Guide · Quality

What is a quality management system (QMS)?

Q: Do we need ISO 9001 certification to have a QMS?

No. A QMS is simply the documented way your business runs; ISO 9001 is a standard you can certify that system against. Plenty of businesses run an ISO-aligned QMS without ever getting certified. Certification matters when customers demand it — government tenders, tier-one contractors and large corporates increasingly require the certificate, not just a quality policy on your website.

Q: How long does building a QMS take?

For a small business, weeks rather than months if you keep it right-sized: document what you actually do, fill the genuine gaps (nonconformance handling, internal audit, management review), and start using the registers. The traditional consultant route often stretches to six or twelve months; modern platforms that generate a tailored system from a structured questionnaire compress the drafting to days, leaving embedding as the real work.

Q: What documents are mandatory under ISO 9001?

ISO 9001:2015 explicitly requires a documented scope, a quality policy and quality objectives, plus records ('documented information') proving the system works — competence records, monitoring results, internal audit results, management review minutes, nonconformity and corrective action records, and operational records like design, traceability and calibration where they apply. Beyond that, you document whatever your business needs to operate consistently — the standard no longer mandates a quality manual or six specific procedures.

Q: Who should own the QMS in a small business?

Give day-to-day ownership to someone organised and close to operations — an operations or office manager is common — but keep accountability with the owner or managing director, because ISO 9001 puts leadership duties squarely on top management and auditors check for it. What fails is handing the whole thing to an external consultant: the system stops reflecting the business within months.

Q: How much does a QMS cost to run?

The real running cost is time: a few hours a month keeping registers current, an internal audit once or twice a year, and a management review that should fit in an hour. Software is typically low hundreds of dollars a month. If you certify, expect certification body fees in the low thousands per year for a small business, with a three-year cycle of surveillance and recertification audits. A bloated system multiplies all of these — the strongest argument for keeping it lean.

A quality management system is the documented way your business consistently delivers what customers ordered — the processes, responsibilities and records that make good work repeatable instead of dependent on whoever happens to be on the job. It is not a folder of paperwork. Here's what actually goes in one, how it relates to ISO 9001, and what a right-sized version looks like for a small Australian or New Zealand business.

The plain-English definition

Strip away the jargon and a QMS answers three questions: how do we do the work (processes), who is responsible for what (responsibilities), and how do we know it was done right (records). Every functioning business already has an informal version — it lives in the owner's head and a few veterans' habits. A QMS writes the important parts down, so quality survives staff turnover, busy periods and growth.

That's also why "we're too small for a QMS" misses the point. Small businesses feel inconsistency hardest: one key person off sick and jobs go sideways. The system exists precisely so the business, not the individual, holds the knowledge.

What's actually in a QMS

Different consultants dress it up differently, but a working QMS contains a recognisable core: a quality policy, documented procedures for your core processes, control of documents and records, competence and training records, supplier management, a way to handle things that go wrong (nonconformance and corrective action), internal audit, and management review. Here's each component, the question it answers, and what it looks like in real life.

Component	The question it answers	Example
Quality policy & objectives	What does "good" mean here, and what are we aiming at this year?	A one-page policy signed by the owner; three measurable objectives like "warranty callbacks under 2% of jobs".
Core process procedures	How is the work meant to be done, from enquiry to handover?	Short procedures for quoting, job setup, delivery/production, inspection and handover — a page or two each.
Document & record control	Is everyone using the current version, and can we prove what happened?	Version-numbered templates; completed job checklists filed against the job number.
Competence & training records	Is the person doing this work actually qualified to do it?	A training matrix listing licences, tickets and inductions with expiry dates.
Supplier management	Can we rely on the people we buy from?	An approved supplier list with criteria; a record when a supplier repeatedly ships late or off-spec.
Nonconformance & corrective action	When something goes wrong, do we fix the cause or just this instance?	A register capturing defects and complaints, root cause, the fix, and a check the fix worked.
Internal audit	Are we actually following our own system?	A once- or twice-yearly check of each process against the procedure, with findings tracked to closure.
Management review	Is the system working, and what will leadership change?	An hour with the owner reviewing feedback, objectives, audits and issues — minuted with decisions and owners.

QMS vs ISO 9001: system vs standard

These get used interchangeably, but they're different things. The QMS is the system — your policies, processes and records. ISO 9001 is the international standard that describes what a good QMS must do, and the benchmark you can have it independently certified against. You can absolutely run a QMS without ever certifying it, and many businesses do — the benefits of consistency don't require a certificate.

What's changed is the market. Government tenders, tier-one contractors and large corporates across Australia and New Zealand increasingly ask not "do you have a quality system?" but "are you ISO 9001 certified?" — and a self-declared system scores fewer points than a certificate from an accredited body. If tendering is in your future, build the QMS ISO-aligned from day one so certification is a short step, not a rebuild. Our ISO 9001 checklist walks through the standard clause by clause.

Signs a small business needs one

Rework and warranty calls are eating margin. The same mistakes recur because nothing forces the lesson into the process.
Tender knockbacks that mention a "quality system", "quality accreditation" or ISO 9001 — the clearest commercial signal you'll get.
Key-person dependency. One estimator, supervisor or technician holds the how-it's-done knowledge, and everything wobbles when they're away.
Inconsistent delivery between jobs or crews. Customers get a different experience depending on who they draw, and reviews say so.

Two or more of these and a QMS isn't red tape — it's the cheapest fix available, because you're already paying for the absence of one.

Right-sized vs bloated

The QMS's bad reputation comes from oversized implementations: a 200-page manual adapted from a corporate template, forty procedures nobody has read, and forms that exist only to be filled in before audits. That version genuinely is a waste of money — and it fails audits anyway, because auditors can tell when documents don't match reality.

A right-sized SME QMS looks different: short procedures people actually read (a page or two, written in the language of your trade), registers that get used because they're the same tools the team runs jobs with, and reviews that fit in an hour because the data is already compiled. The test of every document is brutal and simple: if it disappeared tomorrow, would anyone notice? If not, it shouldn't exist. ISO 9001:2015 supports this — it dropped the mandatory quality manual and lets you document only what your business needs. See our guide to ISO 9001 for small business for what lean-but-compliant looks like.

One system, three standards

A QMS is usually the first management system a business builds — and its bones (document control, training records, corrective action, internal audit, management review) are exactly the bones of an ISO 45001 safety system and an ISO 14001 environmental system. Build the QMS well and adding safety and environment later means extending one system, not running three. That combined structure is an integrated management system, and it's where most trade and services businesses in construction supply chains end up.

Where to start

Don't start by writing documents. Start by mapping the handful of processes that make or break your quality — usually quoting, job setup, delivery and handover — and write down what your best people already do. Then add the pieces almost every informal system is missing: a nonconformance and corrective action loop, a simple internal audit, and a scheduled management review. Use the system on real jobs for a month before you polish anything. A modest system that's genuinely used beats an impressive one that's ignored — in business results and in audits.

Skip the 200-page manual

Answer around 20 questions about your business and BigTick generates a complete, tailored quality management system — policies, procedures, registers and review templates sized for an SME, aligned to ISO 9001 and ready to extend to 45001 and 14001. Audit-ready in weeks, not months.

Start a free trial

Frequently asked questions

Do we need ISO 9001 certification to have a QMS?

No. The QMS is the system; ISO 9001 is the standard you can certify it against. Many businesses run an ISO-aligned QMS uncertified. Certification matters when customers demand it — and tenders increasingly do.

How long does building a QMS take?

Weeks, not months, if you keep it right-sized: document what you actually do, fill the real gaps, and start using the registers. Consultant-led builds often run six to twelve months; platforms that generate a tailored system compress drafting to days, leaving embedding as the real work.

What documents are mandatory under ISO 9001?

A documented scope, quality policy and objectives, plus records proving the system works: competence, monitoring, internal audit, management review, nonconformity and corrective action, and operational records where they apply. No quality manual is required any more — beyond the mandatory items you document what your business needs.

Who should own the QMS in a small business?

Day-to-day, someone organised and close to operations; accountability stays with the owner or MD, because ISO 9001 places leadership duties on top management. Outsourcing ownership entirely to a consultant is the classic failure mode.

How much does a QMS cost to run?

Mostly time: a few hours a month on registers, one or two internal audits a year, and an hour-long management review. Software is typically low hundreds per month; certification, if you pursue it, adds low thousands per year in audit fees for a small business.

Related guides

A plain-English overview of quality management systems and ISO 9001:2015, not a substitute for the standard or certification advice.