To get ISO 9001 certified as a care provider, you build a quality management system that meets the standard, run it for long enough to produce records, then pass an audit by an accredited certification body. The work breaks into eight steps, from gap analysis to the certification audit.
This checklist is for NDIS providers and aged care providers in Australia. ISO 9001 is voluntary. It does not replace your NDIS registration audit or your aged care quality assessment, but a well-run quality system makes both of those much easier.
What ISO 9001 covers for a care provider
ISO 9001 is the international standard for quality management systems. It sets out how an organisation plans its work, controls its documents, manages risk, checks its own performance and improves. It does not set care standards. It says nothing specific about restrictive practices, medication or clinical care.
That is why it sits alongside your sector standards rather than in place of them. The NDIS Quality and Safeguards Commission regulates providers against the NDIS Practice Standards, and the Aged Care Quality and Safety Commission assesses providers against the Aged Care Quality Standards. Both expect good governance, risk management, feedback handling and continuous improvement. ISO 9001 gives you a tested structure for exactly those things.
| Area | What ISO 9001 asks for | Where the sector standards overlap |
|---|---|---|
| Leadership | Management commitment, a quality policy and clear roles | Governance and operational management |
| Risk | Risk-based planning of processes | Risk management and incident management |
| Documents | Controlled, current documented information | Policies, procedures and records kept up to date |
| Improvement | Internal audit, corrective action and management review | Feedback, complaints and continuous improvement |
The ISO 9001 checklist
Most care providers follow these steps in order. Smaller organisations can combine some of them.
- Get leadership commitment. The board or owner approves the project, the budget and a project lead.
- Run a gap analysis. Compare what you already do with each clause of ISO 9001 and with your sector standards.
- Set the scope. Decide which services and sites the certificate will cover.
- Build the quality management system. Write the quality policy, quality objectives and the procedures the gap analysis showed were missing.
- Set up document control. Give every controlled document an owner, a version number and a review date.
- Train staff and run the system. Staff need to use the new processes long enough to produce real records.
- Run an internal audit and a management review. Check the system against the standard, fix what you find, and have leadership review the results.
- Book the certification audit. Choose an accredited certification body and prepare for the stage 1 and stage 2 audits.
Start with a gap analysis and a clear scope
A gap analysis tells you how much work is ahead. Most registered NDIS and aged care providers already have policies, a risk register and a complaints process, so the gap is often smaller than expected. The usual gaps are in the parts ISO 9001 adds: measurable quality objectives, formal internal audits and a recorded management review.
- Map each ISO 9001 clause to the policy, register or record that meets it, and mark the ones with nothing.
- Note where the same document can serve ISO 9001 and your sector standards, so you do not write things twice.
- Agree the scope early. Adding a site or service later means more audit time.
If you are still getting your sector compliance in order, fix that first. Our article on common compliance mistakes new providers make covers the usual starting problems.
Build the quality system and control your documents
The quality management system is the set of policies, procedures and records that describe how you run the organisation. It should reflect what staff actually do. A manual copied from a template that nobody follows will not survive a certification audit.
- Quality policy: a short statement, signed by leadership, of what quality means for your services.
- Quality objectives: measurable targets with an owner and a date, reviewed at least once a year.
- Procedures: written for the key processes, such as intake, service planning, incidents, complaints and staff induction.
- Registers: risk, incidents, complaints and feedback, and a corrective action or continuous improvement register.
Document control is where many providers slip. Each controlled document needs a version number, an owner, an approval date and a next review date. Old versions should be removed from use but kept on file. Staff should always be able to find the current version quickly.
Internal audit and management review
ISO 9001 expects you to check your own system before anyone else does. An internal audit tests whether each process follows the procedure and meets the standard. It needs an audit plan, auditors who do not audit their own work, and written findings.
Management review is a formal meeting where leadership looks at how the system is performing. The standard lists the inputs, which include audit results, customer feedback, the status of objectives, risks and corrective actions. The minutes should record the decisions made and the actions assigned, with owners and dates.
- Complete at least one full internal audit cycle before the certification audit.
- Log every finding in a corrective action register and close it with evidence.
- Hold a management review after the internal audit and keep the signed minutes.
The same habits help at your sector audits. Our audit remediation checklist shows how to close findings in a way auditors accept.
The certification audit
Certification is carried out by an independent certification body. Choose one that is accredited to certify ISO 9001, because a certificate from an unaccredited body carries little weight with funders or partners. Ask whether its auditors have worked with care providers.
The audit usually runs in two stages. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the system is working in practice, through records, observation and staff interviews. Any non-conformities raised must be addressed before the certificate is issued. After that, the certification body returns for regular surveillance audits.
Our ISO compliance support covers the gap analysis, the quality system and preparation for the certification audit. We quote a fixed fee after a free 15-minute call. Book a call.
Frequently asked questions
Is ISO 9001 required for NDIS or aged care providers?
No, it is voluntary. Your NDIS registration and aged care assessment are separate requirements that apply whether or not you hold ISO 9001.
Does ISO 9001 replace the NDIS Practice Standards audit?
No. ISO 9001 is a general quality management standard, and the NDIS Practice Standards cover care-specific requirements it does not address. Many providers find the same quality system supports both audits.
How long does ISO 9001 certification take?
It depends on your starting point and size. The main factor is how long it takes to run the system and produce records, including a full internal audit and management review.
Who can certify us?
An independent certification body accredited to certify ISO 9001. Consultants can help you prepare, but they cannot certify the system they helped build.