

The gap analysis exercise is an inventory exercise before it is a remediation exercise. Start by listing what exists, in whatever form it takes. The real gaps become visible only after that.

The manufacturing gap analysis: clause by clause

Work through these in the order they appear in the standard. The priority column reflects what Kaiso's experts see auditors focus on most sharply in manufacturing Stage 2 audits.

• Clause 7.1.5: Monitoring and measurement resources. This is the most commonly missed manufacturing requirement. Do you use measuring equipment — calipers, gauges, test equipment, thermometers, load cells? Every piece of measuring equipment used to verify product conformity needs a calibration record, not just a service history. The record must show what it was calibrated against, when, by whom, and what the acceptable tolerance is. Current state at most manufacturers: equipment is serviced, not calibrated; records show maintenance dates but no reference standard or tolerance result. Priority: fix before Stage 2.
• Clause 8.4: Control of externally provided processes, products and services. Supplier evaluation is required for every external provider that affects product quality. That means not just your material suppliers but also your subcontractors, your calibration service, your finishing house, your outsourced heat treatment. Most manufacturers have an implicit approved supplier list but no formal evaluation criteria on file. The standard does not require annual audits of every supplier; it requires defined criteria and evidence that they were applied. Current state at most manufacturers: approved suppliers known, criteria not documented, evaluations not recorded. Priority: fix before Stage 2.
• Clause 8.5.1: Controlled conditions for production. Work instructions, process parameters, monitoring requirements: these need to be documented at the process level, not the business level. One page per process line is usually enough. The test is whether a competent person could follow the instruction to produce a conforming product without asking anyone else. Current state at most manufacturers: the experienced operators know what to do; the instructions are either missing or do not match current practice. Priority: fix before Stage 2.
• Clause 8.7: Control of nonconforming outputs. When something goes wrong in production, there needs to be a defined process for identifying it, segregating it, and deciding its fate (rework, scrap, concession). Most manufacturers do this instinctively; the gap is the record that it happened on specific jobs. Current state at most manufacturers: process exists, records are sporadic or informal. Priority: can formalise during implementation.
• Clause 7.2: Competence. Not just that people were trained, but that their training was appropriate for the tasks they perform, and that there is a record. New hires and role changes are the most common gap. Current state at most manufacturers: induction exists, role-specific competency records patchy or absent for recent hires. Priority: can build progressively, but must be current by Stage 2.
• Clause 9.2: Internal audit. You need to have completed at least one internal audit cycle before Stage 2. This is a procedural requirement that cannot be backdated. It requires documented evidence: an audit schedule, audit report, and any findings raised and closed. Current state at most manufacturers: never done. Priority: schedule this from week one; it takes time to complete properly.
• Clause 9.3: Management review. Senior leadership must formally review the QMS at planned intervals. Minutes are the evidence. This cannot be informal. Current state at most manufacturers: leadership discussions happen; no formal minutes exist with the required inputs (audit results, quality objectives, customer feedback, nonconformances). Priority: schedule early; one completed review is the minimum.

The calibration gap that catches manufacturers on Stage 2 day

It is worth dwelling on Clause 7.1.5 because it catches more manufacturers by surprise than any other clause.

Here is the distinction the standard makes: maintenance is keeping equipment in working order. Calibration is verifying that measuring equipment is producing accurate readings, traceable to a known standard. An auditor asking for calibration records on a micrometer is not asking for the last service date. They are asking: how do you know this instrument reads correctly, what was it compared against, and what is the acceptable tolerance?

Many manufacturers have annual servicing for their measuring equipment. Almost none have calibration records in the sense Clause 7.1.5 requires, unless a customer has previously asked for them. The fix is not expensive. An accredited calibration service can issue certificates for common measuring equipment. Some equipment can be in-house calibrated against a traceable master, with the process documented. But it requires identifying every piece of measuring equipment used in product verification, which is usually a longer list than expected: calipers, micrometers, dial gauges, temperature sensors, pressure gauges, balances, hardness testers.

If you find yourself preparing for Stage 2 with no calibration records, understanding what the auditor will specifically ask about is the fastest way to prioritise which instruments to address first.

The tribal knowledge problem

In most manufacturing businesses, the people who know how things really work are not writing it down. The senior operator who has run Line 3 for twelve years. The purchasing manager who knows which suppliers actually deliver on spec and which ones need watching. The maintenance technician who understands why the torque setting on machine 7 needs to be 3% lower than the manual says.

ISO 9001 is, among other things, a formal test of key-person risk. Clause 8.5.1 asks whether a competent person could produce a conforming product without that person being in the building. Most manufacturing operations cannot honestly say yes. The auditor knows this, and they are not being hostile when they ask; they are checking whether the experience has been captured somewhere it can survive a retirement or a resignation. That is the same question any major customer or acquirer would ask, and the auditor is not being hostile in asking it.

The practical approach: start with the highest-risk processes, the ones where a mistake produces scrap, a safety issue, or a customer complaint. Interview the people who run them. Write a one-page work instruction that reflects what they actually do, not what the theory says. Have them review it. That process, repeated across the critical steps of the operation, is the QMS for a manufacturer.

How to triage: what to fix first

Not everything can happen at once, and some gaps matter more than others for Stage 2. The following sequence reflects what Kaiso's experts see as the most defensible approach for a manufacturer starting from a disorganised position.

1. Build the calibration register first. Because this takes the longest to remediate properly. Getting an accredited calibration service involved, receiving certificates, updating the register: this is a real-world logistics exercise that cannot be compressed. Start it in week one.
2. Document the three or four most critical process lines. Not everything: the processes where quality failures have consequences. Get these into work instruction format that operators can recognise as accurate. You need at least one completed internal audit before Stage 2, and these procedures are what the audit will test against.
3. Formalise supplier evaluation for your top ten external providers. Define simple criteria (on-time delivery, conformance rate, quality complaints) and apply them retrospectively where records exist. Document the criteria, document the list, document any recent issues and how they were resolved.
4. Schedule internal audit and management review immediately. These cannot be created after the fact. They need to happen, produce records, and be closed out before the Stage 2 date. Book them into the calendar in week one so they do not slip.
5. Reconstruct competency records for recent hires. Even a supervisor sign-off that confirms training was completed and the person demonstrated competence is better than nothing. Work forward from the hire date.

The gaps that can wait: the quality objectives process, the customer satisfaction mechanism, the risk and opportunity register. All required, but all buildable progressively. A first internal audit that surfaces these as areas for development is not a problem; it is evidence the audit process is working.

How AI document ingestion handles the messy-records starting state

The hardest part, in practice, is assembling everything that exists — across inconsistent formats, scattered locations, and informal systems, and working out what it maps to.

That is the specific problem Kaiso was built to address. Upload your production procedures, your incoming inspection checklists, your supplier lists, your equipment register, your training inductions: Kobi, the platform's AI engine, reads them and maps them to relevant ISO 9001 clauses in a single session. It flags what you have, what it needs more context to assess, and where the gaps are. The output is not a generic checklist. It is a gap picture built from your actual documentation, showing which clauses have coverage and which do not.

An expert then reviews the output, closes the interpretive gaps that require judgement rather than pattern matching, and helps prioritise what to build first. The starting state of the records does not need to be clean for this to work. Messy is the normal input. The platform is designed for it.

Kaiso's AI reads your existing production documentation and flags what is missing, so you start with a roadmap, not a panic.

Frequently asked questions

Where does a manufacturer start when their quality records are disorganised?

Start with an inventory of what already exists, not with what is missing. Most manufacturers have more ISO 9001 evidence than they realise: production procedures, supplier records, training sign-offs, incoming inspection logs, maintenance records. Assemble these, map them to the standard's clause structure, and identify the genuine gaps. The gap analysis is an inventory exercise before it is a remediation exercise.

What documents does a manufacturer actually need for ISO 9001?

ISO 9001:2015 requires documented information at specific clauses, but does not prescribe a format or a document hierarchy. For a manufacturer, the minimum set includes: a defined scope, a quality policy, documented procedures for the processes that affect product quality (particularly production, inspection, nonconforming output, and corrective action), a competency record for each role, calibration records for measuring equipment, internal audit records, and management review minutes. The standard removed the Quality Manual requirement in 2015.

How long does ISO 9001 certification take for a small manufacturer?

Most small manufacturers (10 to 50 people) can move from a gap analysis to a Stage 2 audit in three to six months, depending on the complexity of their processes and how much documentation already exists. The hard constraint is time: a management review and at least one internal audit cycle must be completed before Stage 2, and both require scheduling lead time. Starting both in the first two weeks of implementation is standard practice.

What is the calibration requirement under ISO 9001 Clause 7.1.5?

Clause 7.1.5 requires that measuring equipment used to verify product conformity is calibrated or verified at defined intervals against measurement standards traceable to a national or international standard. Calibration records must identify the equipment, the calibration standard used, the result, and the acceptance criteria. Regular maintenance or service records do not satisfy this requirement unless they also contain this information. Equipment that cannot be calibrated must be identified, and its limitations must be understood and managed.

Do I need to evaluate all my suppliers for ISO 9001?

Clause 8.4 requires evaluation and selection of external providers based on their ability to provide conforming outputs. This applies to all external providers of goods and services that affect the quality of your product, not just material suppliers. In practice, the depth of evaluation should reflect the risk: a sole-source supplier of a critical component warrants more rigorous evaluation than a stationery supplier. The standard requires that evaluation criteria are defined and that there is evidence of them being applied. An approved supplier list with documented criteria and any performance records (complaints, on-time delivery history, inspection results) is the typical starting point.