The first 90 days of a first quality manager should end with five things in hand: a signed scope statement under clause 4.3, a clause-by-clause gap list for clauses 4 through 10, a first internal audit (clause 9.2) and a first management review (clause 9.3) that have already happened, a corrective-action log (clause 10.2) with real entries, and a shortlist of accredited certification bodies with quotes requested. Not a quality manual. Not a certificate date.
This page is for 10–300 employee manufacturers in the United States that just posted a quality engineer, quality manager, or director of quality role whose description says “drive us toward ISO 9001 certification” or “build our QMS.” You are hiring one person to carry the company to a certificate. Six to nine months is typical for a first certification. The first quarter decides whether that range holds or slips.
It does not walk the three clocks of a first certificate; that is the first-time certification article. It does not teach the gap walk; that is the gap-assessment article. It names what the hire must produce, what to write in the posting so the right person applies, what the hire should not touch in the first quarter, and the two clauses that sink first Stage 1 audits.
What the first 90 days must produce
Judge the hire on artifacts, not activity. Each deliverable below has a clause number and a physical form: a signed page, a dated list, minutes, a log, an email thread with a registrar.
| Deliverable | Clause or standard | What done looks like | When |
|---|---|---|---|
| Scope statement | 4.3 | One paragraph naming the site, the products, and the processes, with any exclusion justified in writing. Signed by the owner or general manager. | By week 2 |
| Gap list | 4 through 10 | Every requirement sorted into do-and-can-prove, do-but-unwritten, or do-not-do, with a named owner and a due date on each open gap. | By week 4 |
| Corrective-action log | 10.2 | A log that is open and in use: nonconformity, cause, action, and a verification date on each entry. At least a few entries closed with evidence that the action worked. | From week 1 onward |
| First internal audit | 9.2 | A dated audit of the core processes by someone who does not run them, with findings written down and handed to corrective action. | By week 8 |
| First management review | 9.3 | Dated minutes with every input from clause 9.3.2 on the agenda, “no data yet” written where that is true, and the clause 9.3.3 outputs recorded as decisions with owners. | By week 10 |
| Registrar shortlist | ISO/IEC 17021-1 | Quotes requested from at least three certification bodies accredited by a signatory to the Global ACI MRA (formerly the IAF MLA) such as ANAB, with audit-day estimates and earliest Stage 1 dates in hand. | By week 12 |
The scope statement comes first because everything else hangs on it. It names what the certificate will cover and what it will not. A build-to-print shop that does no design states that clause 8.3 does not apply and says why. Get it signed; an unsigned scope is a draft.
The gap list is the project plan. The gap-assessment article covers how to sort each requirement into three buckets and why a website scan is not that walk. What matters here is the output: a list with owners and dates that leadership has seen. A gap list that lives only on the hire’s laptop is not a deliverable.
Audit days follow IAF MD 5, which sizes the audit from effective headcount, sites, and complexity, so request quotes while the gap list is still ugly. Lead time is measured in weeks, not days.
What to write in the job posting
“ISO 9001 experience required” attracts people who sat in an audit once. It does not tell a strong candidate what the job is, and it does not tell a weak one to stay away. Name the deliverables. Someone who has produced them before will recognize the list; someone who has not will read it and self-select out.
- Write a QMS scope statement (ISO 9001:2015 clause 4.3) and get it signed by leadership within the first month.
- Produce a clause-by-clause gap list for clauses 4 through 10, with an owner and a date on every open gap.
- Plan and lead the first internal audit (clause 9.2) and run the first management review (clause 9.3) inside the first quarter.
- Stand up corrective action (clause 10.2) so nonconformities are recorded with cause, action, and verification, starting with the next bad part or late delivery.
- Shortlist certification bodies accredited by a signatory to the Global ACI MRA (formerly the IAF MLA) such as ANAB, request quotes, and bring audit-day estimates and dates to leadership.
- Own document control (clause 7.5) so the revision on the floor is the one in use, and keep training and calibration records current as the work happens.
Then ask for evidence in the interview. “Show me a management review you ran. What were the inputs? What decisions came out of it?” A candidate who answers with a talk about culture has not run one. Ask for the last corrective action they closed and how they verified it worked. The answers are either specific or they are not.
Title matters less than reporting line. Clause 5.1 puts top management on the hook for the system, and clause 5.3 has top management assign the roles. A hire who reports three layers down and cannot get the owner into a management review is a document clerk, whatever the posting calls the role. Say in the posting who the role reports to and that the owner will sit the review.
What the hire should not spend the first quarter on
The quality manual. ISO 9001:2015 no longer requires a quality manual. A hire who opens a template on day one and starts filling in a long manual is producing something no clause asks for, in a form that promises processes the shop does not run. Keep a short manual later if a customer or the registrar wants a map. It is not a first-quarter deliverable.
A certificate date. Booking Stage 1 for a month when no management review has happened often turns Stage 1 into a not-ready letter and a rebooking fee. Request quotes in the first quarter, yes. Set the Stage 1 date only once the review and the audit have records behind them. The certification body samples what exists; it does not audit intentions.
The two clauses that sink first Stage 1 audits
The gap-assessment article names the two gaps that stop Stage 1; on this calendar they look like this: a first Stage 1 with no management-review record and no corrective-action record often ends in a not-ready letter. Both records are cheap to produce and impossible to backfill honestly. That is why they sit in the middle of the 90-day table rather than at the end.
Clause 9.3, management review
Clause 9.3.2 lists what a review must consider: the status of actions from the previous review, changes in external and internal issues, customer satisfaction and feedback, whether quality objectives were met, process performance and product conformity, nonconformities and corrective actions, monitoring and measurement results, audit results, supplier performance, adequacy of resources, whether risk actions worked, and opportunities for improvement. Clause 9.3.3 lists what must come out: opportunities for improvement, any need to change the QMS, and resource needs, with documented information kept as evidence. A first review will have “no data yet” against several inputs; write that down rather than leaving the input off the agenda. What sinks Stage 1 is a review that never happened, or minutes that read like a production meeting with the word “quality” added.
Clause 10.2, corrective action
Clause 10.2.1 asks the organization to react to a nonconformity, evaluate whether the cause needs eliminating, act on it, review whether the action worked, update risks and opportunities if needed, and change the QMS if needed. Clause 10.2.2 asks for documented information on the nature of the nonconformity, the action taken, and the results. A hire can start this in the first week with the next bad part, the next late shipment, or the next customer complaint. The auditor will pick one entry and follow it through cause, action, and verification. The management-review and corrective-action articles walk each clause in detail; this page only insists that both have dated entries before day 90. The standard sets no deadline for either; the 90 days are this page’s plan.
How the documentation gets written in parallel
The gap list will show documented information that does not exist: procedures for the processes the shop runs, forms that capture the records clauses 7 through 10 expect, a policy and objectives under clauses 5.2 and 6.2. Someone has to write those while the hire runs the audit, the review, and the registrar calls. There are three routes, and the hire should own the choice.
- The hire writes it. The result is sized to the shop by definition, and the hire will know every sentence at Stage 2. The cost is the calendar: the writing competes with the audit, the review, and the day job, and the record clock does not pause while procedures are drafted.
- A consultant writes it. For a shop this size, consultants commonly quote $5,000 to $25,000 for documentation and hands-on help, and the good ones write from your floor rather than from a binder. The hire still owns approval and still runs the processes.
- A fixed-price packet. ISO Delivered’s Full documentation package is one option: documentation sized to how your company runs, a flat $8,000, typically 2–4 weeks after a complete intake. That window is an estimate, not a commitment. It is documentation, not certification, and the hire approves every page before it goes on the floor.
Whichever route, the hire is the approver. Documents must describe what the shop does, because the hire is the one who will defend them to the auditor. No documentation provider is an accredited certification body, and none of the three routes shortens the record clock. The certification decision belongs to the certification body after Stage 1 and Stage 2.
The day-90 checkpoint
At day 90, put the table on the desk and check each row for a dated artifact. If the scope is signed, the gap list has owners, the audit and the review have minutes, the corrective-action log has closed entries, and three registrar quotes are in, the timeline in the introduction still holds.
If the rows are empty, look at clause 5 before you look at the hire. A quality manager who could not get the owner into one management review in a quarter usually has a leadership problem, not a competence problem. Fix the reporting line, sit the review, and restart the clock. If leadership did show up and the rows are still empty, the posting attracted the wrong person.
Sources
- ISO 9001:2015 — Quality management systems — Requirements. The clause numbers on this page refer to this text.
- IAF MD 5 — The audit-duration document for management system audits, now held on the Global ACI document site. Registrar quotes on the shortlist are sized from its tables.
Frequently asked questions
Can one hire carry a small manufacturer to ISO 9001 certification?
One hire can own the system. They cannot do it alone. Clause 5.1 requires top management to take accountability and provide resources, and clause 9.3 has top management review the system. Clause 9.2 requires audits to be objective and impartial, so at least one other person or an outside auditor is involved. The certificate itself is issued by an accredited certification body after Stage 1 and Stage 2.
Should we book the Stage 1 audit inside the first 90 days?
Request quotes and pick a shortlist inside the first 90 days. Set the Stage 1 date only after the first management review and the first internal audit have dated records. Stage 1 checks whether those records exist; booking it before they do often produces a not-ready letter and a rebooking fee.
Is AS9100 or IATF 16949 experience a substitute for ISO 9001 experience?
Usually yes for this role. AS9100 and IATF 16949 are built on ISO 9001 and add sector requirements on top. A candidate who has run management review and corrective action under either scheme has run clauses 9.3 and 10.2. Ask for the same artifacts in the interview and check that they know which additions do not apply to a plain ISO 9001 scope.
Quality engineer, quality manager, or director of quality: which title should we post?
The title matters less than the reporting line and the authority. The person must be able to get top management into management review (clause 9.3), stop nonconforming product (clause 8.7), and audit processes they do not run (clause 9.2). Post the title your pay band supports and state the reporting line in the posting.
How much ISO 9001 experience is enough?
Enough to have produced the deliverables before. Ask a candidate to walk through a management review they ran, a corrective action they closed with verification, and a scope exclusion they justified. Specific answers with dates and outcomes are the evidence. Years on a résumé are not.