ISO 9001 is the international standard that sets the requirements for a quality management system: how an organisation plans, performs, controls and improves its processes to meet customer requirements consistently. The version in force is ISO 9001:2015, confirmed in 2024 without changes. This article was written in 2021 to announce WWG's certification; we keep it with its date and rewrote it in 2026 around the question that matters to anyone choosing a vendor: what changes, in practice, when you work with a software house that applies ISO 9001. The current status of WWG's certifications is published on the partners and certifications page.
TL;DR
- ISO 9001 does not certify the quality of the product but the system the company uses to manage it: defined processes, clear responsibilities, measurement, handling of non-conformities, continuous improvement.
- For a software house's client it means tracked reports, documented requirements, controlled testing and releases, periodic reviews.
- The standard is often a prerequisite for public tenders and for vendor selection in large companies.
- The right way to check a certification is to ask for the certificate with number, body and expiry date; the 2021 announcement is kept as a record of the time.
- Many ISO 9001 practices coincide with those of a good agile process: definition of done, code review, retrospectives, decision logs.
What is ISO 9001 and what does it require?
ISO 9001 is a standard of the International Organization for Standardization that sets the requirements for a quality management system, applicable to any organisation of any size and sector, from a factory to a services company. The aim is to improve the effectiveness and efficiency of the processes used to make a product or deliver a service, and to demonstrate the ability to meet customer and legal requirements consistently. (iso.org)
The 2015 version is organised in seven areas of requirements: the context of the organisation, leadership, risk-based planning, support in terms of resources and competence, operations, performance evaluation and improvement. In practice the company must establish and maintain the necessary documentation and records, measure customer satisfaction, measure and monitor products and processes, analyse data, handle non-conformities and implement corrective and improvement actions. Certification is issued by an accredited body after an audit, lasts three years with annual surveillance audits, and must be renewed.
What changes for the client of a certified software house?
What changes is how the work is tracked and controlled: the client's reports follow a coded process and do not get lost, requirements are documented before development, testing and releases follow defined controls, and management periodically reviews results and problems. It is the difference between trusting the people and trusting the method as well.
| ISO 9001 requirement | How it translates in a software project |
|---|---|
| Documented requirements | A written functional and technical specification approved before development, as in our guide to the technical specification |
| Operational control | Definition of done, code review, integration pipeline and automated tests |
| Handling of non-conformities | Defects logged, classified by severity, with root cause and corrective action |
| Measurement | Project indicators: defects in production, delivery times, customer satisfaction |
| Management review | Periodic portfolio reviews and retrospectives with tracked actions |
| Competence | Training and certification plan, described in our article on continuous learning |
In 2021 we wrote that an IT consulting company has a number of coded processes that track customer reports, preventing tickets from being parked for long periods because of haste or volume, and that this traceability has a cost, from platforms to people, which many clients are willing to pay because they are buying a service that aims to keep improving. That still holds. For many public tenders and vendor selections in large companies, moreover, ISO 9001 is an explicit prerequisite.
How do you verify a vendor's certification?
You verify it by asking for the certificate, which shows the number, the certification body, the scope and the expiry date, and by checking the body in the list of the national accreditation body, Accredia in Italy. A logo on a website or an announcement from a few years earlier is not enough: certifications expire, change scope and must be renewed through periodic audits.
That applies to us too. This article announced in 2021 WWG's certification under UNI EN ISO 9001:2015, with the commitments made: establish a policy for the management system, set quality objectives, document roles and responsibilities, conduct management reviews, identify training needs, document procedures and controls, carry out verification, validation and testing, communicate clearly with clients. We keep it as a record of the time. The current status of WWG's certifications and recognitions, with verifiable documents, is published on the partners and certifications page: that is the source to consult, and we provide certificates to clients on request during vendor selection.
Are ISO 9001 and agile methods compatible?
They are compatible and largely overlapping: the standard asks for defined processes, measurement and continuous improvement, and a good agile process provides exactly that, with the definition of done, code review, retrospectives and a decision log. The difference is that ISO 9001 requires the system to be documented and its application demonstrated to an external auditor.
The mistake to avoid is producing documentation for the audit instead of for the work: a procedure nobody follows is a non-conformity, not a guarantee. In our experience the management system works when the records the standard requires are the ones the team produces anyway, from the backlog to the pipelines to the retrospective notes, and the auditor reads them where they are born. WWG's quality assurance services apply this principle to clients' projects, certified or not.
Want to know how we manage quality and traceability in projects? Talk to a WWG engineer at business@wwg.it.
Sources
FAQ
Frequently Asked Questions
It is the attestation, issued by an accredited certification body after an audit, that an organisation's quality management system conforms to the ISO 9001 standard. It does not certify the product but the way the company defines, controls and improves its processes. It lasts three years, with annual surveillance audits, and must be renewed.
It makes the processes that affect the client traceable and controlled: requirements gathering, development, testing, release, handling of reports and defects, training of people. For the client it means knowing how the work is done and measured; for the company it is often a prerequisite for public tenders and vendor selection in large organisations.
Ask for the certificate, which shows the number, the certification body, the scope and the expiry date, and check that the body is accredited by the national accreditation body, Accredia in Italy. A logo or a dated announcement is not enough, because certifications expire and must be renewed through periodic audits. The current status of WWG's certifications is on the partners and certifications page.
Yes. The standard asks for defined processes, measurement, handling of non-conformities and continuous improvement; a well-run agile process provides them through the definition of done, code review, retrospectives and a decision log. ISO 9001 adds the obligation to document the system and demonstrate its application to an external auditor.
