ISO 9001, ISO 9002 and ISO 9003 are the three standards against which a quality system can be audited and certified. ISO 9001 certification of a quality system does not signify a higher level of quality than ISO 9002 certification, and the latter is not “better”, or of a higher quality ranking than ISO 9003 certification.
So, an organization chooses that its quality system be certified against ISO 9001, ISO 9002, or ISO 9003 according to the business processes covered by the quality system. Advertisements which imply a quality ranking between the three standards are misleading and should be avoided.
The three standards differ in their scopes:
ISO 9001 sets out the requirements for an organization whose business processes range all the way from design and development, to production, installation and servicing.
For an organization which does not carry out design and development, ISO 9002 is the appropriate standard since it does not include the design control requirements of ISO 9001 – otherwise, its requirements are identical.
ISO 9003 is the appropriate standard for an organization whose business processes do not include design control, process control, purchasing or servicing, and which basically uses inspection and testing to ensure that final products and services meet specified requirements.