ISO 9000 is a family of standards for quality management systems. ISO 9000 is maintained by ISO, the International Organization for Standardization and is administered by accreditation and certification bodies. For
The Common Source Incorporated, some of the requirements in ISO 9001 (which is one of the standards in the ISO 9000 family) would include:
• a set of procedures that cover all key processes in the corporation;
• monitoring document management processes to ensure they are producing quality product;
• keeping proper records;
• checking outgoing product for defects, with appropriate corrective action where necessary;
• regularly reviewing individual processes and the quality system itself for effectiveness; and
• facilitating continual improvement
A company or organization that has been independently audited and certified to be in conformance with ISO 9001 may publicly state that it is "ISO 9001 certified" or "ISO 9001 registered."
Although the standards originated in manufacturing, they are now employed across a wide range of other types of organizations, including colleges and universities. A "product", in ISO vocabulary, can mean a physical object, or services, or software. In fact, according to ISO in 2004, "service sectors now account by far for the highest number of ISO 9001:2000 certificates - about 31% of the total" - source:
the ISO Survey 2004
Two types of auditing are required to become registered to the ISO 9001: 2000 standard: auditing by an external certification body (external audit) and audits by internal staff trained for this process (internal audits). The aim is a continual process of review and assessment, to verify that the system is working as it's supposed to, find out where it can improve and to correct or prevent problems identified. It is considered healthier for internal auditors to audit outside their usual management line, so as to bring a degree of independence to their judgments.
The 2000 standard uses the process approach. While auditors perform similar functions, they are expected to go beyond mere auditing for rote "compliance" by focusing on risk, status and importance. This means they are expected to make more judgments on what is effective, rather than merely adhering to what is formally prescribed.