Bond prepares ISO 9001 certification in Iraq and Kurdistan.
The base quality management system. It sets how work is planned, done, checked and corrected, and it is the certificate Iraqi buyers and tender committees ask for first.
ISO 9001 Quality management systems · Quality
What ISO 9001 is
ISO 9001:2015 is the international standard for a quality management system. It asks a company to define what it does, control how the work is carried out, measure the result, and correct what goes wrong. The certification body issues the certificate to the company.
What the standard requires
- Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 10 are the requirements an auditor checks.
- Clause 4, context. List the parties that matter, state what the quality system covers, and map the processes end to end.
- Clause 5, leadership. Management owns the system, signs the quality policy, and assigns responsibility for each process in writing.
- Clause 6, planning. Record the risks and opportunities for each process and set quality objectives with numbers and dates.
- Clause 7, support. Competence records, training, equipment and calibration, plus control of documents and records.
- Clause 8, operation. Review what the customer asked for before accepting the order, control the work, control suppliers, and stop nonconforming output.
- Clause 9, performance evaluation. Measure the objectives, run internal audits on a plan, and hold a management review.
- Clause 10, improvement. Log every nonconformity and complaint, find the cause, correct it, and show the correction worked.
Who needs ISO 9001 in Iraq and Kurdistan
The buyers that ask for ISO 9001
| Buyer or list | What they ask for |
|---|---|
| KRG Approved Suppliers Center | asc.gov.krd. Annual registration. Certificates must come from a recognised conformity body to clear the quality criteria. |
| Ministry of Natural Resources Approved Vendor List | mnronline.com/avl. Evaluates finances, quality system and HSE. A government fee applies by category, renewed each year. We confirm the current fee before you apply. |
| Kurdistan operators | DNO, Genel Energy, Gulf Keystone and HKN route suppliers through the MNR list and their own prequalification files. |
| Basra operators | Basrah Gas Company, Rumaila, EBS Petroleum and AL-WAHA run no public tenders. A supplier is invited once the file is accepted. |
| UN agencies through UNGM | ungm.org. One free registration covers UNDP, UNICEF, WFP, UNHCR, IOM and FAO. Three levels, in English. |
| Federal Ministry of Planning | Contractor classification and the federal unified electronic tendering platform. We confirm the current instruction before filing. |
| EPC contractors | Subcontractor files on projects in Kurdistan and Basra carry a quality prequalification section. |
| Foreign buyers and lenders | Buyers in the Gulf and Europe ask for a certificate from a body accredited under an IAF member before they place a first order. |
Two tracks, you choose one
Certificate track
5 daysA company that needs a valid certificate to register on the KRG ASC or the MNR AVL, or to answer a quality clause in a tender before the deadline. We prepare the compliance system in five working days. The certification body then issues the certificate, and its calendar sits outside those five days.
Steps- We read the tender or the registration form and confirm the standard, the scope and the body the buyer accepts.
- We agree the scope statement and the process map with the owner on the first of the five working days.
- We write the document set inside those five days: policy, objectives, process descriptions, procedures and forms.
- We train each process owner in a half day session on the records that person has to keep.
- We run the first internal audit and the management review in the same five days, then close the findings.
- We book the certification body, prepare the site, attend stage 1 and stage 2, and answer the findings with your team.
- The compliance system, prepared in five working days
- Scope statement and process map
- Quality policy and objectives with numbers and dates
- Procedures and forms in the working language
- Internal audit report and management review minutes
- Corrective action records for every finding
- The certification body's stage 1 and stage 2 reports
- A three year surveillance and renewal calendar
Implementation track
6 to 14 weeksA company that will be audited on its records by an operator or an EPC client, and wants the system used by staff every day.
Steps- We analyse what the company does and what its buyers and tenders require, then send a proposal.
- We map every process with the people who run it and write the risk register with them.
- We write the documentation in Arabic, Kurdish or English and keep it to the forms the staff will actually fill in.
- We train every department and hand the records over to the process owners.
- We let the system run live for three to four weeks so the certification body sees records from real work.
- We run the internal audit programme and the management review, then close the findings.
- We prepare the site, attend stage 1 and stage 2, answer the findings, and set the surveillance calendar.
- Process map and risk register built with the process owners
- Full documented system in the working language
- Training records for every department
- Three to four weeks of live records before the audit
- Internal audit programme, reports and management review minutes
- Supplier evaluation file and customer complaint log
- Corrective action records for every finding
- A three year surveillance and renewal calendar we run with you
The certification body issues the certificate.
The implementation track, week by week
| Phase | Weeks | What happens |
|---|---|---|
| Scope and buyer requirements | Weeks 1 to 2 | We confirm which sites and activities the certificate covers and which body the buyer accepts. Nothing is written before this is fixed. |
| Process mapping and risk register | Weeks 2 to 4 | We sit with each department, map how the work runs today, and record the risks and objectives for each process. |
| Documentation | Weeks 3 to 7 | Policy, procedures and forms written in Arabic, Kurdish or English. Forms are built around what the staff already record. |
| Training and rollout | Weeks 6 to 9 | A session per department on the records that department owns, plus a session for management on the review. |
| Records running live | Weeks 8 to 11 | The system runs in daily operations for three to four weeks so there is real evidence for the auditor to sample. |
| Internal audit and management review | Weeks 11 to 12 | We run the first internal audit against every clause, log the findings, and hold the management review with the owner. |
| Certification audit | Weeks 12 to 14 | The accredited body runs stage 1 on the documents and stage 2 on site. We prepare the site, attend both, and answer the findings. |
What we do, what you do
We do
- Confirm which standard, which scope and which certification body the buyer accepts, before any work starts.
- Write the whole documented system in the language the company works in.
- Train the process owners and management on the records they have to keep.
- Run the first internal audit and chair the management review.
- Select certification bodies, collect their quotes, and book the audit dates.
- Prepare the site, attend stage 1 and stage 2, and answer the auditor with your team.
- Write the corrective actions for every finding and submit the evidence to the body.
- Keep the surveillance and recertification dates in a calendar and prepare each audit.
You do
- Name one management representative who can give about four hours a week.
- Give us the current contracts, org chart, licences and any records the company already keeps.
- Release each process owner for a half day of training and a half day for the internal audit.
- Have the owner or general manager attend the management review, which takes about two hours.
- Use the forms in daily work during the live period so the auditor sees real records.
- Pay the certification body directly, or through us at cost with the receipts.
- Have the owner or general manager present at the opening and closing meetings of the certification audit.
What moves the price
- Number of sites and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
- Effective headcount, which sets the auditor days under the IAF MD 5 table.
- Number of processes and how different they are from each other.
- Whether the certificate has to come from a body accredited under an IAF member or a locally accredited body is enough.
- Languages the documentation is written in.
- How much usable documentation already exists in the company.
- Which track the company takes, the five day certificate track or the 6 to 14 week implementation track.
- Whether ISO 9001 is built alone or together with ISO 14001 and ISO 45001 as one system, which lowers total auditor days.
- Number of findings at stage 2 and how much evidence the body asks for to close them.
The proposal names the scope, the deliverables and the dates before work starts.
ISO 9001 questions we are asked
We prepare the compliance system in five working days on the certificate track. The implementation track runs six to fourteen weeks. The certification body then issues the certificate on its own calendar. Bureau Veritas, SGS, TUV and KQC in Erbil each set their own audit dates.
The proposal names the scope, the deliverables and the dates before work starts.
A certificate from a body accredited by IQAS, for example KQC in Erbil, is valid in Iraq and accepted for KRG lists. IQAS is not a member of the IAF Multilateral Recognition Arrangement. Oil companies, UN agencies and foreign buyers normally require a body accredited under an IAF member, such as Bureau Veritas, SGS or TUV. We confirm which one the buyer accepts before any body is booked.
KRG ASC registration at asc.gov.krd is annual and asks for certificates from a recognised conformity body under its quality criteria. The MNR Approved Vendor List at mnronline.com/avl evaluates the quality system next to finances and HSE. In practice a company without ISO 9001 does not clear those criteria, and operators such as DNO, Genel Energy, Gulf Keystone and HKN take their suppliers from those lists.
Three years from the date of issue. The certification body runs a surveillance audit each year and a recertification audit in year three. We keep those dates in a calendar and prepare the company for each one. If a surveillance audit is missed the body can suspend the certificate, and a suspended certificate will not pass a list renewal at the KRG ASC or the MNR AVL.
Yes. We work anywhere in Iraq, in Basra, Baghdad, Kirkuk, Erbil, Sulaymaniyah and Duhok, and in the Gulf. The office is in Erbil and the team travels to the site.
No. All three use the Annex SL structure, so clauses 4 to 10 line up and one integrated system covers them. Building the three together saves documentation work, and the certification body can audit them in one visit, which lowers total auditor days. The number of standards is what moves the implementation track between six and fourteen weeks. Contractors bidding to operators in Kurdistan and Basra are usually asked for all three.
Business inquiry
Select a target. Two questions follow, and the file reaches the desk on WhatsApp. A reply comes within four working hours.