ISO 9001 procedures: which you actually need, and which you do not

In short: ISO 9001 procedures are no longer a fixed list; the six mandatory procedures were dropped in 2015. Most small firms keep a handful: document control, purchasing, internal audit, management review, and handling problems through corrective action. Keep only those that help you run and prove your business; every extra one costs time to maintain. Buy just the ISO 9001 procedures you need and pay nothing for documents you’ll never use.

The fear here is drowning in paperwork, and I get it, but it's based on an old rule that's long gone. You need far fewer procedures than you think, only the ones that genuinely help you run the place. Most of what the standard wants, you're already doing; it's just a case of writing down the few that matter and skipping the rest. Let me show you which you actually need, so you buy only those, one business owner to another.

One of the biggest fears about ISO 9001 is the paperwork: the idea that you need dozens of formal procedures for everything. You do not, and a lot of the confusion comes from an old rule that no longer applies. Let me clear it up, because it will save you time and money.

The “six mandatory procedures” myth

If you have been reading around, you may have seen talk of six mandatory procedures. That comes from an older version of the standard, which did demand six specific documented procedures. People still search for them, and plenty of out-of-date pages still list them as if they were current.

They are not. The 2015 revision did away with that rigid list. ISO 9001 no longer tells you which procedures you must write. Instead it asks you to keep the documented information you actually need to run your business and prove it works. That is a big shift, and it is good news: it means a small business needs far fewer formal procedures than the old rule implied.

So which procedures do you actually need?

The honest answer is: the ones that genuinely help you run and evidence your business, and no more. For most small and medium sized businesses, a sensible core looks like this:

• Document control: how you keep your documents current, so people always work from the right version.
• Purchasing: how you choose and check the suppliers whose work goes into yours.
• Management review: how the people in charge regularly look at how the system is performing and decide what to change.
• Internal audit: how you check your own system honestly.
• Handling problems: how you deal with things that go wrong and stop them recurring.

Alongside a few of those you keep supporting forms and registers, the things you fill in and the lists you maintain, which are where your evidence actually lives. You do not need a formal procedure for every activity in the business. You need the few that earn their place. For the full list the standard asks for, see ISO 9001 required documents and records.

Procedure, process, work instruction: what the words mean

These get muddled, so here they are in plain terms. A process is simply a set of activities that turns something in into something out, like taking an order and delivering it. A procedure is a written description of how you carry out a particular task, the steps and who does what. A work instruction is a step-by-step guide for one specific job, written so anyone can do it the same way each time, like how to set up a particular machine.

You do not need all three for everything. Most small businesses need a few procedures, a set of forms and registers, and the occasional work instruction for a fiddly job. That is it.

Buy only what you need, or the lot

This is where we do things differently, and honestly. You do not have to buy a giant kit stuffed with procedures you will never use. Our ISO 9001 Essentials are sold individually, so you buy only the documents you actually need to fill your gaps, each written in plain English and ready to adapt, each with a boxed Operator's Take telling you why it earns its place.

The honest way to know which you need is a gap analysis, which shows you exactly what is missing. Buy those few, and you are sorted. If it turns out you need most of them, the complete Certification-Ready System gives you the whole set, including the top-level quality manual, for less bother than buying many singles. Either way, you only ever pay for what genuinely helps.

Frequently asked questions

What are the 6 mandatory procedures for ISO 9001?

There are no longer six mandatory procedures for ISO 9001; that requirement came from an older version of the standard and was removed in the 2015 revision. The current standard does not dictate a fixed list of procedures you must write. Instead it asks you to keep whatever documented information you genuinely need to run your business and prove it works, which for most small firms is far fewer than six formal procedures.

How many documented procedures does ISO 9001 require?

ISO 9001 does not require a set number of documented procedures; the old fixed list was dropped in 2015. You keep the procedures and records that are genuinely needed to run and evidence your particular business, which varies by size and what you do. For most small and medium sized businesses that means a handful of core procedures plus supporting forms and registers, not dozens.

Which procedures do I actually need for ISO 9001?

For most small businesses the useful core is document control, purchasing, management review, internal audit and a way of handling problems, supported by the relevant forms and registers. Beyond that, you add only what genuinely helps you run and prove your business. A gap analysis is the honest way to see exactly which you are missing, so you can buy only those rather than a bloated kit.

What is the difference between a procedure and a work instruction in ISO 9001?

A procedure describes how a task or process is carried out and who does what, while a work instruction is a step-by-step guide for one specific job so anyone can do it the same way each time. A procedure is broader; a work instruction is the fine detail for a single task. Most small businesses need several procedures and only a few work instructions, for the genuinely fiddly jobs.

Are there free ISO 9001 procedure templates?

Free ISO 9001 procedure templates exist, but they are often generic, out of date, or written in clause-speak you have to decode yourself. You can lose more time fixing a poor free template than adapting a good one. Our Essentials are written in plain English to the current 2026 standard, sold individually from $49, so you buy only the procedures you actually need, ready to adapt. For the full picture, here is free versus paid ISO 9001 templates.

Do I need to buy a full ISO 9001 procedures package?

No, you do not need a full package if you only have a few gaps; you can buy the individual procedures you need and no more. Our Essentials are sold individually for exactly this reason, so you are not paying for documents you will never use. If a gap analysis shows you need most of them, the complete Certification-Ready System is the tidier option, but that is your choice, not a forced upsell.

Find out exactly which procedures you need with the ISO 9001 gap analysis, then buy only those from the Essentials.

About the author

Written by Mike Armstrong, senior ISO consultant, former company director, and founder of Plain Standards. In over 30 years running companies at director level, Mike built his own management systems to drive profit long before he adopted ISO 9001, so he comes at this from the owner's side, not the auditor's. Plain Standards helps small and medium sized businesses get ISO certified without a consultant.