Manufacturing · ISO and GRC consulting
ISO certification for manufacturing: one system for quality, safety and the plant floor.
Your customers send supplier questionnaires, your approved-vendor status depends on a valid certificate and your auditors want to see production running. Sterling's expert and experienced consultants build the system with your plant team, around the processes you already run, and stay with you through the certification audit. We ensure successful certification for our clients.
- Quality, environment, safety and energy in one integrated system, with one internal audit and one management review for the plant
- Built around your routings, control plans, shifts and suppliers, with Effivity included with the engagement, at no additional cost
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- Keep approved-supplier statusA valid certificate on the scope your customers check, renewed without a lapse.
- Fewer repeat defectsNonconforming product contained, causes found and corrective actions closed with proof.
- Safer shiftsHazards controlled on every line and shift, including contractors and agency staff.
- One audit-ready plantQuality, environment and safety records in one place, ready for any auditor.
What Manufacturing is asked for
The standards manufacturers are asked for, and when each one applies.
Most plants start with ISO 9001 because customers and tenders ask for it first. ISO 14001 and ISO 45001 usually follow, and many manufacturers run the three as one system. Automotive, medical device and food producers then add the scheme their customers or regulators recognise.
Why now
Why manufacturers are certifying, or re-certifying, now.
The reasons are rarely abstract. A customer asks, a tender closes, an edition changes or something goes wrong on the line.
- Customers and OEMsSupplier onboarding packs and annual vendor reviews ask for a valid certificate, and a lapse can put you on conditional status until it is restored.
- Tenders and vendor listsIndustrial and export tenders often screen out bidders without a certified quality system before price is compared.
- Revised editionsISO 9001:2026 was published on 16 September 2026 and ISO 14001:2026 on 15 April 2026, each with a three-year transition for existing certificates.
- Regulators and sector schemesAutomotive parts are certified under the IATF scheme, device makers selling into the United States work to the FDA's QMSR, and food brands may ask for FSSC 22000.
- Group and parent companiesMultinational parents and brand owners often roll one set of standards out to every plant, so a new or acquired site has to catch up.
- Incidents and near missesA recall, a customer escape, an injury or a permit exceedance usually shows the controls that were missing, and the case for fixing them properly.
Scope and evidence
What the requirements look like on a production floor.
The standards are written for any organisation. On a plant, the auditor looks for the same things in your own language: routings, control plans, calibration, permits and shift records.
| Requirement area | What it looks like in Manufacturing | Evidence auditors ask for |
|---|---|---|
| Scope, sites and shifts | Every production line and shift in scope, plus warehouses, design offices and head-office functions that support the plant | A scope statement, a site and process map, headcount by shift and the list of outsourced processes |
| Production and release | Planned and controlled production, first-off and in-process checks, and product released only when the checks are complete | Work instructions, control plans or inspection plans, release records and the log of nonconforming product and its disposition |
| Measuring equipment | Gauges, instruments and test rigs calibrated where results depend on them, with measurement studies where automotive customers require them | A calibration register, certificates traceable to the equipment, out-of-tolerance reviews and, for IATF 16949, MSA results |
| Suppliers and outsourced work | Raw material, components, subcontract machining, coating or heat treatment controlled like your own processes | Supplier evaluations, incoming inspection records, supplier performance data and corrective action requests |
| Environmental aspects and permits | Emissions, effluent, waste, chemicals, energy and water identified as aspects and monitored against permit limits | An aspects register, a register of compliance obligations, monitoring results, waste manifests and the evaluation of compliance |
| Workers and contractors | Hazards on every line and shift, with contractors and agency staff inside the system and controls chosen in the order the hierarchy of controls sets | Hazard and risk assessments, machine guarding and ventilation checks, contractor permits, training records and emergency drills |
Where energy is in scope, ISO 50001 adds an energy review, energy performance indicators and a baseline. Certification auditors for safety and environmental standards tour the plant while it operates, so evidence has to come from the floor, not only the office.
The engagement
What happens between the first call and the certificate.
Six steps, the same for every standard. For most manufacturers the primary standard is ISO 9001, with ISO 14001, ISO 45001 or a sector scheme integrated in the same project.
- 01Define what the certificate needs to cover.Confirm activities, sites, headcount, customer expectations and the intended certification scope.
- 02Gap analysis: review the current system against the requirements.The gap analysis identifies what is missing, preserves effective practice and agrees actions, owners, dates and resources.
- 03Implement and collect meaningful evidence.Put controls into use, train the relevant people and keep the records that show how the system operates.
- 04Audit, review and address the findings.Internal audit and management review evaluate implementation; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, internal audits, reviews and improvement continue, alongside the body's surveillance audits and three-yearly recertification.
What you receive
Everything a working, certifiable system needs. No separate purchases.
- Scope and gap analysis reportThe scope of the certificate and every shortfall against the standard, with an owner and a date.
- Implementation planMilestones, responsibilities, the weekly session calendar and the target audit window.
- The documented management systemPolicies, processes, procedures, forms and records on Sterling's template sets, tailored to your operation.
- Effivity workspace, configuredDocuments, registers, audits, actions, training records and management review in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner courses for the people who run the system, internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Internal audit and management reviewProgramme, checklists, report, corrective actions closed with evidence, and a management review record with decisions.
- Certification readinessCertification bodies compared and their accreditation checked, Stage 1 and Stage 2 preparation, and support until the certificate is issued.
- The Sustain™ calendarThe year after certification planned: surveillance dates, internal audits, refreshers, new-hire training and any transition to a revised edition.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Standards for Manufacturing
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 13485ISO 13485 certification consulting for medical device makers: design controls, risk, traceability and complaints, prepared for an accredited audit.
- ISO 22000ISO 22000 certification consulting: PRPs, a validated hazard control plan, traceability and recall readiness, built with your teams for an accredited audit.
- ISO 50001ISO 50001 certification consulting for measured, normalised energy performance improvement, with the data to prove it at an accredited certification audit.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- IATF 16949IATF 16949 certification consulting for automotive part makers: defect prevention, less variation and waste, prepared for an IATF-recognised body's audit.
Manufacturing client experience
On the record: what Manufacturing clients say about working with Sterling.
The plant manager reports that the collaboration delivered HACCP and ISO 9001:2015 certification, tightened internal processes and gave the company a credential that directly supports its expansion into international markets.
The ISO and GRC in-charge writes that Sterling's deep understanding of ISO 9001 and ISO 14001 helped the company streamline its processes and align them with internationally recognised practice, and that the team's insights were essential in working through complex requirements.
The production manager writes that the workshops helped production staff understand why each control matters rather than only which forms to complete, and that the HACCP plan is now clearer, more consistent and easier to maintain.
The director of IT infrastructure writes that Sterling's professionalism, patience and expertise helped the team work through the process with confidence, and that beyond compliance the consultants helped it understand the intent behind the standard, find improvement opportunities and strengthen the ISMS in a practical, sustainable way.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions Manufacturing clients ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Which ISO standards does a manufacturing company need?
Most manufacturers need ISO 9001 first, because customers and tenders ask for it before anything else. ISO 14001 and ISO 45001 follow when customers, parent companies or your own risks call for environmental and safety control. Automotive parts makers add IATF 16949, medical device makers ISO 13485 and food producers ISO 22000 or FSSC 22000. The discovery call confirms which ones your customers actually check.
Is ISO 9001 enough if we supply automotive or medical device customers?
Usually not. IATF 16949 is implemented together with ISO 9001 and your customers' specific requirements, and it is audited by an IATF-recognised certification body. ISO 13485 is a separate device quality standard, and its certificate is not a claim of conformity to ISO 9001. Device approval remains a separate decision by the regulator or notified body. We plan the order so that work done for one standard counts towards the next.
Can we combine ISO 9001, ISO 14001 and ISO 45001 in one system?
Yes, and most plants should. The three standards share the same structure, so one document set, one risk approach, one internal audit programme and one management review can serve all of them. Your certification body can then audit them together. What stays separate is the content: product quality, environmental aspects and workplace hazards each need their own assessment and controls.
How long does ISO certification take for a manufacturing plant?
It depends on the standard and on how much of the system already runs. As a guide, ISO 9001 typically takes three to six months, ISO 14001 and ISO 45001 four to eight months, ISO 50001 six to twelve months and IATF 16949 nine to eighteen months. More sites, more shifts and several standards at once extend the plan; existing control plans and records shorten it.
Will the certification auditor want to see production running?
Yes. Auditors assess the system where the work happens, and for safety standards the audit includes a tour of operations. Shifts that run different processes, such as nights or weekends, may be visited as well. We plan the internal audit to cover every shift and site first, so the certification audit finds the same controls on the night shift as on the day shift.
We are certified to ISO 9001:2015. What does ISO 9001:2026 mean for us?
Your certificate stays valid while you transition. ISO 9001:2026 was published on 16 September 2026 with a three-year transition to 30 September 2029, and the timetable for your transition audit is confirmed with your certification body. We review your system against the revised edition, update what has changed and run the internal audit on the new requirements before the body arrives.
Does Sterling issue the certificate, and can you cover plants in several countries?
No. Sterling does not certify; an independent, accredited certification body audits your plant and decides. Our role is implementation, training, internal audit and readiness. For groups with plants abroad, Sterling has offices in 21 countries and has supported 8,100+ client engagements in 60+ countries since 2003, so one engagement team can run a multi-site programme on a single plan.
Talk to a consultant
Plan certification for your manufacturing operation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice