ISO 9001 (ISO 9000 Quality Management Systems)

ISO 9001 means ISO 9001:2015, titled Quality management systems: Requirements. It is an international standard published by the International Organization for Standardization (ISO). It specifies requirements for a quality management system that an organization can use to demonstrate its ability to consistently provide conforming products and services.

ISO 9001 belongs to the ISO 9000 family of quality management standards. Organizations use it as a basis for establishing, implementing, maintaining and assessing a quality management system. In Canadian federal procurement, buyers cite it when they want assurance that a supplier controls the quality of what it delivers.

Where ISO 9001 sits in the ISO 9000 family

The ISO 9000 family covers quality management as a whole, and ISO 9001 is the member that contains the requirements. A supplier builds a quality management system around those requirements and can then be assessed against them. The Standard Acquisition Clauses and Conditions (SACC) Manual identifies the standard by its full title, Quality management systems: Requirements, in clause D5509C. See the SACC Manual clause D5509C.

Outside Canada, NATO bodies use the same standard. NATO's Communications and Information Agency reported ISO 9001:2015 certification for the full life-cycle support of Integrated Air and Missile Defence capabilities, as described on its quality management system page.

ISO 9001 alongside AQAP-2110 and Government Quality Assurance

In defence procurement, ISO 9001 is commonly used with NATO quality assurance requirements, including the Allied Quality Assurance Publications (AQAP) and Government Quality Assurance (GQA). CanadaBuys guidance on standards and quality assurance allows a buyer to require a contractor to establish and maintain a quality assurance system. It names three ways to show adequate controls:

• ISO 9001:2015;
• ISO 9001:2015 plus AQAP-2110; or
• an equivalent recognized qualifying program.

The standard is therefore one accepted route to meeting a quality assurance requirement, not the only one.

How DND solicitations use ISO 9001

Department of National Defence (DND) solicitations may require the contractor's quality system to comply with ISO 9001:2015 during contract performance. Examples appear in the request for proposal W8485-247842 and the request for proposal W8476-236718. These solicitations also impose Government Quality Assurance. The contractor must give the Quality Assurance Representative access to contractor and subcontractor facilities and provide assistance for evaluating, verifying and validating conformity.

Some DND materiel and spare-parts solicitations take a lighter approach. The request for standing offer W8486-260438 recommends that the contractor base its quality system on ISO 9001:2015. It also requires inspections and testing, retention of complete inspection records, and access to those records by authorized DND representatives.

Compliance versus registration under clause D5509C

SACC clause D5509C states that the contractor must comply with the ISO 9001:2015 requirements appropriate to the contract work. It also states that the contractor is not necessarily required to be registered to ISO 9001. The same position appears in the DND solicitations above: ISO registration is not intended to be mandatory, but the contractor's quality management system must address the requirements that apply to the work. A solicitation can still expressly require certification or registration, so the bid documents set the rule for each opportunity.

What it means for a supplier bidding on Canadian public contracts

Read the quality assurance clauses in each solicitation closely, because the obligation changes from one to the next. Depending on the document, a supplier may need to:

• maintain a quality management system that addresses the ISO 9001 requirements relevant to the work;
• hold ISO 9001 certification or registration where the solicitation expressly requires it;
• conduct and document inspections and tests;
• retain quality and inspection records;
• permit Government Quality Assurance audits, inspections or verification;
• flow applicable quality requirements to subcontractors and external providers; and
• report non-conforming products or services where the contract requires it.

Suppliers that already hold ISO 9001:2015 certification, or ISO 9001:2015 with AQAP-2110, are well placed for defence work. Suppliers without certification should check whether the clause asks for compliance only, and be ready to show how their documented system covers the applicable requirements.