ISO 9001
ISO 9001, as a byproduct.
Run your business properly in Rockbase and the evidence an auditor wants is already there. Certification-ready, never certified by us.
A quality management system is almost a re-description of a well-run company. Rockbase already holds the primitives a QMS needs: controlled documents, records as evidence, an audit trail, risk, corrective actions, measurable objectives. ISO 9001 rides over them as a lens. It maps each clause to the evidence you're already producing, and shows you exactly where the gaps are.
The primitives
Good-business records, built in.
Controlled documents
Versioned, approved, reviewed, with the right people in scope.
Records as evidence
Immutable, stamped with what produced them.
Audit trail
Every change, who made it and when. ISO records by default.
Risk & controls
A live register, with controls mapped to the risks they mitigate.
Nonconformity & CAPA
Corrective actions that run as tracked workflows.
Objectives & KPIs
Measurable, mapped to real data, reviewed on schedule.
Readiness dashboard
For each clause: is the evidence there? Gaps become a to-do list.
Clause coverage
Every clause we pack, and the one we do not.
Taken from the clause pack that ships, not from the standard's contents page. §8 is a row rather than an omission — a coverage table that quietly drops the uncovered clause is the fake-green the readiness board refuses to show you.
| Clause | What it asks for | What evidences it in Rockbase | How |
|---|---|---|---|
| §4.1 | The organisation and its context | Your SWOT and PESTLE registers | Automatic |
| §4.2 | Interested parties and their requirements | The interested-parties register | Automatic |
| §4.4 | The QMS and its processes | Processes modelled on the spine, with their interactions | Automatic |
| §5.2 | Quality policy | Your purpose and mission, with the formal policy document pinned on top | Automatic |
| §5.3 | Roles, responsibilities and authorities | Roles and seats in the org model | Automatic |
| §6.1 | Risks and opportunities | The risk register, with controls mapped to what they mitigate | Automatic |
| §6.2 | Quality objectives, and planning for them | Objectives with a live, judged KPI — measurable is the requirement | Automatic |
| §7.2 | Competence | Competence records held against your people | Automatic |
| §7.5 | Documented information | Controlled documents: versioned, approved, reviewed | Automatic |
| §8 | Operation | Not packed yet — product and service requirements, design controls and external providers have no primitive in the spine | Not packed |
| §9.1.1 | Monitoring, measurement, analysis and evaluation | Anything measured, with a real reading judged against its target | Automatic |
| §9.1.3 | Analysis and evaluation | A breached measure raised as a challenge against the objective it measures | Automatic |
| §9.2 | Internal audit | An internal-audit record from the last 12 months | By hand |
| §9.3 | Management review | A management-review record from the last 12 months | By hand |
| §10.2 | Nonconformity and corrective action | A nonconformity record, or an entry in the CAPA log | Automatic |
- Automatic
- A rule finds the evidence in records you produce by running the business. Nothing to assemble for the audit.
- By hand
- Deliberately not automatic. Internal audit and management review are things a person does; the board keeps them open until the record exists, which is the lens working.
- Not packed
- We have not packed it, and we would rather show you the row than leave it off the table.
How it stays honest.
Rockbase can't fake a record. It can only make true ones easy to create and surface the gaps that remain. An accredited body issues the certificate; Rockbase gets you ready for it and keeps you there.
Questions
Answers.
Build on solid ground.
We're taking on a small number of founding clients. If your strategy and your work have drifted apart, let's fix the foundation.
Apply for early access