Quality portal

Your management system stops being a folder

Living documentation, planned audits, non-conformities with an owner, and indicators that calculate themselves. One platform for all your standards.

What a QMS is made of

A quality management system always consists of the same six pieces: the process map, document control, internal audits, nonconformities and corrective actions, indicators, and the management review. What separates a living system from a well-ordered folder is whether those pieces feed off daily work or get reconstructed the week before the audit. Kimobox is built for the former, and serves several standards at once without duplicating the system.

Content reviewed on 25 August 2026

Reference standard: ISO 9001:2015 Fifth edition, with Amd 1:2024 on climate change in 4.1 and 4.2
Common structure: Annex SL (harmonised structure) Ten clauses shared by ISO 9001, 14001, 45001, 27001 and others
Certification cycle: 3 years, with annual surveillance Two-stage initial audit and renewal in year three
Documented information: Clause 7.5 of ISO 9001 The standard has not required a quality manual since the 2015 edition
Standards covered: More than 20 in one installation ISO, food protocols, compliance and sector schemes

Document control

Versions, approvals and distribution with read receipts.

Connected to your document cloud

Publish and version documents by connecting to OneDrive, Google Drive or SharePoint, without duplicating folders.

Audits

Annual program, checklists per standard, findings linked to actions.

Non-conformities

Root cause, action, owner, deadline and effectiveness check.

KPIs

Process objectives fed with real operating data.

Legal requirements

A register of legal and other requirements, with validity and compliance evaluation per standard.

Corrective actions

Root cause, action, owner, deadline and effectiveness check, all linked to the nonconformity.

Improvement actions

Improvement opportunities with an owner and tracking, beyond just fixing what already failed.

Management review

A pre-built report with indicators, audits and nonconformities, ready for the meeting.

What it covers

One system, several certifications

Integrated quality, environmental and safety management systems
Risk management and organizational context
A legal requirements register with validity and compliance evaluation
Equipment control, calibration and maintenance
Staff training and competencies
Suppliers, purchasing and evaluation
Management review with a pre-built report
Document manager with versioning, connected to OneDrive, Google Drive and SharePoint

Standards and bodies

We build on the reference standards

ISO

The International Organization for Standardization publishes the management standards Kimobox covers.

AENOR

Spain's leading certification body for ISO management systems.

UNE

Spain's standards body, author of the UNE standards and Spain's representative at ISO.

Standards covered

Pick your standard and see what it solves

GMP+ Animal feed safety Food industry · animal feed IATF 16949 Automotive Automotive SQAS2022 Chemical and logistics assessment Quality · chemical and logistics ISO 19600 Compliance management systems Compliance · guidance ISO 37301 Compliance management systems Compliance ISO 22716 Cosmetics manufacturing Quality · cosmetics GDPR Data protection Legal · data protection ISO 14001 Environmental management Environment SGE 21 Ethical and responsible management Social responsibility IFS Food Food safety Food industry FSSC 22000 Food safety management system Food industry BRCGS Global food standard Food industry ISO 14064 Greenhouse gases Environment · carbon footprint HACCP Hazard analysis and critical control points Food industry ISO 27001 Information security Cybersecurity ISO 20000 IT service management Quality · IT services ISO 13485 Medical devices Healthcare ISO 15189 Medical laboratories Quality · healthcare ENS National Security Framework Security · public sector UNE 73401 Nuclear quality assurance Quality · nuclear ISO 45001 Occupational health and safety Health & safety ISO 9001 Quality management Quality · every sector ISO 26000:2010 Social responsibility Social responsibility · guidance Sustainability Sustainability management ESG UNE 19602 Tax compliance Compliance · tax ISO 17025 Testing and calibration laboratories Quality · laboratories

Real examples

The three symptoms of a dead system

Manufacturer · triple certification

Three systems for three standards

Before ISO 9001, 14001 and 45001 with three sets of procedures, three audit programmes and three management reviews. Everything done three times.

After One integrated system sharing processes, documents and audits, with only the standard-specific parts kept separate. There is one management review, covering all three.

Services · first certification

Nonconformities left open

Before A notebook of jotted incidents and no corrective action with an owner or a deadline. They all surface at once during the audit.

After Every nonconformity has an owner, a root cause, an action, a deadline and effectiveness verification. The auditor looks at the record, not at a verbal explanation.

Manufacturing · documentation

The circulating version is not the current one

Before Procedures sit on the network drive, but every department keeps a local copy. Nobody knows which is the right one.

After A single controlled document with its version, approver and date. Uncontrolled copies stop existing because they stop being necessary.

Vocabulary

The auditor's vocabulary

Nonconformity: Failure to meet a requirement, whether of the standard, the customer or the system itself. It is not a problem in itself: failing to detect them is.
Corrective action: A measure aimed at eliminating the cause of a nonconformity so it does not recur. Distinct from correction, which only repairs the immediate effect.
Documented information: The term ISO 9001:2015 uses for documents and records together. The standard stopped requiring a quality manual, though many organisations keep one out of habit.
Management review: Periodic analysis of the system by top management, with inputs and outputs listed in clause 9.3. It is where most systems come unstuck.
Annex SL: The high-level structure common to ISO management system standards. It is what makes integrating several standards into one system technically feasible.
Risks and opportunities: The approach introduced in 2015 that replaced preventive action: rather than reacting, the organisation must plan what could go wrong in each process and what it will do about it.

Frequently asked questions

What people ask us before getting started

Does it work for an integrated system?

Yes. A single process map and documentation shared across standards.

Can the auditor log in to check things?

They get a read-only account with exactly what they need to see.

Do you migrate our current documentation?

We load the structure and current documents during setup.

Does ISO 9001 still require a quality manual?

Not since the 2015 edition. The standard speaks of documented information and leaves each organisation to decide what it needs to write. Many keep the manual out of habit or because a customer asks, but an auditor cannot require it as such.

What changed with the 2024 amendment?

Amd 1:2024 added to clauses 4.1 and 4.2 the obligation to consider whether climate change is a relevant issue for the organisation and its interested parties. It is a short piece of text that nonetheless requires evidence of the analysis.

Can more than one standard live in the same system?

That is exactly the scenario it is built for. The common Annex SL structure allows sharing the process map, document control, audits, nonconformities and indicators, leaving only the standard-specific parts separate.

How long is the certification cycle?

Three years. The initial audit runs in two stages, there are annual surveillance audits, and renewal comes in year three. In between, what the auditor looks at is the day-to-day records.

What is a major nonconformity?

One that compromises the system ability to meet a requirement: a required process missing altogether, systematic failure, or a failure affecting the product. It usually blocks certification until closed, unlike a minor one.

Get ahead of your next audit

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 9001:2015 — Quality management systems. Requirements ISO · 2015 ed., with Amd 1:2024
ISO 19011:2018 — Guidelines for auditing management systems ISO · 2018 ed.
ISO Survey of certifications to management system standards ISO · Published annually

Quality and ISO standards software for SMEs

Kimobox's quality management software covers document control, internal audits, non-conformities, corrective and preventive actions, KPIs, risk management and management review, with full traceability of every record.

It's built for ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 13485, IATF 16949, IFS Food, BRCGS, FSSC 22000, HACCP, ISO 17025, ISO 15189, ISO 22716, UNE 73401, SQAS2022, GMP+, ISO 20000, ISO 14064, SGE 21, ISO 26000, ISO 19600, ISO 37301, UNE 19602, ENS, GDPR and ESG sustainability criteria, letting you run an integrated management system with documentation shared across standards.