ISO 9001 software in South Africa: what to look for

What's the difference between certifying your QMS and buying ISO 9001 software?

A certification body audits your organisation. If you meet the standard, it issues an ISO 9001 certificate, a judgement about your management system made by an accredited third party. Software supports your management system by controlling documents, tracking approvals and keeping an audit trail. It is never itself "ISO 9001 certified", because certification applies to organisations.

In South Africa, look for a certification body that is SANAS-accredited. SANAS, the South African National Accreditation System, accredits certification bodies for quality management systems and other schemes, so a SANAS-accredited certificate carries a documented chain of trust from SANAS to the certification body to your organisation. A consultant can help you prepare for that audit. Software like Obel-MS gives your certification body the document control and audit trail evidence it will ask for, built around ISO 9001 clause 7.5. The certificate itself always comes from the accredited body.

Many of the South African search results for "ISO 9001 software" are certification consultancies advertising audit and certification services. They solve a different problem from software. A consultancy helps you get certified. Software runs your document control day to day, before and after the audit. Ask early which one you are talking to.

What should a South African SME check about data residency and POPIA?

POPIA does not flatly require your data to stay inside South Africa, but it does put conditions on moving personal information to a third party abroad, and it makes you accountable either way. Before choosing ISO 9001 software, ask where the servers are and who is legally responsible for what.

Under POPIA, the responsible party is whoever decides why personal information is collected and how it is processed. For your supplier records and quality documents, that is your own organisation. An operator processes that information on your behalf under contract, without setting its own purpose for it. That is the role a hosted QMS vendor plays for the records you put into its system. Ask any vendor to state, in writing, which role it plays.

Cross-border transfer is the specific POPIA question that matters most when your vendor's servers are outside South Africa. Section 72 restricts transferring personal information about a data subject to a third party in a foreign country unless one of several conditions is met, most commonly that the recipient is subject to a law, binding rules or an agreement providing an adequate level of protection similar to POPIA's own, or that the data subject has consented to the transfer. Hosting with a South African provider sidesteps that question entirely for data that never leaves the country.

In practice, ask a vendor two direct questions: which country is your data physically stored in, and who else, such as subcontractors, subprocessors or a parent company abroad, might ever touch it? A vendor that can't answer both without checking should be asked again, well before you sign.

What else should you check before choosing ISO 9001 software in South Africa?

Beyond POPIA, a handful of practical checks separate a vendor built for South African SMEs from one that happens to sell here. Work through the table below with any vendor you're evaluating.

On cloud hosting and load-shedding, moving to a hosted system doesn't make load-shedding disappear. It moves the uptime problem from your own server room to your vendor's infrastructure and your team's internet connection. What it does remove is your dependency on a single office's power and a single physical server. Your team can reach a cloud-hosted system from anywhere with a connection, which a locally-installed system tied to one building cannot offer.

How does Obel-MS fit these checks?

South African customers can host Obel-MS on Google Cloud in Johannesburg (africa-south1), so their data stays in South Africa. It is priced in ZAR from R1,490 a month excluding VAT. All ZAR prices exclude 15% VAT. Billed annually. Month-to-month costs 15% more.See the full pricing page for every plan. For the documents and records you put into Obel-MS, we act as operator under POPIA. You remain the responsible party, and a data processing agreement is available on request. Full detail on hosting, access control and what's still on our roadmap is on the security and hosting page.

Obel-MS is not ISO 9001 certified, and no software can be. Only your organisation's QMS is certified, by an accredited body such as a SANAS-accredited certification body. Obel-MS also does not currently support single sign-on or multi-factor authentication. Both are listed as not yet available on the security page. Approvals in Workflow Manager are recorded in a full audit trail rather than issued as formal electronic signatures.

A short checklist for evaluating ISO 9001 software in South Africa

Use this list as a script for a first call with any vendor. A vendor that can answer all nine plainly, in writing, is one worth shortlisting.

• Where exactly are your servers, and who owns the infrastructure?
• Are you the responsible party or the operator for the data we put into your system?
• Is a POPIA data processing agreement available, and what does it say about cross-border transfer?
• Is pricing quoted in ZAR, and is it VAT-inclusive?
• What are your support hours, and where is your support team based?
• Can we export our full document set, metadata and audit trail if we leave, at no extra cost?
• Does your audit trail show who approved what, and when, in a format our certification body can review?
• Do you support single sign-on, multi-factor authentication or electronic signatures? If not, what is the alternative?
• Are you claiming ISO 9001 certification for your software? No software can hold one, so ask them to explain how.

None of these questions are unreasonable to ask. A vendor built for South African SMEs should answer every one without escalating to a sales engineer. If a vendor hedges on hosting location, data export or what "ISO 9001 software" means, treat that as an answer in itself.