Bond prepares ISO 29001 certification in Iraq and Kurdistan.
ISO 9001 with the petroleum sector requirements added. It controls how equipment and services for oil and gas are made, inspected and traced, and operators read it in the vendor file.
ISO 29001 Petroleum, petrochemical and natural gas quality management · Oil and gas
What ISO 29001 is
ISO 29001:2020 is the quality management standard for companies that supply products and services to the petroleum, petrochemical and natural gas industry. It carries the ISO 9001:2015 requirements and adds sector requirements on design control, supplier and subcontractor qualification, inspection and test planning, traceability and records retention. The certification body issues the certificate to the company.
What the standard requires
- Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 10 are the requirements an auditor checks, and the sector requirements sit inside them.
- Clause 4, context. List the parties that matter, state which products and services the certificate covers, and map the processes from enquiry to delivery.
- Clause 5, leadership. Management owns the system, signs the quality policy, and assigns responsibility for each process in writing.
- Clause 6, planning. Record the risks for each process, plan contingency for critical supply, and set quality objectives with numbers and dates.
- Clause 7, support. Competence records for welders, inspectors and machine operators, calibration of every measuring instrument, and control of documents and records with a defined retention period.
- Clause 8, design and supply. Control design where the company designs, review the order before accepting it, qualify suppliers and subcontractors on record, and control special processes such as welding, heat treatment, coating and NDT.
- Clause 8, inspection and traceability. Plan the inspection and test points, record the result at each one, keep traceability from the material certificate to the delivered item, and control the release of nonconforming product.
- Clause 9, performance evaluation. Measure the objectives, run internal audits on a plan, and hold a management review.
- Clause 10, improvement. Log every nonconformity, complaint and field failure, find the cause, correct it, and show the correction worked.
Who needs ISO 29001 in Iraq and Kurdistan
The buyers that ask for ISO 29001
| Buyer or list | What they ask for |
|---|---|
| Kurdistan operators | DNO, Genel Energy, Gulf Keystone and HKN buy equipment and services against sector specifications and route suppliers through the MNR list. |
| Ministry of Natural Resources Approved Vendor List | mnronline.com/avl. Evaluates finances, quality system and HSE. A government fee applies by category, renewed each year. We confirm the current fee before you apply. |
| Basra operators | Basrah Gas Company, Rumaila, EBS Petroleum and AL-WAHA run no public tenders. A supplier is invited once the vendor file is accepted. |
| EPC contractors | Vendor and subcontractor files on oil and gas projects in Kurdistan and Basra carry a sector quality section with inspection and test requirements. |
| API licensees and API aligned buyers | ISO 29001 is aligned with API Spec Q1. Buyers working to API specifications accept it where a general quality certificate is not enough. |
| KRG Approved Suppliers Center | asc.gov.krd. Annual registration. Certificates must come from a recognised conformity body to clear the quality criteria. |
| Foreign buyers and lenders | Buyers in the Gulf and Europe ask for a certificate from a body accredited under an IAF member before they place a first order. |
Two tracks, you choose one
Certificate track
5 daysA company that already sells to an operator or an EPC contractor and needs a valid sector certificate to answer a vendor questionnaire or an MNR AVL renewal before the deadline. We prepare the compliance system in five working days. The certification body then issues the certificate, and its calendar sits outside those five days.
Steps- We read the vendor questionnaire or the tender and confirm the scope, the product families and the body the buyer accepts.
- We agree the scope statement, the product and service list and the process map with the owner on the first of the five working days.
- We write the document set inside those five days: policy, objectives, procedures, inspection and test plans, and the job file format.
- We set the traceability rule from material certificate to delivered item and the records retention periods.
- We train each process owner and inspector in a half day session on the records that person has to keep.
- We run the first internal audit and the management review in the same five days, then close the findings.
- We book the certification body, prepare the site, attend stage 1 and stage 2, and answer the findings with your team.
- The compliance system, prepared in five working days
- Scope statement with the product and service families
- Process map and quality objectives with numbers and dates
- Procedures and forms in the working language
- Inspection and test plans with hold and witness points
- Supplier and subcontractor qualification file
- Traceability rule and records retention schedule
- Internal audit report and management review minutes
- A three year surveillance and renewal calendar
Implementation track
6 to 14 weeksA company that is audited by an operator vendor team on real job files, and wants traceability, inspection records and supplier control running on every order.
Steps- We analyse what the company does and what its buyers and tenders require, then send a proposal.
- We map every process with the people who run it, from the enquiry to the delivery note, and write the risk register with them.
- We build the inspection and test plans with the workshop and the inspectors and set the hold and witness points.
- We write the documentation in Arabic, Kurdish or English and keep it to the forms the staff will actually fill in.
- We qualify the suppliers and subcontractors on record, including the mills, the coating shops and the test houses.
- We let the system run for three to four weeks so complete job files exist for real orders before stage 2.
- We run the internal audit programme and the management review, then prepare the site and attend stage 1 and stage 2.
- Process map and risk register built with the process owners
- Full documented system in the working language
- Inspection and test plans and completed job files for real orders
- Welder, inspector and operator competence records
- Calibration register for every measuring instrument
- Supplier and subcontractor qualification and evaluation file
- Three to four weeks of live production, inspection and traceability records
- A three year surveillance and renewal calendar we run with you
The certification body issues the certificate.
The implementation track, week by week
| Phase | Weeks | What happens |
|---|---|---|
| Scope and buyer requirements | Weeks 1 to 2 | We confirm which product families, services and sites the certificate covers and which body the buyer accepts. Nothing is written before this is fixed. |
| Process mapping and risk register | Weeks 2 to 4 | We sit with each department, map the work from enquiry to delivery note, and record the risks and objectives for each process. |
| Inspection and test planning | Weeks 3 to 6 | We build the inspection and test plans with the workshop and the inspectors, set the hold and witness points, and fix the traceability rule. |
| Documentation | Weeks 4 to 8 | Policy, procedures, job file format, calibration and retention rules, written in Arabic, Kurdish or English around the records the company already keeps. |
| Training and supplier qualification | Weeks 7 to 9 | A session per department on the records it owns, plus qualification of the mills, coating shops, test houses and subcontractors on record. |
| Job files running live | Weeks 8 to 11 | Real orders run through the new job file for three to four weeks so the auditor samples complete files with material certificates and test results. |
| Internal audit and management review | Weeks 11 to 12 | We audit every clause including the sector requirements, log the findings, and hold the management review with the owner. |
| Certification audit | Weeks 12 to 14 | The accredited body runs stage 1 on the documents and stage 2 on site. We prepare the site, attend both, and answer the findings. |
What we do, what you do
We do
- Confirm which standard, which product families and which certification body the buyer accepts, before any work starts.
- Map the processes and write the whole documented system in the language the company works in.
- Build the inspection and test plans with the workshop and set the hold and witness points.
- Set the traceability rule and the records retention periods the sector requirements ask for.
- Qualify the suppliers and subcontractors and build the evaluation file with them.
- Train the process owners, the inspectors and management on the records they have to keep.
- Run the first internal audit and chair the management review.
- Select certification bodies, collect their quotes, book the audit dates, prepare the site and attend stage 1 and stage 2.
- Write the corrective actions for every finding and keep the surveillance and recertification dates in a calendar.
You do
- Name one management representative who can give about five hours a week.
- Give us the current contracts, product list, drawings, welding procedures and any records the company already keeps.
- Release each process owner and inspector for a half day of training and a half day for the internal audit.
- Give us the supplier list with the mill certificates and test reports you already hold.
- Run real orders through the new job file during the live period so the auditor sees complete files.
- Have the owner or general manager attend the management review, about two hours, and the opening and closing meetings of the certification audit.
- Pay the certification body and any government fees directly, or through us at cost with the receipts.
What moves the price
- Number of sites and workshops, and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
- Effective headcount, which sets the auditor days under the IAF MD 5 table before the sector uplift.
- Whether the company designs product or only supplies to a customer drawing.
- Number of product families and special processes such as welding, heat treatment, coating and NDT.
- How many suppliers and subcontractors have to be qualified and kept on record.
- Whether the certificate has to come from a body accredited under an IAF member or a locally accredited body is enough.
- Languages the documentation is written in.
- How much usable documentation already exists, including any API Spec Q1 work already done.
- Which track the company takes, the five day certificate track or the 6 to 14 week implementation track.
- Whether ISO 29001 is built alone or together with ISO 14001 and ISO 45001 as one system, which lowers total auditor days.
The proposal names the scope, the deliverables and the dates before work starts.
ISO 29001 questions we are asked
We prepare the compliance system in five working days on the certificate track. The implementation track runs six to fourteen weeks. The certification body then issues the certificate on its own calendar. Fewer bodies in Iraq carry an auditor qualified for the petroleum sector, so Bureau Veritas, SGS or TUV is booked early.
The proposal names the scope, the deliverables and the dates before work starts.
ISO 29001:2020 carries the ISO 9001:2015 requirements and adds petroleum sector requirements on top. The additions cover design control, supplier and subcontractor qualification, inspection and test planning, control of special processes such as welding, traceability from the material certificate to the delivered item, and defined records retention. Operators in Kurdistan and Basra ask for it when the supplier makes or handles equipment rather than only supplying labour. A company certified to ISO 29001 already meets the ISO 9001 requirements, and one body can issue both certificates from one audit for a small addition to the auditor days.
A certificate from a body accredited by IQAS, for example KQC in Erbil, is valid in Iraq and accepted for KRG lists. IQAS is not a member of the IAF Multilateral Recognition Arrangement. Operators such as DNO, Genel Energy, Gulf Keystone and HKN and their EPC contractors normally require a body accredited under an IAF member, such as Bureau Veritas, SGS or TUV. We confirm which one the buyer accepts before any body is booked.
Operators and their EPC contractors. DNO, Genel Energy, Gulf Keystone and HKN in Kurdistan take suppliers from the Ministry of Natural Resources Approved Vendor List at mnronline.com/avl, where the quality system is scored next to finances and HSE. Basrah Gas Company, Rumaila, EBS Petroleum and AL-WAHA invite a supplier once the vendor file is accepted. Buyers working to API specifications accept ISO 29001 because it is aligned with API Spec Q1.
Yes. We work anywhere in Iraq, in Basra, Baghdad, Kirkuk, Erbil, Sulaymaniyah and Duhok, and in the Gulf. The office is in Erbil and the team travels to the site.
Three years from the date of issue. The certification body runs a surveillance audit each year and a recertification audit in year three. We keep those dates in a calendar and prepare the company for each one. If a surveillance audit is missed the body can suspend the certificate, and a suspended certificate will not pass a vendor file review with DNO or Basrah Gas Company, or a renewal at the MNR AVL.
Business inquiry
Select a target. Two questions follow, and the file reaches the desk on WhatsApp. A reply comes within four working hours.