Quality · 25 June 2026 · 12 min read

ISO 9001 for CNC machine shops: a clause-by-clause guide

Strip away the jargon and ISO 9001 asks a precision shop one question: can you prove you do what you say you do? Not that you're perfect — that you're in control, and that when something goes wrong you catch it, contain it, and stop it happening again. Here's the 2015 standard translated into shop-floor terms, clause by clause: what each one actually means at the machine, the evidence an auditor will ask for, and where shops most often trip up.

This is written for the 5-to-30-person UK sub-contract or precision shop — milling, turning, grinding, surface treatments — whether you're already certified and want surveillance to feel lighter, or you're working toward it and want the map. ISO 9001:2015 has ten clauses; the first three are scope, references and definitions, so the real work lives in clauses 4 to 10. We'll take them in order.

Want to skip the reading and see roughly where you stand first? Our free ISO 9001 readiness check scores you against these same clauses in about ninety seconds.

Clause 4 — Context: know who you serve and how the work flows

What it means on the floor: write down who your customers and other "interested parties" are (customers, regulators, key suppliers, your own people), what they need from you, and the scope of your quality system — what it covers and what it doesn't. Then map your processes: the actual flow from enquiry to quote to job to inspection to despatch.

Evidence an auditor wants: a documented scope statement and a process map or interaction diagram. Where shops trip up: a scope written once at certification and never looked at again, or a process map that bears no resemblance to how jobs actually move through the shop.

Clause 5 — Leadership: the owner owns quality

What it means on the floor: in a small shop you are top management, and the standard wants visible commitment — a short, honest quality policy, clear roles and responsibilities, and a customer focus that's real rather than framed on a wall. The quality manager can run the system, but accountability sits with the owner.

Evidence an auditor wants: a one-page quality policy that's actually understood by the people doing the work, and a clear answer to "who's responsible for what." Where shops trip up: a policy nobody on the floor could paraphrase, and "responsibility" that all funnels to one overworked QM.

Clause 6 — Planning: risks and measurable objectives

What it means on the floor: think ahead about what could go wrong — a single-source supplier, a machine with no backup, one person who's the only one who can run the grinder — and decide what you'll do about each. Then set measurable quality objectives (on-time delivery, first-pass yield, scrap rate) and actually track them through the year.

Evidence an auditor wants: a live risk register with actions, and objectives with real numbers reviewed across the year — not invented the week before. Where shops trip up: objectives like "improve quality" with nothing measured behind them, and a risk assessment done once for the certificate and never revisited.

Clause 7 — Support: people, calibration and documents

What it means on the floor: three things auditors lean on hard in a machine shop. Competence (7.2): a skills matrix showing who's trained to do what, with records and review dates. Calibration (7.1.5): every gauge and instrument on a schedule, with due dates tracked and overdue kit flagged and quarantined. Documented information (7.5): your procedures and work instructions version-controlled, with a clear "current" version and an approval trail.

Evidence an auditor wants: the matrix, the calibration register (and no in-date-but-actually-overdue gauges in use), and controlled documents where the latest revision is unambiguous. Where shops trip up: a micrometer in daily use whose cal certificate lapsed four months ago, and three slightly different copies of the same work instruction floating around with no way to know which is live.

Clause 8 — Operation: this is where the shop lives

Clause 8 is the biggest, because it's the actual work. For a machine shop it breaks down roughly like this:

• Contract / requirements review (8.2): before you accept an order you confirm you can meet it — the drawing, the spec, the quantity, the date. The quote and order acknowledgement are your evidence.
• Purchasing and supplier control (8.4): an approved-supplier list, and incoming material checked against its certs — heat number, cast, mill certificate — before it goes near a job.
• Production control (8.5): the job traveller, the routing, the controlled drawing at the machine, and identification and traceability through the process so you can answer "what material, which operator, which machine" for any part.
• Inspection and release (8.6): first-article and in-process inspection, with records, before product is released.
• Control of nonconforming output (8.7): when something's wrong, it's identified, segregated, dispositioned and recorded — not quietly reworked and forgotten.

Where shops trip up: material traceability that breaks the moment a bar is cut and the cert isn't linked to the job, and inspection that happened but wasn't recorded in a way you could put in front of an auditor six months later.

Clause 9 — Performance evaluation: audit yourself before they do

What it means on the floor: monitor your objectives, run internal audits (9.2) on a schedule against the clauses, and hold a management review (9.3) that covers the inputs the standard lists — audit results, objective performance, customer feedback, nonconformities, status of actions. The management review is where leadership looks the system in the eye once or twice a year.

Evidence an auditor wants: internal-audit findings tracked to closure, and a management-review record that genuinely covers every required input. Where shops trip up: an internal audit done in a panic the month before surveillance, and a "management review" that's a ten-minute chat with no record.

Clause 10 — Improvement: nonconformity and corrective action

What it means on the floor: when a nonconformity happens — internal scrap, a customer complaint, an audit finding — you raise it, contain it, and where it warrants it, drive a corrective action (CAPA) to root cause and verify the fix actually worked before you close it. This is the engine of the whole standard: the loop that stops the same problem recurring.

Evidence an auditor wants: NCRs with dispositions, and CAPAs chased to root cause with an effectiveness check. Where shops trip up: CAPAs closed without the effectiveness check ever being done — the single most common finding we've seen, and the one a good auditor digs into first.

The pattern underneath all of it

Read those clauses back and one thing connects the trip-ups: the records get created after the fact, in separate places, with nothing linking them together. The defect on a pad, the NCR in one system, the job in another, the calibration in a spreadsheet, the cert in an email. ISO 9001 doesn't fail shops because they do bad work — it catches them out because the evidence of good work is scattered and reconstructed under pressure.

That's the gap DAS QMS was built to close, and it's worth being plain about how: by capturing each record at the moment the work happens, and by storing the chain as a chain — defect → NCR → CAPA, each inheriting the job, part-revision, machine and operator automatically — so that when an auditor asks for the trail, it's a few clicks rather than a folder excavation. We dug into exactly what that does to surveillance week in a separate piece on audit prep.

Why I'm writing this

I ran a UK precision-machining shop for years, certified to ISO 9001, and I did all of this the hard way before I built software for it. DMOS — and the DAS QMS module in particular — is the operating system that ran that shop, turned into a product, refined over real audits and real non-conformities. That's also why you won't find a fabricated ROI table here: run your own numbers, and if you want to see a real shop's audit pack, our pricing's here and a twenty-minute demo is below.