ISO 29001 · Sector-specific quality management systems, oil and gas
ISO 29001 certification consulting for the supplier quality operators and contractors demand.
Get ISO 29001 certified by an independent, accredited body, first time, on the date your customer qualification needs. Sterling's expert and experienced consultants build the oil and gas supplements onto a working ISO 9001 system with your people, from risk-based controls and validated competence to inspection and test plans, supplier assessment and change control, prepare the evidence and stay with you through the certification audit and after it, in 60+ countries. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced oil and gas quality consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO 29001 client experience
What it is
What is ISO 29001 and what is it used for?
ISO 29001 is the quality management system standard for organisations that supply products and services to the petroleum, petrochemical and natural gas industries: equipment manufacturers, fabricators, coating and heat-treatment contractors, inspection, maintenance and well-service companies, and distributors. Prepared by ISO/TC 67, the oil and gas industries committee, it exists because the sector's supply chain runs on evidence: an operator qualifying a vendor wants to see how risk is assessed, how special processes are validated, who is competent for which task and how a change is controlled before it reaches the field.
The construction of the standard matters. Every requirement of ISO 9001:2015 is reproduced inside it, in boxed text, unaltered and in its entirety; the sector-specific supplemental requirements and guidance sit outside the boxes, clause by clause. ISO 29001 adds the documented processes, risk-based controls and records oil and gas customers ask for anyway, in the language of the industry's product specifications, such as the quality specification level of API Spec 6D and the product specification level of API Spec 6A and 17D.
Current edition. ISO 29001:2020, published in May 2020, is the first edition of ISO 29001 as a full International Standard; it replaced the technical specification ISO/TS 29001:2010 and was confirmed by ISO in 2025. Amendment 1:2024, published in February 2024, adds the climate-change consideration to clauses 4.1 and 4.2; accreditation bodies such as UKAS have said no transition programme or certificate update is needed for it. ISO 29001:2020 is written as a supplement to ISO 9001:2015. ISO 9001:2026 was published on 16 September 2026 and, at the time of writing, ISO/TC 67 has not listed a revision of ISO 29001 to follow it, so ISO 29001:2020 remains the edition you implement and certify to; ask your certification body early how it will schedule the ISO 9001 transition for a combined ISO 9001 and ISO 29001 certificate. ISO 29001 and ISO 9001:2026: what is known and what to ask your certification body
Who it is for
Who needs ISO 29001 certification?
ISO 29001 is for any organisation in the oil and gas supply chain whose customers are operators, EPC contractors, drilling contractors or the larger suppliers above it, and for the supplying arms of operators themselves. The certificate's scope should describe the products and services your customers qualify you for. Organisations come to Sterling for ISO 29001 from four starting points:
- A vendor list, prequalification or tender asks for it. An operator's approved vendor process, an EPC contractor's questionnaire or a national oil company's registration names ISO 29001, sometimes next to API Spec Q1 or Q2. Establish which credential, scope and accreditation are wanted before you commit.
- You hold ISO 9001 and want the sector credential. Your quality system works, but competitors present ISO 29001 in bids and customers read ISO 9001 alone as generic. The supplements are added to the system you run and audited with it.
- Field nonconformities, customer audits and expediting are costing you. Rejected items, missing traceability, unvalidated welding or coating, changes that reached the customer unannounced. ISO 29001 puts inspection and test plans, validated processes and change control into daily work.
- You are a service company, not a manufacturer. Inspection, maintenance, repair, well services, rental equipment or logistics. ISO 29001 requires the usage history, repairs, modifications and critical spares of service equipment to be documented, and customers ask service providers for the certificate, or API Spec Q2, too.
The intended benefit is a supply relationship your customers can verify. The results come from implementation and continued ownership, not from the certificate by itself.
Business benefits
How ISO 29001 supports supplier qualification and reliable delivery
A sector quality system should help you win and keep the customers who audit you. We start where a missing record, an unvalidated process or an uncontrolled change costs a qualification, a shipment or a claim, and build the system around those points.
- Faster vendor qualificationDocumented processes, a risk method and competence records in the form operator and EPC auditors expect, so a supplier audit confirms rather than discovers.
- Fewer field nonconformitiesInspection and test plans with hold points, validated special processes and release on evidence, so the item that ships is the item specified.
- Traceability that survives a claimUnique identification from material certificate to shipped item and the person who released it, retrievable when a customer or an investigation asks.
- Suppliers managed by riskCritical providers assessed at planned intervals and controls adjusted to the risk, not one approved-vendor form for everyone.
- Competence you can proveA competence catalogue, proficiency levels and validated profiles for the tasks that carry risk, not a training matrix nobody has tested.
- Changes that do not surprise the customerChanges to organisation, key people, critical providers, design or the system reviewed for risk and notified where the product or service is affected.
Track a few measures that reflect these priorities, such as customer audit findings, field nonconformities per shipment and on-time delivery. A thicker set of procedures is not a result.
Requirements
What are the main ISO 29001 requirements?
ISO 29001 keeps the harmonised structure of ISO 9001, clauses 4 to 10, and every ISO 9001:2015 requirement applies as written; clause 3 adds five sector terms, among them quality specification level, competence profile and inspection and test plan. The supplements add, in most clauses, a documented process where ISO 9001 leaves the method to you, a record where ISO 9001 requires only for an outcome, and a risk basis for the depth of control. The table is a plain-language map; the programme checks your implementation against the standard clause by clause.
| Clause | What it requires of you | What the ISO 29001 supplement looks like in practice |
|---|---|---|
| 4 Context of the organisation | Understand the business, its interested parties and the boundaries of the system, and keep the evidence | Records that demonstrate the understanding of context and of interested parties' needs; a documented scope, with any requirement claimed not applicable advised to interested parties on request; the extent of documented information defined from interested parties' requirements |
| 5 Leadership | Set direction, keep a quality policy in use, promote customer focus and define roles | The ISO 9001 leadership requirements, plus relevant roles defined and their responsibilities and authorities kept as documented information, so an auditor or a customer can see who decides what |
| 6 Planning | Manage risks and opportunities through a defined process, set objectives and control change | A documented risk and opportunity process naming its techniques and tools, sources of risk, analysis of consequence and likelihood, evaluation, controls and treatment plans; management of change, with the risks of each proposed change assessed and recorded |
| 7 Support | Provide infrastructure, measuring equipment, competence, awareness and controlled documented information | Documented maintenance processes: what is maintained, how and how often, to which acceptance criteria and by whom, with usage history and critical spares for service equipment; a measuring equipment register with unique identification; competence validated to the risk of the task; external providers' personnel aware of the customer, regulatory and conformity assessment requirements of their work; documented document control, including how customer specifications, addenda and errata enter procedures |
| 8.1 to 8.3 Operational planning, customer requirements, design | Plan operations against the customer's scope, review requirements through a defined process and design with risk built in | Quality plans, service quality plans or inspection and test plans for products, projects and contracts; change management in operational planning and, where a contingency plan is the risk treatment, its roles, communication and immediate actions; a documented contract review process; design planning that builds in the risk process and records inputs, reviews, verification, validation and changes |
| 8.4 to 8.7 External providers, production, release, nonconforming outputs | Control external providers by risk, produce and serve under validated and traceable conditions, release on evidence and control what does not conform | Supplier performance assessed at planned intervals, controls adjusted to risk; validation of processes whose output cannot be verified later, with equipment, competence, methods, acceptance criteria and revalidation defined; documented processes for traceability, customer property, risk-based preservation, release and nonconforming outputs; changes to organisation, key personnel, critical providers, design or the system reviewed, with customers notified where affected |
| 9 Performance evaluation | Monitor, measure, analyse, audit and review through defined processes | Documented processes for measuring customer satisfaction and for collecting and analysing data, including audit and management review results; audit intervals set from the risks and performance of each process, which can mean monthly or quarterly audits of critical processes |
| 10 Improvement | Correct nonconformities, remove their causes and improve under change control | A documented corrective action process; improvements implemented through the management of change process; a documented continual improvement process with evidence that it delivers |
What does useful ISO 29001 evidence look like?
A risk register that names its method and links each treatment to a control, inspection and test plans with hold and witness points, a competence matrix with the assessments behind it, maintenance records against acceptance criteria, supplier performance reviews, validation records for welding, coating and other special processes, traceability from material certificate to shipped item, change records with their customer notifications, release records with the authorising signature, and nonconformity reports with concessions. They live in Effivity from the first workshop, so the auditor sees a system that runs.
ISO 29001 requirements explained, clause by clauseCertification process
How do you get ISO 29001 certified?
Build a system that works first; then an independent certification body assesses it. Sterling provides consulting and preparation, the certification body decides, and that separation gives the certificate its value.
- 01Define what the certificate needs to cover.Products, services, sites and headcount, the customer specifications and API product standards in play, and whether ISO 9001 is already certified.
- 02Gap analysis: measure the current system against ISO 9001:2015 and every ISO 29001 supplement.Clause by clause: which documented processes exist, which are practised but unwritten and which are missing, with actions, owners and dates agreed.
- 03Implement and collect meaningful evidence.The risk process, competence validation, inspection and test plans, supplier controls and management of change in daily use, with records accumulating as work is done.
- 04Audit, review and address the findings.An internal audit programme with intervals set by process risk, and a management review that decides; findings are raised by us first and closed with evidence.
- 05Complete the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit of implementation and effectiveness; respond to any findings and await its decision.
- 06Maintain the system after certification.Monitoring, risk-based internal audits, reviews and improvement continue, alongside annual surveillance audits, recertification in the third year and customer audits in between.
Judge the route on its credibility, not only on the quoted price. Ask who will issue the certificate and whether ISO 29001 is on that body's accreditation schedule: ISO 29001 is not among the management system sub-scopes listed in the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA, so recognition rests on the individual accreditation body and on what your customer accepts. API Spec Q1 and Q2 registration is a separate programme of API's own registrar, APIQR. How to choose a credible ISO 29001 provider · The certification buyer's checklist
Cost
How much does ISO 29001 certification cost?
There is no useful universal price for ISO 29001 implementation. A valve distributor with a certified ISO 9001 system needs a different scope from a fabricator validating welding, NDE and coating across two yards. What we can promise is a proposal in which every component is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Whether ISO 9001 already exists, the documented processes to build, special processes to validate, sites, and how much of the work your team takes on (Design™ or Drive™) |
| Independent certification | The certification body's audit days for the scope, whether ISO 9001 and ISO 29001 are audited together, locations, travel and annual surveillance |
| Internal resources | Process-owner time, competence assessments, supplier re-evaluation, maintenance and calibration catch-up, and operational changes the gap analysis reveals |
| Software and learning | Included in a Sterling engagement: Effivity for the system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, system upkeep, customer audit preparation, refreshers and future transitions under Sustain™ |
What moves the price
- Manufacturing, service or both, and how many special processes need validation
- The number of critical suppliers and the depth of control each one needs
- Sites and countries, and one certificate or several
- Whether a certified ISO 9001 system exists, and how much of it is documented
- Customer specifications, API product standards and any API Spec Q1 or Q2 registration in parallel
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 29001 certification take?
The realistic timeline depends on your starting point, the availability of your people, the processes to be validated and the certification body's schedule. It is measured in months, not days, typically four to eight, and shorter where a certified ISO 9001 system exists: the risk process, the maintenance and competence records and the supplier assessments must run long enough to produce the evidence an auditor asks for. The plan is built backwards from that evidence, with milestones your team tracks in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to people, sites, customer specifications, existing procedures and records |
| Build and implementation | Documented processes to write or rewrite, process validations, supplier re-assessments and internal capacity |
| Evidence and review | Processes operating long enough to show effectiveness, then the internal audit programme and management review |
| Certification assessment | The certification body's availability, Stage 1 and Stage 2 scheduling, and the time to address any findings |
If a vendor registration, a tender or a customer audit sets the date, share it at the start. We will say plainly what is achievable and which decisions cannot wait. A certificate date promised before anyone has seen your shop floor, yard or service base is a sales tactic, not a plan.
Challenges
Common ISO 29001 implementation challenges
ISO 29001 programmes tend to stall on the same five problems. Each has a practical answer.
The ISO 9001 system never wrote down the processes ISO 29001 requires.
ISO 9001 lets you decide what to document; ISO 29001 requires documented processes for risk, maintenance, measuring equipment, competence, document control, contract review, design, traceability, preservation, release, nonconforming outputs, corrective action and improvement. We write them with the process owners from how work is actually done, so each describes your operation.
Competence is asserted, not validated to the risk of the task.
Certificates on file are not competence validated to task risk. We build the competence catalogue and proficiency levels for the roles that matter, run the assessments with your supervisors and keep the profiles current in Effivity, so a customer auditor sees who is qualified for which task.
The risk register is disconnected from the shop floor.
A register reviewed once a year does not satisfy a standard that expects risk to set the depth of inspection, supplier control and audit frequency. We connect each significant risk to a control in the inspection and test plan, the supplier assessment or the audit programme, and review them together.
Changes live in e-mail and reach the customer as surprises.
Management of change has to cover organisation, key personnel, critical providers, design and the system itself, with customers notified where products or services are affected. We agree the triggers, review, authorisation and notification rule, and run it as one workflow.
Every customer wants a different credential.
One operator asks for ISO 29001, another for API Spec Q1, a service customer for API Spec Q2, and all of them for their own specifications. We build one system on the ISO 9001 core and map each scheme's extra requirements to it, so the same records serve every audit.
Your engagement
What your ISO 29001 engagement includes
Where others sell consulting alone and leave software, training and audit readiness to you, a Sterling engagement covers the whole route to the certificate, from one team, for one all-inclusive proposal.
Scope, gap analysis and implementation plan
Against ISO 9001:2015 and every ISO 29001 supplement, with responsibilities, dates and decision owners agreed before work starts.
Process development and documentation
The documented processes ISO 29001 requires, from the risk method and competence model to inspection and test plans and change control, on Sterling's template sets, built with your process owners.
Effivity ISO & GRC software
Your sector QMS is configured in Effivity from the first workshop, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, on the risk-based audit programme, with findings closed with evidence before the certification body arrives.
Certification readiness and support
Stage 1 and Stage 2 preparation, help with any findings the body raises, and support until the certificate is in your hands.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO 29001 implementation
ISO 29001 engagements are delivered on Sterling OS™, our operating system for consulting work: five phases, each with defined deliverables, decision owners and evidence. You choose how much of the work your team carries; the method, the software and the accountability do not change.
- 01Design™Guided implementation: your team builds the supplements with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed work with your process owners.
- 03Sustain™Post-certification operation: surveillance readiness, risk-based internal audits, customer audit preparation, refreshers and new-hire training, year after year.
- 04Automate™The QMS in Effivity: documents, risks, competence, maintenance, calibration, suppliers, audits, actions, KPIs and management review in one workspace.
- 05Revise™Alignment when ISO 29001 or ISO 9001 is revised, additions such as API Spec Q1 or Q2, and changes in scope, sites or customer requirements.
The first week fixes the engagement team, the weekly working session, the deliverables and who decides what; every later session reviews progress against them, so a slipping supplement shows in month two, not at Stage 1.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO 29001
- API Spec Q1API Spec Q1 certification consulting for oil and gas suppliers: contract review, design, purchasing and release controlled, prepared for the APIQR audit.
- AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
- AWS StandardAWS water stewardship certification to the Alliance for Water Stewardship Standard: what it is, who asks for it and how Sterling prepares your site for audit.
- CHAS, SafeContractor and AchillesCHAS, SafeContractor and Achilles accreditation for UK contractors: what each scheme is, who asks for it and how Sterling prepares your evidence.
- GRESBGRESB assessment explained: Real Estate, Infrastructure and Development components, the annual cycle, validation and ratings, and how Sterling prepares you.
- IATF 16949IATF 16949 certification consulting for automotive part makers: defect prevention, less variation and waste, prepared for an IATF-recognised body's audit.
Effivity · ISO 29001 QMS software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO 29001:2020.
Every Sterling ISO 29001 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the QMS workspace within the agreed scope, so the documented processes, risk register, competence records, maintenance and calibration, supplier evaluations, inspection and test records, nonconformities, audits and management review live in one place, the system runs in daily work and the certification auditor, or your customer's auditor, reviews a live system. Your Effivity subscription is included with the engagement, at no additional cost.
Context, interested parties and scope, evidence retained
Issues, interested parties and their requirements, and the scope are kept as a reviewed register, so the records clauses 4.1 and 4.2 ask you to retain exist as a matter of course.
Policy, defined roles and quality objectives
The policy, the roles with their documented responsibilities and authorities, and the objectives with measures, owners and dates live where their owners work, with progress reported from the system.
The documented risk process and management of change
A risk and opportunity register recording method, sources, analysis and treatments, linked to the controls they justify; change requests reviewed for risk, authorised and closed, with customer notification recorded.
Competence, maintenance, measuring equipment, documents
Competence profiles and proficiency levels per person, linked to Sterling Academy; maintenance plans with acceptance criteria and history; a measuring equipment register with unique identification and calibration status; documents with versions, approvals and the customer specifications they carry.
Contract review, inspection and test plans, suppliers, release
Requirement reviews, quality plans and inspection and test plans as forms and workflows, supplier evaluation and periodic performance assessment, validation records, traceability, preservation, release with the authorising person, and nonconforming outputs with concessions.
Risk-based audits, data analysis and management review
An audit programme with intervals set per process, findings and follow-up; customer satisfaction and KPIs on live dashboards; a management review that records inputs, decisions and actions.
Nonconformity, corrective action and controlled improvement
Nonconformities and complaints raised, investigated and closed with root cause and evidence that the action worked; improvements routed through the change process, as clause 10.3 requires.
Your own processes, forms and reports
Forms, fields, workflows and reports adapted to how you work, without code; customer, regulatory and API product-standard requirements tracked to the processes they affect.
What this means at the audit
The certification auditor, and the operator's supplier auditor a month later, ask for the risk register and its method, the competence profiles of the people on the job, maintenance and calibration records, supplier assessments, the inspection and test plans for a live order and the open nonconformities. In Effivity each is a screen, with dates, owners and evidence attached, not a folder assembled before Stage 1. After certification, Sustain™ continues in the same workspace, so the surveillance auditor finds a system that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your procedures, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS and more when you integrate other standards
ISO 29001 client experience
Client letters on file, available on request.
Signed client letters for ISO 29001 are available on request. The client feedback wall lists every letter by standard.
Case study with ISO 29001 in scope
One integrated system for an oil and gas operator.
- 01Read the case study
Oil and gas: a dependable supply chain and stronger safety across five standards
An oil and gas organisation needed a dependable supply chain and strong safety performance in a complex industry. It implemented ISO 9001, ISO 14001, ISO 45001, ISO 29001 and API Spec Q1. Supplier assessment and procurement moved onto Sterling's software platform, maintenance improved and downtime fell, and early hazard identification, joined-up emergency response plans and a stronger safety culture reduced incidents and their consequences. Its VP of operations said the company had fundamentally improved how it operates.
Sterling Academy · ISO 29001 e-learning
Train every employee on ISO 29001, not just the quality department.
ISO 29001 expects the people doing the work, including external providers' personnel, to know the customer and regulatory requirements, risk mitigations and conformity assessment requirements of their tasks. Sterling Academy delivers that awareness for the whole workforce and practitioner learning for those who run the system: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO 29001 awareness for every employee, with the evidence the standard requires
- Practitioner courses for process owners, the quality lead, inspectors and the management representative
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for every audit
- New hires and contractor personnel trained as they arrive, so evidence is current at every audit
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about ISO 29001
Watch a video on how to implement ISO 29001 and API Spec Q1 here.
Watch a video on ISO 29001 requirements here.
Why Sterling
Want successful ISO 29001 certification? Come to Sterling.
Whether you supply one operator from one workshop or several national oil companies from yards and service bases in different countries, Sterling helps you establish the sector quality processes with clear local ownership, working through differences in customer specifications, API product standards, suppliers and regulation without losing sight of how each site delivers.
Management systems in 60+ countries since 2003
Quality, environmental and safety systems implemented for equipment manufacturers, fabricators, service companies and operators across every region we serve, with one engagement team accountable wherever you operate.
All-inclusive proposal
Consulting, Effivity, training and Academy access in a single proposal, certification-body fees shown separately, and a fee that does not move.
A system your people can use
The documented processes ISO 29001 requires, written at the length the work needs and connected to training and software, so inspectors, planners and supervisors adopt the system rather than tolerate it.
Expert and experienced consultants
Consultants who have advised on quality management systems across sectors and countries since 2003, who know how operators and EPC contractors audit suppliers, and who build your system properly the first time, so the certification audit confirms what works.
The Sterling Promise
What our ISO 29001 certification success guarantee means
We stay with you until your agreed ISO 29001 certification outcome is achieved, supporting implementation, preparation and the resolution of assessment findings. Clear explanations, practical delivery, included software and employee learning turn the investment into a capability your customers can verify.
The engagement letter names the standard, the scope, the outcome and each party's responsibilities. Your organisation provides accurate information and operates the agreed controls. Conformity is assessed, and the certification decision taken, by the independent certification body. Our commitment concerns the agreed certification support, not a promise of every vendor approval, tender award or error-free delivery.
After certification
What happens after ISO 29001 certification?
Your sector quality system should keep working as orders, specifications, suppliers and people change: risks reviewed, competence profiles current, maintenance and calibration continuing, changes controlled and improvements checked for effect. The certification body returns for surveillance audits, normally each year, and for recertification in the third year; your customers return for their own supplier audits whenever a contract requires.
As you grow into new products, services or customers, the system should evolve with you. Under Sterling OS™ Sustain™ we review customer audit findings, field nonconformities and supplier performance with you alongside the internal audits, management reviews and surveillance preparation, so the system stays alive between audits.
FAQs
Frequently asked questions about ISO 29001
What is the difference between ISO 29001 and ISO 9001?
ISO 29001 contains the complete text of ISO 9001:2015, reproduced unaltered in boxed text, and adds supplemental requirements and guidance for suppliers to the petroleum, petrochemical and natural gas industries. The additions mostly require documented processes, records and a risk basis for the depth of control: a defined risk method, competence validated to task risk, documented maintenance and measuring-equipment processes, inspection and test plans, supplier performance assessment, validated processes, traceability, management of change with customer notification, and risk-based audit intervals.
Do we need ISO 9001 certification before ISO 29001?
Not as a rule of the standard: ISO 29001 includes every ISO 9001 requirement, so a first-time implementer can build to ISO 29001 directly. In practice most organisations either hold ISO 9001 and add the supplements, or have both audited together. Ask the certification body how it structures the audit and certificates for your scope.
ISO 29001 or API Spec Q1 and Q2: which one does our customer want?
They are different schemes. ISO 29001 is the ISO standard, certified by accredited certification bodies. API Spec Q1 is the American Petroleum Institute's quality specification for manufacturers, now in its 10th edition, and API Spec Q2 its specification for service supply organisations; registration to both comes only through API's own registrar, APIQR, and API Spec Q1 is also the system requirement behind an API Monogram licence. Many suppliers hold ISO 29001 and API Spec Q1 or Q2 on one system; we map both schemes to one set of processes.
Which documented processes does ISO 29001 make mandatory?
Where ISO 9001 lets you decide what to document, ISO 29001 requires documented processes for risk and opportunity, management of change, maintenance, measuring resources, competence, document control, contract review, design, external providers, process validation, traceability, preservation, release, nonconforming outputs, data analysis, corrective action and continual improvement, plus the records showing each runs. The gap analysis lists which you already have.
Does Sterling issue the ISO 29001 certificate?
No. Sterling provides consulting and hands-on support. An independent certification body, accredited to ISO/IEC 17021-1 with ISO 29001 on its schedule, conducts the Stage 1 and Stage 2 audits and makes the decision. A provider offering to implement and certify on one invoice is offering paper.
What does ISO 9001:2026 mean for ISO 29001?
ISO 29001:2020 is written as a supplement to ISO 9001:2015 and reproduces that edition's text in full, so it is complete in itself and remains the certifiable edition. ISO 9001:2026 was published in September 2026; ISO/TC 67 has not yet listed a revision of ISO 29001 to align with it. If you hold both certificates, confirm with your certification body how it will schedule the ISO 9001 transition and treat the combined certificate. Sterling's Revise™ service runs the review and the plan.
Can ISO 29001 be integrated with ISO 14001 and ISO 45001?
Yes. Because ISO 29001 keeps the harmonised structure of ISO 9001, the context, leadership, planning, support, performance evaluation and improvement clauses can be shared with an environmental and a health and safety system, which is how the integrated oil and gas programme on this page was built. The sector supplements and each standard's specific requirements still have to be met in full.
What does Sterling's 100% success guarantee mean for ISO 29001?
We stay with you until your agreed ISO 29001 certification outcome is achieved, through consulting, assessment preparation and the resolution of audit findings. The engagement letter fixes the standard, scope and outcome; the audit and the decision belong to the independent certification body.
What do you need to prepare an ISO 29001 proposal?
The products or services to be covered, the sites, approximate headcount, whether ISO 9001 or another certificate exists, the customer requirement or vendor questionnaire behind the enquiry, any API Spec Q1 or Q2 ambition, and your deadline. That is all a scoped, all-inclusive proposal needs; no quality manual has to exist first.
Before the first call
Prepare a useful ISO 29001 readiness brief
No quality manual is needed before the first discussion. Bring a short account of what you supply, to whom, and where the certificate should help. Seven questions are enough:
- Which customer, vendor list or tender is asking, and does it name ISO 29001, API Spec Q1, API Spec Q2 or all three? If nobody has asked, what should the operation do better?
- Which products or services are in scope, at which sites, and which special processes, such as welding, NDE or coating, are done in-house or by suppliers?
- How do you review customer specifications today, and how do changes to orders, designs or key people reach the customer?
- What do customer audit findings, rejected items, field nonconformities and supplier problems say about the starting point?
- Which existing procedures, inspection and test plans, competence and maintenance records already work well?
- Who can make decisions and give time to implementation, internal audits, competence assessment and learning?
- Is there an existing ISO 9001 or other certificate, a customer audit date or a vendor registration deadline to plan around?
These answers let us scope the work and price it realistically. They prepare a conversation; they are not a scored assessment and not a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO 29001 certification.
An ISO 29001 certificate is useful when the operator's vendor department accepts its scope and accreditation, and when the system behind it survives the supplier audit that follows. The oil and gas market attracts paper: certificates from bodies nobody accredits, "ISO 29001 / API Q1" documents from firms outside API's programme, and consultants who promise to manage everything while your inspectors and welders change nothing. They cost less, until a vendor auditor or a failure investigation checks.
How to choose a credible ISO 29001 provider
- Ask who will issue the certificate, check its status and scope on the body's public register, and check that ISO 29001 appears on its accreditation schedule.
- Confirm the accreditation your customer accepts with the accreditation body itself; ISO 29001 is not a listed sub-scope of the Global ACI arrangement, so acceptance is a question for the operator, not a logo in a quotation.
- Treat any "API Q1" or "API Q2" certificate from an ISO certification body as a warning sign. API registration comes only from APIQR, and API's directory shows who holds it.
- Ask how the programme will validate your special processes, assess competence and review live orders. Procedures with another company's name still in them do not survive a customer audit.
- Identify who carries each task, which assessment costs are separate, and what support exists when Stage 2 or a customer audit raises findings.
- Refuse "certified in 7 to 10 days", "we manage everything" and a single invoice covering consulting and the certificate. A sector quality system has to be implemented and operated before it can be audited.
Keep exploring
More on ISO 29001 and related standards
Every ISO 29001 guide
More in Construction, energy, oil & gas
Talk to a consultant
Plan your ISO 29001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice