CHRA DOSH Requirements: 4 Steps to Get Right
CHRA stands for Chemical Health Risk Assessment. In Malaysia it is the written assessment that DOSH (JKKP) requires from every employer whose staff may be exposed to chemicals hazardous to…
ISO 9001 is the international standard for quality management systems, and the only one in its family that an organization can be certified to. As of October 2026, the current edition is ISO 9001:2026, published on September 16, 2026. The 2015 edition still quoted in many places has been withdrawn.
Often, the request starts with a customer or a tender that asks for the certificate. Then comes the question of who to call, and that is where the confusion begins. ISO does not issue certificates. Neither does a consultant.
In this guide, we set out who does what, using the wording of ISO, Global ACI, Standards Malaysia and SIRIM QAS:
ISO describes ISO 9001 as a globally recognized standard for quality management. Its requirements define how an organization builds a quality management system (QMS) and then keeps improving it. It is written for organizations of all sizes and sectors, and ISO reports more than one million certificates issued in 189 countries.
The 2026 edition is the sixth. ISO says it focuses on clarity, so that organizations of any size and maturity can understand the requirements better. It puts more weight on quality culture and leadership, and it treats risks and opportunities separately. The full text is sold by ISO, so this guide quotes only what ISO publishes openly.
ISO’s own answer is no. Certification is a choice, and an organization can apply ISO 9001 without ever being audited. ISO adds one caveat: for some industries, certification is a legal or contractual requirement.
In practice, the push often comes from a buyer. One quality professional in Malaysia describes multinational customers that ask for ISO 9001 before they register a supplier or contractor. Tenders can work the same way. Check the contract or the tender documents first. They show whether the certificate is required and which scope it has to cover.
Each of the four parties has a different job, so it pays to know which one to call for what.
ISO writes and publishes the standard, and stops there. In its own words, “ISO does not perform certification or issue certificates.” A company cannot be certified by ISO.
A certification body audits your system and issues the certificate. SIRIM QAS International is one example in Malaysia. It states that it holds accreditation from the Department of Standards Malaysia and from the United Kingdom Accreditation Service.
An accreditation body checks the certification bodies themselves. In Malaysia, that is the Department of Standards Malaysia (JSM), which describes itself as both the National Standards Body and the National Accreditation Body. At international level, Global ACI has taken over the roles formerly held by the International Accreditation Forum (IAF).
A consultant or training provider sits outside that chain. It can help you build and run the system, but it cannot certify you. Certification bodies keep the line clear from their side too: SIRIM QAS says it does not offer training or consultancy, to protect the impartiality its accreditation body requires.
Certification is written assurance from an independent body that your system meets the requirements. Accreditation is the formal recognition that the certification body itself works to international standards. Your organization is certified; the body that certifies it may be accredited.
ISO adds a nuance. Accreditation is not compulsory, and a certification body without it is not necessarily disreputable. Even so, ISO’s advice when choosing one is to compare several bodies and check whether each is accredited. JSM keeps a public online directory of the organizations it accredits, so that check takes little effort.
Each certification body sets out its own process, so ask for theirs. As an example, SIRIM QAS publishes these nine steps:
No step on that list involves a consultant. The system has to be in place before the audits start, and that work happens inside your organization, with or without outside help.
SIRIM QAS defines both audits. Stage 1 determines whether your management system documentation is adequate and whether you are ready to proceed. Stage 2 evaluates how the system is implemented, including whether it is effective.
Auditors on an international ISO 9001 forum on Reddit add a point worth planning for. They say it is hard to get through Stage 2 without a completed internal audit program and a management review. That is field experience rather than the wording of the standard, but it shows what to finish first.
After Stage 2, the certification body recommends and approves certification, or does not. That decision is theirs alone, and no consultant can promise the outcome.
For many organizations, getting certified is the easier half. The quality professional in Malaysia mentioned earlier named the real headache plainly: finding the right person to get the company certified, then to maintain the certification year to year.
SIRIM QAS sets out what maintaining means. Every certified organization has one surveillance audit a year, and the first comes within 12 months of certification. Renewal depends on a satisfactory recertification audit before the certificate expires. SIRIM QAS states that its certificates are valid for 3 or 5 years, depending on the scheme, so confirm the cycle with your own certification body.
Two things can slip between audits. The first is leadership: one practitioner abroad said the hardest part was getting management to take on the extra work. The second is the management review itself, which one quality coordinator warned could become a major nonconformity if it was delayed again.
Auditors also differ. One quality manager felt that different auditors look for different things, and a long-time external auditor replied that each has their own hot buttons. The steady answer is a system your own people can check, with internal audits that run on schedule and a management review held on time.
Global ACI published its transition rules on September 16, 2026, the same day as the standard. It set a three-year transition period. Two dates matter most to organizations:
The move can take place at a scheduled surveillance or recertification audit, or in a separate transition audit.
SIRIM QAS has written to its certified clients with its own rules inside that window. It says all ISO 9001:2015 certificates will cease to be valid after September 30, 2029. Its surveillance and recertification audits after September 30, 2028 follow the 2026 edition. According to SIRIM QAS, organizations that miss the deadline will generally need a new initial certification, Stage 1 and Stage 2 included.
Other certification bodies may set their own steps within the Global ACI timeline. ISO’s advice is the same for everyone: certified organizations should contact their certification body. If you are starting from zero, ask each body you compare which edition it can audit against today.
We do not certify, and we take no part in the certification decision; that belongs to the certification body. Our work is the system around it. Our ISO 9001 consulting works alongside your team to develop and implement your processes. Our awareness, internal auditor and refresher courses are for the people who run and check the system.
If a customer or a tender has just asked your organization for ISO 9001, we can talk through where you stand and which step comes first.
Connect with us today to plan the next step. Call or WhatsApp +6010 208 0698, email in**@*********************om.my, or get a free consultation.
There is no fixed price, and each certification body quotes its own fee. SIRIM QAS, for example, says its fee depends on the size of the organization and the scope of certification. The number of employees, the location, and the type and number of schemes also count. Consulting or training support is a separate cost. Contact us and we can help you scope it.
SIRIM QAS says the timeline depends on the readiness of the client. The audits can only move as fast as your system can show evidence that it works. Ask each certification body for a timeline with its quotation, and treat any fixed promise with caution.
Yes. SIRIM QAS answers this in its FAQ: a very small organization can be certified, provided it can demonstrate compliance with the requirements of the standard.
ISO points to IAF CertSearch, the International Accreditation Forum’s global database. If something looks wrong, ISO says complaints go to the certification body that certified the organization, not to ISO.
Not in the way a company is. Company certification is an audit of the organization’s quality management system. Lead auditor, lead implementer and internal auditor courses are for individuals: they show what a person has learned, and they do not certify that person’s employer.
Many Malaysian organizations know the standard as MS ISO 9001, the Malaysian Standard version. Malaysian Standards documents are sold through MySOL, the online system of the Department of Standards Malaysia, which offers more than 5,000 of them. The ISO 9001:2026 text is sold on ISO’s own website.